Is Signal HIPAA Compliant? No — And Encryption Isn't the Reason

The short answer

Signal is not HIPAA compliant. The answer is the same regardless of how your practice configures the app or which plan you use — Signal offers no Business Associate Agreement and no HIPAA-specific provisions.

The confusion here is understandable. Signal has excellent security. Its end-to-end encryption is well-regarded, and the Signal Protocol is used by other major messaging apps. Many clinicians assume that strong encryption equals HIPAA compliance. That assumption is wrong, and the gap matters.

Why encryption alone isn’t enough

HIPAA compliance requires four categories of safeguards, not one.

Technical safeguards cover encryption and access controls. Signal handles the encryption piece. It does not handle access controls — there’s no way to restrict who in a practice can view a Signal thread, log which staff members accessed which conversations, or revoke access when an employee leaves.

Administrative safeguards require documented policies, training, and a signed BAA with every vendor that handles PHI. Signal doesn’t sign BAAs.

Physical safeguards govern where data is stored and who can physically access it. Signal stores messages on device — which could be a personal phone without a device management policy — and has no healthcare-specific controls over physical access.

Organizational safeguards require the BAA and compliance agreements. Back to the same problem.

A practice using Signal for patient communications has a gap in all four categories simultaneously, despite Signal’s strong technical encryption.

The disappearing messages problem

Signal’s disappearing messages feature, which automatically deletes message threads after a user-configured period, creates a specific HIPAA problem beyond the BAA issue.

HIPAA requires covered entities to retain certain records for a minimum of six years. Communications about patient care — care coordination messages, treatment-related instructions passed through a messaging app, documentation of clinical decisions — may constitute records subject to this requirement.

Using disappearing messages for any patient-related communication destroys records your practice is legally obligated to keep. This is a records retention violation on top of the BAA violation.

The FTC and OCR position on consumer messaging apps

The FTC and the HHS Office for Civil Rights have both issued guidance warning covered entities against using consumer messaging apps for PHI. The warning applies to Signal, WhatsApp, standard iMessage (without additional MDM controls), and similar consumer platforms.

The enforcement history supports taking this seriously. Small practices have faced OCR investigations and civil monetary penalties for staff using consumer apps for patient communications. The OCR’s Right of Access enforcement actions show the agency is willing to act on complaints from patients and audits of small practices, not just large health systems.

What to use instead

Three purpose-built clinical messaging platforms cover the Signal use case within HIPAA-compliant infrastructure:

TigerConnect is widely used in hospital systems but has plans for smaller practices. It provides secure messaging, audit trails, and BAA coverage across voice, text, and image sharing.

Klara handles patient-facing messaging specifically — secure messaging between practice and patient, with BAA coverage and records retention built in.

Spruce Health covers both staff-to-staff and patient-facing communication, with HIPAA compliance and a BAA included.

The coordination gap beyond messaging

Secure messaging handles communications. Practices also need a compliant place for the work that follows those communications.

When a patient message generates a task — a follow-up call, a referral to schedule, a prescription to process — that task references patient context. It can’t live in a general task tool without HIPAA coverage, and it doesn’t belong in a messaging thread that might disappear.

We built PHIGuard to handle this coordination layer: HIPAA-compliant task management for small practices at $20/month flat for up to 10 staff. A BAA is included at every tier, no per-user fees. Staff can track patient-related work without creating compliance gaps in tools that were never designed for healthcare.