WhatsApp and messaging apps for medical practices: HIPAA, opt-in and platform rules

Patients ask practices to message them on WhatsApp, and certain practices already do, from a staff phone or a WhatsApp Business account. It feels like texting, and for a patient who lives abroad part of the year or who uses no other messaging app, it can be the only channel they answer. The question for the practice is not whether WhatsApp is secure in a technical sense. It is what HIPAA requires when patient information passes through a company that has not agreed to protect it, and what WhatsApp’s own business rules allow.

This guide covers what the HIPAA rules say about messaging apps, what WhatsApp’s current business policy and platform terms say about health information, when a patient’s own request changes the picture, and how marketing messages fit in. The same questions apply to other consumer messaging apps. For SMS rules, see our guide to business texting rules for medical practices and text message appointment reminders; for messages inside a portal, see patient portal messages and HIPAA marketing rules; and for the systems that send messages at scale, see CRM and marketing automation with patient data.

The short version

• Meta’s terms for the WhatsApp Business Platform say the business acknowledges that Meta is not a business associate or subcontractor under HIPAA. A practice cannot rely on a business associate agreement with Meta for WhatsApp.
• HIPAA lets a practice share patient information with a vendor that handles it on the practice’s behalf only after written assurances, which is the business associate agreement (45 CFR 164.502(e) and 164.308(b)).
• WhatsApp’s business policy says not to use WhatsApp for telemedicine or to send or request health related information where the law requires systems that meet heightened requirements for health information.
• A patient can ask to receive communications by an alternative means, and a patient can ask for a copy of their records in the electronic form they choose, if it is readily producible (45 CFR 164.522(b) and 164.524(c)(2)). Neither rule turns a messaging app into a business associate.
• WhatsApp requires the person’s phone number or username and opt-in permission before a business contacts them, and it requires the business to honor opt-out requests.
• Messages about the practice’s own services are not marketing under HIPAA’s definition when no third party pays for them. Messages that promote a third party’s product, or that a third party pays for, need the patient’s written authorization.
• The COVID-19 telehealth enforcement discretion ended. OCR’s transition period for telehealth ran until 11:59 p.m. on August 9, 2023.

What HIPAA says about messaging apps

HIPAA does not name messaging apps. It works through roles. A business associate is a person or company that creates, receives, maintains or transmits protected health information on behalf of a covered entity (45 CFR 160.103). Before a practice lets a business associate handle protected health information, the practice must obtain satisfactory assurance that the business associate will safeguard it, documented in a written contract (45 CFR 164.502(e)). The Security Rule has the same requirement for electronic protected health information (45 CFR 164.308(b)).

A messaging service that stores the content of conversations on behalf of the practice is handling that content. HHS’s cloud computing guidance says the conduit exception is limited to transmission-only services, including temporary storage incident to transmission, and that a service that maintains electronic protected health information for the purpose of storing it is a business associate, even if it cannot view the information because it is encrypted and it lacks the key. That guidance is written about cloud service providers, not about messaging apps by name, so apply it with your attorney rather than on your own.

The Privacy Rule also requires reasonable safeguards against uses or disclosures that break the rules and to limit incidental disclosures (45 CFR 164.530(c)), and the Security Rule requires technical security measures to guard against unauthorized access to electronic protected health information sent over a network (45 CFR 164.312(e)). A message on a staff member’s personal phone, backed up to that person’s personal account, is hard to fit inside those safeguards.

What WhatsApp’s own rules say

Two documents matter for a practice: the WhatsApp Business Messaging Policy, which WhatsApp says governs the WhatsApp Business App and the WhatsApp Business Platform, and the Meta Terms for WhatsApp Business Platform, the contract for the platform. Both were updated on September 23, 2026.

