WhatsApp is not HIPAA compliant. Meta says so in its own terms for the WhatsApp Business Platform, and it does not sign the agreement a healthcare practice would need.
A few terms first, because the rest of this depends on them. HIPAA is the Health Insurance Portability and Accountability Act, the US law covering how patient information is handled. PHI, or protected health information, is any health detail that can be traced back to a person: a symptom, an appointment, a prescription, or a name attached to any of those.
A business associate, or BA, is an outside vendor that handles PHI on your behalf. A BAA, or Business Associate Agreement, is the contract that lets it do so. HHS, the US Department of Health and Human Services, writes the HIPAA rules and enforces them.
iShort answer
No. Meta's terms state that Meta is not a business associate and that the WhatsApp Business Platform is not HIPAA compliant. End-to-end encryption does not change that, because HIPAA also requires a BAA with any vendor that maintains PHI.
A practice can use WhatsApp for questions that involve no patient information. Patient conversations belong on a channel covered by BAAs end to end. On SiteGPT a BAA is available on the Enterprise plan only, and WhatsApp is off in a HIPAA workspace by default.
Four checks a messaging tool has to pass before it carries patient information.
A signed BAA
Fails. Meta's terms say Meta is not a business associate, so there is no BAA to sign.
Vendor's own position
Fails. Meta's terms state that the WhatsApp Business Platform is not HIPAA compliant.
Encryption
Passes for messages in transit. One safeguard does not make a system compliant.
Access controls and audit logs
Fails for a practice. Chats sit on staff phones, outside the practice's records and review.
What do Meta's terms say about HIPAA?
They answer the question directly. Clause 4.2 of the Meta Terms for WhatsApp Business Platform has the business acknowledge that "Meta is not a Business Associate or Subcontractor" as HIPAA defines those terms. The same clause says the platform "is not HIPAA compliant".
That settles the BAA question. HIPAA lets a practice share PHI with a vendor only under a BAA. A company that states it is not a business associate will not sign one.
WhatsApp's Business Messaging Policy adds a usage rule. It tells businesses not to use WhatsApp for telemedicine, or to send or request health information, where regulations bar sending that information to systems that do not meet heightened requirements. HIPAA is that kind of regulation.
Does end-to-end encryption make WhatsApp compliant?
No. Encryption is one of several safeguards HIPAA asks for, and it does not replace the contract.
HHS addressed this in its cloud computing guidance. A provider that maintains electronic PHI is a business associate "even if the CSP cannot view the ePHI because it is encrypted". The duty to have a BAA follows from holding the data, whether or not the vendor can read it.
Encryption also covers only the journey. Once a message arrives, it sits on a staff member's phone. The practice has no audit log of who read it, no control over backups, and no way to remove it when that person leaves.
| HIPAA expects | |
|---|---|
| A BAA with any vendor that maintains PHI | Meta states it is not a business associate |
| Access limited to authorized staff | Chats live on individual phones and linked devices |
| Audit logs of access to PHI | No log available to the practice |
| Retention and deletion the practice controls | Each user controls their own chats and backups |
| A breach process with the vendor | No BAA, so no breach terms |
Does the conduit exception cover WhatsApp?
It is unlikely to. The conduit exception lets a practice send PHI through a pure carrier without a BAA. HHS FAQ 245 names the postal service, couriers, and "their electronic equivalents" that act merely as conduits.
HHS reads the exception narrowly. Its cloud guidance says it is "limited to transmission-only services", including temporary storage incident to that transmission. A messaging platform that hosts business accounts, stores messages for delivery, and syncs chat history does more than carry a sealed envelope.
Meta has also closed the question from its side. A vendor that disclaims HIPAA compliance in its terms is not one a practice can rely on as a conduit.
This article is general information, not legal advice. A practice with a specific use in mind should put it to its own HIPAA counsel.
What if a patient asks to use WhatsApp?
Patient choice carries weight under HIPAA, but HHS has spoken about email, not about WhatsApp.
Under 45 CFR 164.522(b), a provider must accommodate reasonable requests to receive communications "by alternative means or at alternative locations". HHS FAQ 570 says the Privacy Rule does not prohibit unencrypted email with patients, given reasonable safeguards. The provider can warn the patient of the risks and let the patient decide.
