HIPAA-compliant live chat software compared

A live chat provider is worth shortlisting for a clinic website only if it will sign a business associate agreement (BAA) that covers the exact chat service, plan and features you will use. The table below shows BAA availability, plan, starting price, exclusions and source for each provider. It has to be read together with the BAA text, because a BAA is necessary but not sufficient.

Short answer: what qualifies a live chat provider

A provider qualifies for consideration when all three of these are true:

1. It offers a signed BAA, not just a security page or a statement that it "supports" HIPAA.
2. The BAA names the chat service you will deploy (the widget, transcripts storage, and any bot or AI feature you plan to turn on).
3. The plan that includes the BAA is a plan you will actually buy.

Whether a deployment meets HIPAA depends on the signed BAA, how the clinic configures the tool, and the clinic's own policies. No product is compliant by itself. For the full list of obligations on the clinic side (risk analysis, access control, minimum necessary, retention), see what HIPAA requires from website chat. For the wider picture of chat on healthcare sites, start at the section hub, HIPAA-compliant live chat for healthcare websites.

Comparison table: BAA, plan and price

Rows are sorted by facts, not preference: first by BAA verdict (BAA available, then BAA on request or custom contract only, then no BAA published), then by the lowest plan tier that includes the BAA, then by starting price. Prices are quoted as the vendor shows them, in the vendor's currency; a non-USD price is marked.

Provider	BAA available on (plans) for (services)	Starting price as quoted by vendor	Notable exclusions	Source
LiveChat (Text, Inc.) (livechat.com)	Enterprise plan only, sold through Sales, per the legacy pricing page; the current pricing page (Essential, Growth, Enterprise) marks HIPAA compliance "Coming soon". Covers the LiveChat agent app and website widget. (livechat.com)	Not published (Enterprise is "Request a call"); legacy paid plans without a BAA start at $19 per month billed yearly, in USD. (livechat.com)	BAA covers LiveChat only, not uses of ePHI outside LiveChat. Third-party apps and webhooks (e.g., Zapier) must be reviewed and removed if not HIPAA-ready. The account must use the US data center. Some LiveChat cookies track visitors. Reply Suggestions, AI Text Enhancements and Copilot are listed as eligible. Bot (ChatBot.com) coverage is not published by the vendor. (livechat.com)	https://www.livechat.com/legal/baa/ and https://www.livechat.com/help/livechat-hipaa-compliant-guide/ (livechat.com)
Zendesk (support.zendesk.com)	Suite Professional, Enterprise or Enterprise Plus with Advanced Compliance (add-on or included); covers Chat/Live Chat and Zendesk messaging, Support, Guide, Gather, Explore, Talk (excluding Text) and Sunshine Conversations within the Suite. (support.zendesk.com)	From $115 per agent per month billed yearly (Suite Professional), in USD; the Advanced Compliance cost is not published. (zendesk.com)	Not covered: early-access features, Marketplace apps (including Built by Zendesk), integrations including social messaging channels, standalone Sunshine Conversations, and Talk Text. Contact Center needs a separate AWS BAA. Visitor attachments must be off unless secure attachments are on. AI Agents – Advanced and Copilot are covered add-ons. (support.zendesk.com)	https://support.zendesk.com/hc/en-us/articles/4408832117786-Advanced-Compliance (support.zendesk.com)
Intercom (intercom.com)	Expert plan; listed covered products are Fin AI Agent, Copilot, AI in the Inbox, AI in Phone (including Fin Voice), Pro, and Fin for Sales/Ecommerce. The Messenger chat widget is not named. (intercom.com)	Expert from $132 per seat per month plus from $0.99 per Fin outcome (billing period and currency not stated). (intercom.com)	Not published by the vendor. (intercom.com)	https://www.intercom.com/help/en/articles/8827723-contacts-faqs (intercom.com)
Freshchat (Freshworks) (crmsupport.freshworks.com)	Standalone Freshchat only (not Freshchat inside Freshsales Suite, Freshsales or Freshmarketer); eligible plan not published. (crmsupport.freshworks.com)	Price with a BAA not published; plans are Free $0 (up to 10 agents), Growth $19, Pro $49 and Enterprise $79 per agent per month billed yearly, in USD. (freshworks.com)	Third-party integrations or apps sending data outside Freshworks are not covered. Visitor push notifications (Google Firebase, Apple) must be off. The CSAT additional-feedback option must stay off. Custom mailboxes and Apps are excluded. Freddy AI coverage is not published by the vendor. (crmsupport.freshworks.com)	https://crmsupport.freshworks.com/support/solutions/articles/50000004422-hipaa-configuration-guide-for-freshchat and https://crmsupport.freshworks.com/support/solutions/articles/50000005953-freshworks-commitment-towards-hipaa-compliance (crmsupport.freshworks.com)