• Health information. The policy says: do not use WhatsApp for telemedicine or to send or request any health related information, if applicable regulations prohibit distribution of such information to systems that do not meet heightened requirements to handle health related information.
• Business associate status. Section 4.2 of the platform terms bars a business from giving Meta information that the law requires to be safeguarded or limited in distribution. On health information, the business acknowledges that Meta is not a business associate or subcontractor as HIPAA defines those terms. Meta also says it makes no representation that the platform meets the needs of businesses with heightened confidentiality duties, such as healthcare.
• Opt-in. A business may contact a person only if the person gave the business their phone number or username and the business received opt-in permission to send later messages or calls. WhatsApp says the business alone is responsible for how it collects opt-in and for complying with the law that applies.
• Opt-out. The business must respect each request, on or off WhatsApp, to block or stop communications.
• Templates and the 24-hour window. On the Business Platform, a business starts a conversation only with an approved message template. It can reply freely inside the 24-hour customer service window that opens with each user message.
• Automation. A business can use automation inside the 24-hour window but must offer a clear escalation path, such as transfer to a human agent, a phone number, email or a support form.
• Regulated goods. The policy prohibits using WhatsApp for business to buy, sell or promote certain regulated goods, including drugs, whether prescription or otherwise, and medical and healthcare products. Messaging about over-the-counter drugs is allowed only on the Business Platform in listed countries; the United States is not on that list as of September 23, 2026, though certain US territories are.
• Customer chats. A business may not forward or share information from one customer’s chat with another customer.

When the patient asks for WhatsApp

Two patient rights come up. First, a covered health care provider must accommodate reasonable requests by patients to receive communications of protected health information by alternative means or at alternative locations (45 CFR 164.522(b)). Second, when a patient asks for a copy of their records, the practice must provide it in the form and format the patient requests, if it is readily producible in that form and format (45 CFR 164.524(c)(2)).

HHS’s email FAQ shows how the agency thinks about a patient’s preference. It says the Privacy Rule does not prohibit unencrypted email for treatment-related communications, that reasonable safeguards still apply, such as limiting the amount or type of information sent, and that a patient who starts an email exchange can be assumed to accept email unless they say otherwise. That FAQ is about email. We found no HHS guidance that applies the same reasoning to consumer messaging apps, and none of it removes the business associate question when a vendor stores the messages for the practice.

No federal rule we found requires a practice to use a particular app because a patient prefers it. We recommend that a practice offer a secure channel it controls, explain in plain words why it does not discuss health details on WhatsApp, and keep any WhatsApp use to logistics that carry no health information, after your attorney has reviewed that plan.

Marketing messages on WhatsApp

Under HIPAA, marketing means a communication about a product or service that encourages the recipient to buy or use it (45 CFR 164.501). The definition excludes, among others, communications that describe a health-related product or service the practice itself provides, and communications for treatment, unless the practice receives financial remuneration for sending them. When a communication is marketing, the practice needs the patient’s written authorization before using protected health information to send it, with narrow exceptions for face-to-face communications and promotional gifts of nominal value (45 CFR 164.508(a)(3)).

WhatsApp’s rules add their own layer. Its best practices recommend a separate opt-in for each category of message, such as order updates and offers, and a separate opt-in before calling a user. The policy also lets WhatsApp limit or remove access if a business receives significant negative feedback. Even a promotion that HIPAA allows can still break WhatsApp’s rules if the patient opted in only to appointment updates.

Federal rules for SMS and phone calls, such as the Telephone Consumer Protection Act, are covered in our texting guide. We have not read an FCC ruling or court decision that settles how those rules apply to app-based messages, so this guide makes no claim about it.

Other consumer messaging apps

The same three questions apply to each consumer messaging app a patient may ask about. Will the company sign a business associate agreement for the use you plan? What do its business terms say about health information? Who at the practice controls the account, the phone and the backups? If the company will not sign a business associate agreement, the safer plan is to use the app only for messages with no protected health information, such as office hours or directions, and to move each clinical or scheduling conversation into a channel covered by a business associate agreement.