HHS FAQ 2060 says the same about a patient's right to receive records by unencrypted email. It also says a practice may not require a patient to accept an unsecure method.
Three limits apply before a practice leans on this.
- Both FAQs address email. HHS has published no equivalent naming WhatsApp. Applying them to a messaging app is an inference, and one for counsel to confirm.
- The request is the patient's. It covers that patient's own communications after a warning. It does not make WhatsApp the practice's default channel.
- Meta's terms still apply. A patient's consent does not change what the platform's own terms say about health information.
The pandemic-era flexibility is also over. HHS's enforcement discretion for telehealth expired on 11 May 2023, with a transition period that ended on 9 August 2023.
What can a healthcare practice do on WhatsApp?
A practice can answer questions that involve no patient information. The line is whether the conversation ties a health detail to a person.
General information is fine. Anything that ties health details to a person is PHI.
Fine on WhatsApp
- Opening hours and holiday closures
- Address, directions, and parking
- Which insurers the practice accepts
- How to register as a new patient
- A link to the patient portal
Keep off WhatsApp
- Symptoms and test results
- Appointment details tied to a name
- Prescriptions and refill requests
- Insurance member numbers
- Photos of a condition or a document
The hard part is that patients do not know the line. Someone who finds a practice on WhatsApp will describe a rash or ask about a result. Receiving that message already puts PHI on a channel with no BAA.
Three controls reduce the risk.
- Say it up front. Set a greeting message that asks patients not to send health information and points to the portal or phone line.
- Never ask for PHI. Staff should not request a date of birth, a symptom, or a photo over WhatsApp.
- Move the conversation. When a patient shares health details, reply with the compliant route and continue there.
The greeting message itself is set up in the app, as shown in WhatsApp auto reply.
Can a HIPAA compliant chatbot run on WhatsApp?
Not for patient information. A chatbot vendor can sign a BAA for its own service. That BAA does not reach Meta, and every WhatsApp message passes through Meta's platform.
This holds for every vendor. A chatbot on WhatsApp is suitable for a practice's general questions and unsuitable for anything a patient would not want read aloud in the waiting room.
SiteGPT draws the line the same way. A HIPAA BAA is available on the Enterprise plan only, never on Starter, Growth, or Scale. In a HIPAA workspace, integrations are off by default, and the WhatsApp documentation says WhatsApp there is scoped as part of an Enterprise package. Meta's terms apply whatever the chatbot vendor agrees to.
A covered workspace narrows in other ways too. PHI is confined to end-user conversations, training content must stay free of PHI, and chats run in SiteGPT's own widget. The HIPAA workspace documentation describes the day-to-day behavior, and the standard agreement is published at sitegpt.ai/legal/baa. Reasonable amendments to it are worked in during onboarding.
What should a practice use instead?
Use a channel where every vendor in the chain has signed a BAA.
| Scenario | Best pick | Why |
|---|---|---|
| Results, prescriptions, and clinical questions | The patient portal | It sits inside the health record system, under that vendor's BAA, with access logs. |
| Questions on the practice website, including ones that touch PHI | A chatbot under a BAA | The vendor signs a BAA and conversations stay in its own widget. On SiteGPT this is Enterprise only. |
| Two-way texting with patients | A secure messaging tool that signs a BAA | Purpose-built tools offer a BAA, audit logs, and remote wipe. Confirm the BAA in writing. |
| Hours, directions, and how to book | WhatsApp, with a notice | General information involves no PHI. Tell patients not to send health details. |
The requirements a chatbot has to meet are laid out in what makes a chatbot HIPAA compliant. The questions to put to a vendor before signing are in HIPAA chatbot vendor questions, and what a BAA should contain is covered in chatbot BAA.
SiteGPT's program status is at sitegpt.ai/hipaa. How the product fits a practice is on the AI chatbot for healthcare page.
Is WhatsApp GDPR compliant for UK healthcare?
GDPR asks a different question. It has no equivalent of a BAA that a vendor either signs or refuses.
Two more terms help here. GDPR is the General Data Protection Regulation, and the UK keeps its own version. A controller decides why and how personal data is used, and a processor handles it on the controller's behalf.