Reading the table:

• "BAA available on" names the plan tiers the vendor lists. If the vendor does not publish which plans include a BAA, the cell says so rather than guessing.
• "For (services)" matters as much as the plan. A BAA can cover the chat widget and transcript storage while leaving out a chatbot, an AI assistant or a marketplace add-on.
• Starting price is the entry price of the plan that carries the BAA, not the cheapest plan the vendor sells. If a vendor publishes only "contact sales," the cell says the vendor does not publish a price.
• Notable exclusions are quoted from vendor documents. A blank exclusion cell is not the same as "no exclusions"; read the agreement.

Publisher disclosure. hipaa.chat is owned by Chanty, Inc. Chanty is a staff team-communication product, not a website live chat widget, so it has no row in this table. hipaa.chat is published by Chanty, Inc., the company behind the Chanty team chat and chanty.health.

How we compare: criteria behind each column

BAA scope. For each provider the question is which plans and which services the agreement covers: chat widget, chatbot, AI features, transcripts, file uploads, and integrations. A vendor that signs a BAA for "the platform" but lists AI features as excluded gets the exclusion recorded in the table.

Controls. Only controls the vendor itself publishes are listed, each with a source link:

• Access roles (who on the clinic's staff can read transcripts)
• Audit logs
• Retention and deletion settings for transcripts and attachments
• Encryption in transit and at rest
• SSO and two-factor authentication for agent accounts

Published controls by vendor: LiveChat lists US hosting, turning off file sharing, apps to anonymize or delete transcripts, and IP restriction and access control. Zendesk publishes a full HIPAA setup requirements page. Intercom offers a HIPAA attestation report under NDA and claims SOC 2 Type II and ISO certifications. Freshchat lists role-based access, SAML SSO, pattern-based message masking and device security (livechat.com). Where a vendor does not publish a control, the entry reads "not published by the vendor." That is a gap to close in writing before signing, not proof the control is absent.

Data flows. The chat service is rarely the only place a transcript lands. Check where it goes:

• Email notifications to agents, which can include the message text
• CRM or helpdesk integrations
• Analytics and tag-manager scripts on the same page
• Transcript emails sent to the visitor

Each destination is either inside the BAA, covered by its own BAA, or outside protection altogether.

Selection criteria for this page. This page covers LiveChat, Zendesk, Intercom and Freshchat, each of which sells a website chat widget and publishes its own BAA or HIPAA page (livechat.com).

What a BAA does not cover in live chat

A BAA is a contract between the clinic (covered entity) and the vendor (business associate) about the services the vendor performs. It does not make the clinic's own use compliant, and it only reaches what the agreement names. See the HHS guidance on business associate contracts and sample business associate agreement provisions, and 45 CFR 164.504(e), which sets out the required contract terms. (hhs.gov).

Features outside the agreement. Bots, AI-written replies, translation add-ons and marketplace apps may be excluded or may need a separate agreement. Read the services definition in the BAA, not the marketing page. If the text is not public, ask for it before you pay.

Notification emails, SMS and integrations. A visitor types "I need to reschedule my oncology follow-up" and the tool forwards that line to an agent's personal inbox, a shared mailbox, or a Slack channel. The message has now left the covered service. Fixes include:

• Switch notifications to "new message" alerts with no message text.
• Route agents into the vendor's own console, not into email.
• Confirm that every connected CRM or helpdesk has its own BAA with the clinic, or turn the integration off.

Tracking technologies on the page. Pixels, session-replay tools and analytics scripts on pages that host the widget are a separate disclosure risk, and a chat vendor's BAA does not reach them. A page where a visitor can describe symptoms to a chat agent is the kind of page where this matters most. See what HIPAA requires from website chat for the checklist, and HHS's bulletin "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates" (last modified June 26, 2024), noting that on June 20, 2024 a federal court in AHA v. Becerra vacated its guidance on tracking on public pages that require no login (hhs.gov).

Bots and AI inside live chat

Many live chat products bundle a chatbot, an auto-reply flow or an AI assistant with the widget. Treat each as a separate line in the BAA review:

• Is the bot or AI feature named as a covered service in the BAA?
• If AI features rely on a third-party model provider, does the vendor list that provider as a subprocessor, and is there a BAA chain down to it?
• Are conversations used to train models, and can that be switched off?

