HIPAA-Compliant Chat API Providers: Which Offer a BAA, and How to Choose

Two chat API providers are fully documented below, and both offer a BAA with conditions. Twilio signs a Business Associate Addendum only for customers on Security Edition or Enterprise Edition, and only for products on its HIPAA Eligible Services list. Firebase has no Firebase-specific BAA. Its chat-relevant services are covered through the Google Cloud BAA, which excludes several Firebase-branded products. A BAA is the entry ticket, and the rest of this page covers what it covers, what it leaves out, and what you still have to build. For the wider picture, see HIPAA-compliant chat APIs for developers.

Chat API providers with a BAA: comparison table

Compliance depends on a signed BAA, your configuration and your own policies. No row below is a statement that a product is compliant.

Both providers carry the same verdict ("conditional"), so the order follows plan restrictions first and price second. Firebase comes first because its BAA is not tied to a paid tier. Twilio's required tier has no published price. No prices are shown in a non-USD currency.

Provider	Verdict	Plan or tier required	Price as quoted	Notable exclusions
Firebase (Google)	BAA available on the Google Cloud BAA (any billing account) for Firestore, Firestore in Datastore mode, Identity Platform, Cloud Run functions and Cloud Storage	Google Cloud BAA, accepted for the Google Cloud project. No separate Firebase BAA.	Pay-as-you-go Google Cloud pricing; no additional charge stated for the BAA	Realtime Database, Firebase Authentication, Hosting, Crashlytics, Analytics and other Firebase-branded services not on the covered-products list; pre-GA offerings; anonymous accounts with PHI
Twilio	BAA available on Security Edition or Enterprise Edition for products on the HIPAA Eligible Services list	Security Edition or Enterprise Edition, arranged through an account representative or sales	Not published by the vendor	Pay-as-you-go and Developer accounts without an Edition; any product not on the eligible list; SendGrid email; Programmable Chat (end of life); Twilio Frontline (end of life 9/30/2026)
Stream	Stream Chat includes HIPAA only on the Elevate plan ($599/mo billed annually or $675 monthly, for 10,000 MAU and 500 concurrent connections) and on Enterprise (contact sales). It is unavailable on the free Build plan and on Start ($399/mo annually or $499 monthly). Stream does not publish which services the BAA covers or what it excludes. (getstream.io)	Elevate or Enterprise, via the pricing page or sales	Not published	Not published (getstream.io)

What the two documented BAAs cover

Twilio. Twilio's HIPAA Eligible Services list covers these services:

• Runtime Tools (Studio, Functions, Debugger, API Explorer, Assets, TwiML Bin, Sync)
• Programmable Video (Group Rooms, recordings, compositions, media storage, real-time transcription)
• Programmable Voice and SIP
• Programmable SMS/MMS and messaging features
• Twilio Conversations (classic)
• Verify (SMS, Voice, Push) and Lookup
• Event Streams
• Twilio Flex
• Twilio Segment (per the list's change log)

For a chat build, the relevant line is Twilio Conversations (classic). Programmable Chat is end of life and is not a base to start from. The BAA is an addendum to Twilio's Terms of Service. The "Twilio and HIPAA" page says: "Customers wishing to sign a BAA with Twilio must have our Security Edition or Enterprise Edition." It also says customers may use products not on the list, but "there must be no potential for PHI being exchanged in violation of HIPAA as part of these workflows."

Firebase. The Google Cloud BAA "includes Google Cloud's entire infrastructure" plus a named list of products. Firestore and Cloud Storage are on it, so a chat built on Firestore with Cloud Run functions sits inside the BAA. Firebase Realtime Database is not on the list, which matters because many chat tutorials use it.

For Identity Platform, Google's HIPAA page gives two rules: "Don't store PHI in optional or custom attributes, such as display names or photo URLs. Don't use Identity Platform SDKs and client libraries when interacting with, managing, or storing PHI."