Under WhatsApp's Business Data Processing Terms, WhatsApp processes customer data "as your Processor" and the business is the controller. The duty to use the tool lawfully stays with the business. Health data is a special category under GDPR, so the bar is high.
The UK regulator has acted on this. In August 2023 the Information Commissioner's Office reprimanded NHS Lanarkshire. As Digital Health reported, 26 staff had used a WhatsApp group between April 2020 and April 2022, and patient data was entered on more than 500 occasions. WhatsApp was not approved for patient data there.
The practical rule for a UK practice matches the US one. Use WhatsApp for general information, and keep patient data in systems the organisation has approved. The wider duties are covered in GDPR chatbot requirements.
Frequently asked questions
Is WhatsApp HIPAA compliant?
No. Meta's terms for the WhatsApp Business Platform state that Meta is not a business associate or subcontractor under HIPAA and that the platform is not HIPAA compliant.
Without a BAA, a healthcare practice cannot use WhatsApp as a system for protected health information.
Does WhatsApp sign a BAA?
No. Meta's terms state that Meta is not a business associate, and a business associate is the party that signs a BAA. None is offered for the WhatsApp Business Platform, and none was found for the free WhatsApp Business app.
Is WhatsApp HIPAA compliant because it is end-to-end encrypted?
No. Encryption is one safeguard among several. HIPAA also requires a BAA with any vendor that maintains PHI, along with access controls, audit logs, and a breach process.
HHS cloud guidance says a provider that maintains encrypted health information is still a business associate, even if it cannot read the data.
Can a doctor message a patient on WhatsApp if the patient asks?
HHS has addressed this for email, not for WhatsApp by name. Its guidance says a patient may ask to receive information by unencrypted email, and the provider should warn the patient of the risk first.
Applying that to a messaging app is an inference to confirm with counsel. It does not make WhatsApp a compliant system for routine use.
Can a healthcare practice use WhatsApp at all?
Yes, for conversations that involve no PHI. Opening hours, directions, parking, and accepted insurers are general information.
Patients may type health details anyway, so a practice needs a clear notice and a compliant channel to move those conversations to.
Can a HIPAA compliant chatbot run on WhatsApp?
The chatbot vendor's BAA does not extend to Meta. Messages on WhatsApp pass through Meta's platform, and Meta's terms say that platform is not HIPAA compliant.
A chatbot that handles patient information belongs on a channel covered end to end by BAAs, such as a website widget from a vendor that signs one.
Does SiteGPT offer WhatsApp in a HIPAA workspace?
Not by default. Integrations are off in a SiteGPT HIPAA workspace, and its documentation says WhatsApp there is scoped as part of an Enterprise package.
A SiteGPT BAA is available on the Enterprise plan only, never on Starter, Growth, or Scale.
Is WhatsApp GDPR compliant for a UK healthcare provider?
GDPR works differently from HIPAA. WhatsApp acts as a processor and the business is the controller, so the business carries the duty to use it lawfully.
In 2023 the UK Information Commissioner's Office reprimanded NHS Lanarkshire after staff shared patient data in a WhatsApp group that was not approved for that use.
Sources
- Meta Terms for WhatsApp Business Platform, Meta. Clause 4.2 on HIPAA.
- WhatsApp Business Messaging Policy, WhatsApp. The rule on telemedicine and health information.
- 45 CFR 160.103, Cornell Legal Information Institute. The definition of business associate.
- HHS FAQ 245, HHS. The conduit exception.
- Guidance on HIPAA and cloud computing, HHS. Encrypted data and the limits of the conduit exception.
- 45 CFR 164.522, Cornell Legal Information Institute. Requests for communications by alternative means.
- HHS FAQ 570 and HHS FAQ 2060, HHS. Unencrypted email with patients.
- HIPAA and telehealth, HHS. The end of pandemic enforcement discretion.
- WhatsApp Business Data Processing Terms, WhatsApp. Controller and processor roles.
- ICO reprimands NHS Lanarkshire, Digital Health. The 2023 reprimand.
- Connect WhatsApp and HIPAA workspace, SiteGPT documentation.