Violating HIPAA is easier than it should be. One doctor-patient message through non-secure chat is enough to put you in violation and HIPAA's civil penalties run from $50,000 per violation up to $1.5 million a year for repeat offenses. That's enough to close a clinic.
HIPAA compliant chat for a telemedicine app is patient communication - text, voice, video, file sharing - that meets HIPAA's Security Rule: encrypted in transit and at rest, access-controlled, audit-logged, and covered by a Business Associate Agreement (BAA) with every vendor that touches protected health information (PHI). Miss one of those, and none of it is compliant. This guide covers what HIPAA requires, the features that matter for telemedicine, and how to build it without turning compliance into a second product you maintain forever.
What is HIPAA, and how does it apply to chat?
HIPAA - the Health Insurance Portability and Accountability Act, enacted in 1996 is the US federal law that keeps private health information secure. It sets the rules for how healthcare organizations store, manage, and grant access to patient data.
Chat is squarely in scope. Sensitive information created inside a care relationship - images, file attachments, even IP addresses - moves easily through private messages and group threads. Less-secure chat apps ship with weak encryption, thin authentication, and few controls. That's exactly the gap HIPAA exists to close.
Are you subject to HIPAA?
Two roles matter. Covered entities provide treatment, payment, or healthcare operations - hospitals, doctors, pharmacies, insurers. Business associates are the services that transmit, store, or receive PHI on a covered entity's behalf - which, since a 2013 expansion, includes cloud vendors and chat software providers serving healthcare.
If you're building a telemedicine app that handles PHI, you're a business associate. So is your chat provider. Both are on the hook.
What counts as PHI in a telemedicine app?
PHI is any information that identifies a patient and relates to their health, care, or payment for care. In a chat context that's broad:
Medical records, from an MRI scan to blood test results
Billing records and payment methods
Conversations between patient and doctor, or between clinicians
Any message, note, image, voicemail, or video created inside the care relationship plus metadata that ties a person to a treatment
Assume more PHI than you'd expect, and protect accordingly.
What HIPAA actually requires from your chat
The Security Rule splits into administrative, physical, and technical safeguards. For messaging, these are the ones you implement in code and contracts:
| Requirement | What HIPAA expects | What it looks like in practice |
|---|---|---|
Encryption
| PHI protected in transit and at rest
| AES-256 at rest, TLS 1.2 in transit
|
Access controls
| Only authorized users reach PHI
| Role-based permissions, MFA, SSO
|
Audit controls
| A record of who accessed what, when
| Logs of message and data access
|
Integrity
| PHI can't be improperly altered or destroyed
| Message integrity, retention controls
|
Transmission security
| PHI is safe as it moves across networks
| Encrypted channels for chat, calls, files
|
BAA
| Contract making the vendor liable for PHI
| A signed BAA with every processor
|
Two things people get wrong here.
The BAA is the one that gets skipped. A covered entity or business associate must have a signed, executed BAA with every service provider that touches PHI. If a vendor handles PHI and won't sign one, you cannot use them for a compliant workflow - no matter how good their encryption is. The Department of Health and Human Services publishes a sample BAA if you need a starting point.
There is no official HIPAA certification. No government body stamps a product 'HIPAA approved.' Compliance is a shared responsibility between you and your vendors, established through safeguards and BAAs - not a certificate. Anyone selling you a 'HIPAA certificate' is selling you a PDF. (SOC 2 and HITRUST are real certifications, and they overlap heavily with HIPAA's safeguards, being SOC 2 compliant puts you most of the way there.)
One myth worth retiring: HIPAA does not require PHI to stay on US servers. There's no data-residency rule in the law. Safeguards and a BAA are what matter though some providers still prefer US-based data centers for their own policy reasons.
Must-have vs. nice-to-have chat features for telemedicine
Requirements get you compliant. Features get you adopted. Here's the split for a telemedicine chat client.
Non-negotiable, across text and video:
Enterprise-grade encryption. All data, in transit or at rest, encrypted at AES-256 or higher.
Strong authentication. MFA plus unique credentials before anyone reaches PHI.
