Is Signal HIPAA compliant?
No
Signal's legal terms do not offer a Business Associate Agreement. HHS guidance says a BAA is required when a service creates, receives or maintains PHI for a covered entity. The 'conduit' exception applies only to services with transient access to the PHI they transmit, and end-to-end encryption alone does not turn a messaging app into a HIPAA-covered service.
What to use instead
TigerConnect
BAA terms on vendor page · See vendor
Textline
BAA from the HIPAA Essentials plan · See vendor
OhMD
BAA from the Core plan · $300/mo per account
Sources
- signal.org/legal/
- www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-audio-telehealth/index.html
Last verified 2026-09-24. General information, not legal advice.