Controls the vendors publish

Control	Firebase	Twilio
Encryption in transit	Yes (HTTPS, per Privacy and Security in Firebase)	Not published by the vendor
Encryption at rest	Yes	Not published by the vendor
Audit log	Not published by the vendor	Yes
SSO	Not published by the vendor	Yes (any SAML 2.0 identity provider, per the Editions page)
SOC 2	Yes (SOC 1, 2 and 3 evaluation completed for all Firebase services)	Not published by the vendor
ISO 27001	Yes	Not published by the vendor
HITRUST	Not published by the vendor	Not published by the vendor
Data residency	Not published by the vendor	Not published by the vendor

"Not published" means the vendor's public pages do not state it. A vendor may supply it under NDA or in a security questionnaire, so ask (see the questions below).

What "HIPAA-compliant chat API" actually means

HHS does not certify or endorse chat products, so no API carries a "HIPAA certified" status. The practical test is whether the vendor will sign a BAA covering the specific services your app will use, on the plan you will actually buy.

A chat API vendor is typically a business associate when it creates, receives, maintains or transmits PHI on your behalf (HHS OCR, Guidance on HIPAA & Cloud Computing, published 2016-10-06, page updated 2026-03-20, says a covered entity engaging a cloud service provider should enter into an appropriate BAA and conduct its own risk analysis) (hhs.gov). That makes the BAA a requirement before PHI touches the service.

Responsibility splits like this:

• The vendor secures the platform it operates: infrastructure, the storage layer, the services named in the BAA.
• You handle who can read which channel, how long messages are kept, patient consent for messaging, user provisioning and offboarding, and what staff and patients are allowed to type into a message.

Twilio's eligible-services document puts the first half in contract terms. Covered entities and business associates agree not to use the eligible services "for any purpose or in any manner involving Protected Health Information without first entering into a Twilio Business Associate Agreement."

If you are not sure whether you need an API at all, which kind of chat you need under HIPAA routes staff messaging and vendor verdicts to the right place.

How to choose: a checklist

Apply these checks to any provider, including ones not listed above.

1. BAA access and scope. Is the BAA self-serve or sales-led, and on which plan? Twilio's is sales-led and requires an Edition. Google's is accepted per Cloud project. Then match the BAA's service list against the exact features you will ship: message storage, file upload, push, search, moderation, analytics. A BAA that covers "messaging" but not file storage leaves attachments exposed, and in a clinic setting attachments are where photos of wounds and scanned insurance cards end up.
2. Encryption. Look for encryption in transit and at rest in the vendor's docs. Ask whether end-to-end encryption exists and what it disables: server-side search, moderation, server-side bots and message history for new devices. HIPAA does not require end-to-end encryption for chat. The Security Rule treats encryption as an addressable specification Encryption and the other technical safeguards sit in the HIPAA Security Rule at 45 CFR 164.312, for example 164.312(a)(2)(iv) and 164.312(e)(2)(ii). (ecfr.gov). Your risk analysis decides whether it is needed.
3. Audit, access and retention. Check for audit logs, role-based access, SSO and retention and deletion controls. Of the two documented vendors, Twilio publishes audit log and SAML SSO, while Firebase's public pages do not state either.
4. Residency and subprocessors. Ask where message data is stored and which subprocessors touch it. Confirm whether those subprocessors sit under the vendor's own BAAs.
5. Features that fall outside the BAA. Check push notification payloads, third-party integrations, free or sandbox tiers and pre-GA features. For the two documented vendors, Twilio excludes accounts without an Edition and any product not on its list. Google excludes pre-GA offerings and anonymous accounts holding PHI.
6. Bots and AI features. If the chat will feed a bot, a summarizer or an intake assistant, the model provider needs its own BAA. See AI chat and PHI before wiring one in.

Where the BAA stops: common exclusions

Most PHI leaks in chat builds happen outside the vendor's covered services.