Automatic logoff. Doctors set devices down mid-shift. Auto-logoff keeps an unattended screen from becoming a breach.
Nice-to-have, and worth it for adoption:
Notifications and reminders. Pre- and post-care reminders cut no-shows and improve follow-through.
Rich media. Audio, video, and images together make a virtual visit feel closer to an in-person one.
Secure file sharing. Lab results and diagnostic scans move between doctor and patient without leaving the compliant channel.
For text chat, add saved history, presence, typing indicators, and multi-device sync. For video, add screen sharing, group calls (when you need a specialist), and secure recording. All of it inside the same compliant infrastructure because HIPAA covers every channel, not just the text box.
How to build HIPAA compliant chat into a telemedicine app
Building it in-house is a real option and it's a serious engineering lift plus a compliance posture you now own forever. The faster path uses infrastructure already built for it.
Run a risk assessment first. Find the security and privacy gaps before you write code. A HIPAA compliance checklist speeds this up.
Sign the BAA. Before a single message carries PHI, get the BAA in place. CometChat signs BAAs covering chat, voice, video, and notifications, so you're not chasing a separate agreement per channel.
Turn on the technical safeguards. Encryption in transit and at rest; role-based access for patients, clinicians, and care teams; MFA; and SSO. CometChat ships these rather than leaving you to assemble them.
Integrate the SDK or UI Kit. Drop in pre-built UI Kits for React, React Native, Flutter, iOS, or Android, or go lower-level with the SDKs. We've also published step-by-step tutorials for iOS and Android telehealth apps.
Confirm audit logging covers PHI access, across every channel. You need a record of who accessed what for both security and any future audit and it has to include voice, video, and files, not just text.
If you're mapping the bigger picture, our guide to telemedicine app development covers the full build, and the telehealth trends piece has the industry numbers.
Is CometChat HIPAA compliant?
Yes. CometChat is HIPAA-compliant and signs BAAs to protect PHI, and is independently certified for SOC 2 and HITRUST. It uses AES-256 and TLS 1.2 encryption, role-based access with MFA and SSO, and secure audit logs - across chat, voice, video, and notifications. Infrastructure runs on a 35+ location edge network with a 99.999% uptime SLA.
That last part matters more than it sounds. Compliance that falls over under load isn't compliance - it's a demo. Patient communication has to hold when the clinic is busy, not just when you're showing it to a stakeholder. CometChat gives you text, voice, and video ready to integrate into a telemedicine app, with the must-have and nice-to-have features already there. See the healthcare solution for the full picture.
Frequently asked questions
Is there an official HIPAA certification? No. Unlike SOC 2 or ISO 27001, HIPAA has no certifying body. Compliance is a shared responsibility between covered entities and their vendors, established through safeguards and BAAs - not a certificate.
Do I need a BAA for a telemedicine chat feature? Yes, if the chat vendor stores, processes, or transmits PHI. Without a signed BAA, using that vendor for patient communication is itself a HIPAA violation, regardless of how strong the encryption is.
Does HIPAA require end-to-end encryption specifically? Not by that name. The Security Rule requires PHI to be encrypted in transit and at rest using recognized standards - AES-256 at rest and TLS 1.2 in transit are the common bar. The rule cares about the protection, not the label.
Does HIPAA apply to video visits and voice calls, not just text? Yes. Any channel carrying PHI is in scope - voice, video, file sharing, notifications, all of it. Keeping every channel inside one compliant platform is simpler than securing each separately.
Does PHI have to stay on US servers? No. HIPAA has no data-residency requirement. Proper safeguards and a signed BAA are what keep PHI protected, wherever it's stored.
Can I build HIPAA compliant chat myself? You can, and it's a large, ongoing commitment - you own the encryption, access controls, audit logging, and compliance posture forever. Most telemedicine teams use compliant infrastructure so their engineers can build the care experience instead of maintaining a messaging stack.
Get started
Chat looks simple right up until PHI touches it. If you're building a telemedicine app and want the compliance groundwork handled before it becomes a second product to maintain, that's what CometChat is built for. Sign up and start building, or talk to our team first.
Shrinithi Vijayaraghavan
Creative Storytelling , CometChat
