Configure Enterprise Grid to be HIPAA compliant

Collaborate securely in Slack to meet your compliance requirements

At Slack, we are committed to ensuring that the data you share is always protected.

Slack complies with many broadly recognised standards and offers tools to help customers meet their compliance requirements. Companies that are subject to HIPAA (the US Health Insurance Portability and Accountability Act of 1996) such as health plan administrators, healthcare providers, health insurance companies, health benefit providers and the many businesses that provide them with services, can configure Slack Enterprise Grid to support HIPAA-compliant collaboration. When Slack is helping these customers to carry out healthcare activities or functions, Slack is a vendor/service provider classified as a business associate (BA) under HIPAA.

Healthcare organisations using Slack while maintaining HIPAA compliance

Haven logoVirta logoOne Medical logo
Strive Health logoVieMed logoGalileo logo
Zoom + care logoCityBlock logoStrive Health logo
TrialSpark logoAcuitas Health logoForward logo

Benefits

Share protected health information confidently
Enterprise Grid is Slack’s solution for large, complex organisations. It includes all the security and governance functionality that you expect in an enterprise solution, but with an intuitive, consumer-software-like experience that results in a high rate of adoption.

When configured and used according to Slack’s specific requirements for HIPAA entities, teams collaborating on Enterprise Grid can share protected health information (PHI) within direct, group and channel messaging, and in file uploads.

Control your company’s use of Slack
Compliance monitoring is not ‘one size fits all’. Slack Enterprise Grid provides APIs to support monitoring of access, activity and data in customer workspaces. This ensures that every company can implement the tools and processes that are right for them. You can use Slack’s Discovery APIs and set up an external data loss prevention (DLP) provider to enforce message and file restrictions and export message and file content for HIPAA compliance.

Slack partners with many best-in-class providers that may already be present in your company.

Audit logs
Partner-enabled functionality:

  • Download logs of activity within your Slack workspaces
  • Capture events such as file downloads, file uploads and admin setting changes

Data loss prevention

  • API-based with pre-built connectors to leading solution partners
  • 
Integrated DLP solutions have complete access to all content within your enterprise organisation

Partner-enabled functionality:

  • Monitor messages and files in public channels, private channels and direct messages
  • 
Actively quarantine and remove non-compliant content in near real time

What you should know about using Slack in a HIPAA-regulated environment

Slack subscription supported: Enterprise Grid

Requirements: contact Slack to get the ‘Slack requirements for HIPAA entities’ guide

Other tools that you will need: DLP solution, SSO solution, backup/archival

Process:

  • Review and commit to implementing the ‘Slack requirements for HIPAA entities’ guide
  • Sign Slack’s business associate agreement (BAA)
  • Provide Slack with a list of all Slack orgs or workspaces with which you plan to use PHI

More on Slack requirements for HIPAA entities

  • The ‘Slack requirements for HIPAA entities’ guide is the only comprehensive source of implementation requirements.
  • Slack may not be used to communicate with patients, plan members or their families or employers. Patients, plan members and their families or employers may not be added as users or guests to any Slack workspaces or channels.
  • While users may discuss protected health information in message content and upload files that contain PHI, users may not include PHI in some specific fields.
  • There are restrictions on using email forwarding and ingestion with Slack if transmitting PHI via email.
  • There are controls needed if using shared channels to communicate between two separate companies or workspaces.
  • Channels in which PHI may be shared through messages or documents should be set as private.
  • You must inform your users about how to use and configure Slack so that it can be used in compliant ways. You can do so by using various available Slack capabilities such as customised terms of service, customisable bots, mandatory organisation-wide channels, pinned posts and PHI deletion notifications.
  • There are special considerations for devices, adding users, patient home visits and other situations.

Was this resource useful?

0/600

Nice one!

Thanks a lot for your feedback!

Got it!

Thanks for your feedback.

Whoops! We’re having some problems. Please try again later.