Unless the vendor states in its own documents that a bot or AI feature is covered, assume it is not. Where a vendor does not publish this, the table cell says so, and the clinic should get the answer in writing. A simple pre-chat form with fixed options ("Book an appointment," "Billing question," "Directions") collects less free text than an open AI assistant, which changes what the BAA scope has to cover.

For depth, see chatbots in website chat and HIPAA and AI chat and PHI: what HIPAA allows.

Choosing by situation

Small clinic on a CMS. Check three things first: the plan that includes the BAA, whether the widget loads through a plugin or a script you paste in, and whether the plugin itself sends data to a third party. A plugin that wraps the vendor's widget can add its own analytics or hosting. Plugin-specific problems are covered in HIPAA-compliant chat on a WordPress site.

Practice with an EHR, CRM or scheduling tool. List every integration you plan to switch on and confirm that each has a BAA with the clinic. A chat tool with a BAA that pushes transcripts into a CRM without one has moved PHI outside protection. If an integration is not covered, turn it off or change what the widget collects.

Team that needs staff-to-staff chat, or a vendor verdict. Website live chat is for visitors. If the need is internal messaging among clinicians and front-desk staff, that is a different product category covered at chanty.health (https://chanty.health/hipaa-compliant-chat/) (chanty.health). If the question is whether a specific vendor is acceptable overall, the verdicts live at hipaacompliant.wiki/is. If you are unsure which category you need, begin with which kind of chat you need under HIPAA.

Questions to ask a vendor before signing

Put these in an email and keep the answers with the signed agreement.

1. Will you sign a BAA for this exact plan and these features, and can we see the text before purchase? Name the widget, the bot, any AI feature and the integrations you intend to use.
2. Can transcripts and attachments be deleted, or retained on a schedule we set? Ask whether deletion also removes backups and how long that takes.
3. Which subprocessors handle chat data? Ask for the list, and whether each is bound by a BAA flowing from yours.
4. What is the breach-notification process and timeline in the BAA? Find out who contacts whom, in how many days, and with what detail.
5. Which agent controls are available on our plan? Roles, audit logs, SSO and two-factor authentication may vary by tier.
6. What do notification emails contain by default, and can the message text be removed?
7. Is any chat content used to train or improve models, and can that be disabled in writing?

Sources and last verified

FAQ

Is there a free HIPAA-compliant live chat?

Compliance is not a property of a price tier. What matters is whether a vendor will sign a BAA covering the service on the plan you use. The "BAA available on" column shows which plans carry a BAA; if a vendor lists a BAA only on paid plans, a free plan cannot be used for chat that may contain PHI. None of the four listed vendors publishes a BAA on a free plan: LiveChat, Zendesk and Intercom offer only free trials, and Freshchat has a $0 plan but Freshworks does not publish which plans can carry a BAA (freshworks.com). A free tool without a BAA is suitable only for pages and flows where visitors cannot submit PHI, and that is hard to guarantee on a clinic site.

Does a BAA make a live chat tool compliant?

No. A BAA is necessary and not sufficient. Compliance depends on the signed BAA, the clinic's configuration (roles, retention, notifications, integrations) and the clinic's policies, including a risk analysis and staff training. The BAA also covers only the services it names.

Can a live chat widget collect PHI from visitors?

It can if the clinic has a BAA covering that chat service and has configured it appropriately. Even with a BAA, a clinic can limit what visitors are invited to type, for example with a notice that chat is not for urgent or detailed medical questions and a pre-chat menu that routes clinical questions to a phone line or patient portal. See what HIPAA requires from website chat.

Do chatbots in live chat fall under the BAA?

Only if the vendor states so. Bots, AI replies and add-ons are frequently listed separately or excluded. Check the services definition in the BAA and confirm in writing. The table's exclusions column records what each vendor publishes.

What happens if a visitor types PHI into a chat without a BAA?

If the clinic uses a chat vendor that handles that information on its behalf without a BAA, the clinic has a compliance problem regardless of who typed it. The usual steps are to stop using the widget on pages where PHI is likely, assess the incident with your privacy officer under your breach-assessment procedure, and put a BAA in place or change vendors. See the HHS Breach Notification Rule guidance (45 CFR 164.400-414), which requires covered entities and business associates to provide notification after a breach of unsecured PHI. (hhs.gov). Legal counsel should review specific incidents.

Is chat on a WordPress site different?

The compliance questions are the same, but there are more places for data to leak: the chat plugin, other plugins that add analytics or tracking, the hosting provider, and form or email plugins that receive notifications. Each may need its own review. See HIPAA-compliant chat on a WordPress site.