Questions to ask before you use WhatsApp with patients

• Will any message contain a patient’s name with a visit, condition, appointment type or result?
• Is the account a WhatsApp Business App on one phone, or the Business Platform through a provider? Who owns that provider relationship?
• Has our attorney read the Meta Terms for WhatsApp Business Platform, section 4.2, and the Business Messaging Policy?
• Where are chats backed up, and to whose account?
• How do we record opt-in for each message category, and how do we honor opt-outs made by phone or at the front desk?
• What secure channel do we offer a patient who asks for WhatsApp?
• Who answers when an automated reply cannot help, and how does the patient reach them?

Use and avoid

• Use: WhatsApp, if at all, for messages with no protected health information, such as hours, directions or a link to your secure portal.
• Use: a written opt-in that names each category of message, kept with the date and source.
• Use: a practice-owned account and device, with access removed when staff leave.
• Use: a secure channel covered by a business associate agreement for scheduling details, results and clinical questions.
• Avoid: treating Meta as a business associate. Its platform terms say it is not one.
• Avoid: staff personal phones and personal WhatsApp accounts for patient conversations.
• Avoid: promoting prescription drugs or medical and healthcare products on WhatsApp; the policy prohibits it.
• Avoid: sending a promotional template to patients who opted in only to service updates.

An illustration

This example is invented. [Practice name], a dental office, sees [number] patients who spend winters abroad. One of them, Alex, messages the front desk on WhatsApp asking to move a crown appointment and mentions pain on one side. The office manager replies on WhatsApp with a short note thanking them and a link to the practice’s secure messaging portal, and calls them on the phone number in the chart. The appointment change and the pain question are handled in the portal and on the call, which are covered by the practice’s business associate agreements. The WhatsApp account, which runs on a practice-owned phone, only ever carries the office’s hours, address and the portal link, and the welcome message says so.

Checklist

• Read the current WhatsApp Business Messaging Policy and Meta Terms for WhatsApp Business Platform, and note the dates.
• Decide in writing what may and may not be sent on WhatsApp, and train staff on it.
• Move each conversation with health details into a channel covered by a business associate agreement.
• Use a practice-owned account and device, with backups the practice controls.
• Collect and store opt-in for each message category, and honor each opt-out.
• Check each promotional message against the HIPAA marketing definition before it goes out.
• Do not promote prescription drugs or medical and healthcare products on WhatsApp.
• Have a health care attorney review the plan, including state law.

How we help

We build websites, local and organic search, Google Ads and lead generation and an AI front desk for independent practices. For messaging apps, that means routing patients who reach out on WhatsApp to a channel the practice controls, and keeping health details out of tools that have not agreed to protect them. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• WhatsApp Business Messaging Policy (last updated September 23, 2026)
• Meta Terms for WhatsApp Business Platform (last modified September 23, 2026), section 4.2
• 45 CFR 160.103: Definitions (business associate)
• 45 CFR 164.308: Administrative safeguards (paragraph (b), business associate contracts)
• 45 CFR 164.312: Technical safeguards (paragraph (e), transmission security)
• 45 CFR 164.501: Definitions (marketing)
• 45 CFR 164.502: Uses and disclosures of protected health information (paragraph (e), business associates)
• 45 CFR 164.508: Uses and disclosures for which an authorization is required (paragraph (a)(3), marketing)
• 45 CFR 164.522: Rights to request privacy protection (paragraph (b), confidential communications)
• 45 CFR 164.524: Access of individuals to protected health information (paragraph (c)(2), form of access)
• 45 CFR 164.530: Administrative requirements (paragraph (c), safeguards)
• HHS FAQ: Does the HIPAA Privacy Rule permit health care providers to use email to discuss health issues and treatment with their patients? (content last reviewed July 26, 2013)
• HHS: Guidance on HIPAA and Cloud Computing (content last reviewed December 23, 2022)
• HHS OCR: Notice of Expiration of Certain Notifications of Enforcement Discretion, 88 FR 22380 (April 13, 2023)

More in Phones, front desk and patient messages