• Push notifications (APNs/FCM) and SMS fallbacks. A lock-screen preview reading "Your lab results for HIV are ready" is a disclosure no matter how well the chat backend is covered. Send content-free pushes ("You have a new message") and keep PHI in the app. Whether FCM or Notify-style services fall under a given BAA is a per-vendor check.
• Webhooks, logs and analytics. A webhook that posts message text to a ticketing tool, or an analytics SDK that records screen content, moves PHI to a party with no BAA. Firebase Analytics and Crashlytics are among the Firebase-branded services not on Google's covered list.
• Free and development tiers. Twilio excludes Pay-as-you-go and Developer accounts without an Edition. A prototype built on a free account with real patient messages is outside the BAA from the first message.
• Retired products. Twilio's Programmable Chat is end of life and Twilio Frontline reached end of life on 9/30/2026. Neither belongs in a new design.

What to build around these gaps (payload design, logging rules, data flow) is covered in architecting chat that touches PHI.

Managed API vs SDK vs open source

Managed chat API. This is the fastest route to production. The vendor handles hosting, scaling and the BAA, and cost grows with active users. The trade-off is that your design is limited to the services the BAA lists. For example, a chat on Firestore and Cloud Run functions stays in scope, while the same chat on Realtime Database does not.

UI SDKs. Prebuilt chat components shorten front-end work, but they run in the patient's or clinician's app. Check whether the SDK is named in the BAA and what it sends to the vendor, such as telemetry or crash reports. Google's guidance not to use Identity Platform client libraries when handling PHI shows that client SDKs can fall outside coverage even when the backend service is covered. Details are in HIPAA-compliant chat SDKs.

Self-hosted open source. There is no vendor BAA for the software itself, but the infrastructure you run it on needs one. Your team takes over patching, backups, access control and audit logging. If your cloud provider is AWS, Azure, Google Cloud, Heroku or Supabase, check its BAA terms and services list against your deployment. Open-source chat under HIPAA walks through the setup.

Questions to ask a vendor before signing

• Which of your services are listed in the BAA, and can I read the BAA before purchase?
• Which plan do I need for it, and what does that plan cost? Twilio does not publish the price of Security or Enterprise Edition.
• What are your breach-notification timelines, and how do your subprocessors fall under them?
• What happens to message data and attachments on account termination or a deletion request?
• Do you provide a security questionnaire or SOC 2 report?
• Are push, file storage, search, moderation and analytics inside the BAA or outside it?
• Are the SDKs named in the BAA?

FAQ

Does signing a BAA make a chat API HIPAA compliant?

No. The BAA makes the vendor contractually responsible for the services it lists. Your configuration, access controls, retention rules, message content policies and any services outside the BAA remain your responsibility.

Do I need a BAA with a chat API provider if messages contain no diagnosis?

Probably yes. PHI is broader than diagnoses. A message from a patient to a clinic that identifies them and relates to their care can qualify, so appointment details, medication names and the sender's identity can all count. If the service might carry PHI, treat it as a business associate relationship HHS defines PHI as individually identifiable health information, including demographic data, held or transmitted in any form by a covered entity or business associate. It covers information that relates to a person's health, care or payment for care and that identifies them or could reasonably be used to identify them, such as name, address, birth date or Social Security number. (hhs.gov). Twilio's own wording applies the same logic: products outside its list may be used only where there is "no potential for PHI being exchanged."

Is end-to-end encryption required by HIPAA for chat?

No. The Security Rule treats encryption as addressable, meaning you assess it in your risk analysis and document your decision (45 CFR 164.312(a)(2)(iv), https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312). End-to-end encryption is one option, and it can disable server-side search, moderation and bots.

Can I use a free tier of a chat API for PHI?

Not unless the BAA covers it. Twilio's BAA requires Security Edition or Enterprise Edition and excludes Pay-as-you-go and Developer accounts without an Edition. Google's covers Cloud projects under its BAA, but pre-GA offerings are excluded. Check the free-tier terms of any other vendor.

Are push notifications covered by a chat provider's BAA?

Check the vendor's service list rather than assuming. Twilio lists Verify push as eligible, but the facts for other push services are not stated here. In any case, keep PHI out of the notification payload, because APNs and FCM carry it through Apple and Google infrastructure.

Can I self-host an open-source chat server instead of buying an API?

Yes, as long as the hosting provider signs a BAA for the services you run it on, and you implement the access control, audit logging, backup and patching the vendor would otherwise handle. See open-source chat under HIPAA.

Sources and last verified