If WhatsApp is installed on a smartphone, anyone with access to that smartphone will be able to view the messages in the user’s WhatsApp account, without the need to enter in any usernames and passwords. This is one area where WhatsApp is not HIPAA compliant. HIPAA also requires access controls to be implemented – See 45 CFR § 164.312(a)(1). Since WhatsApp now includes end-to-end encryption, this aspect of HIPAA is satisfied. Provided an alternate, equivalent measure is implemented in its place, encryption is not required. HIPAA does not demand that encryption is used.

Software can support HIPAA compliance and incorporate all the necessary safeguards to ensure the confidentiality, integrity, and availability of ePHI, but those controls can easily be undone by users. Why Isn’t WhatsApp HIPAA Compliant?įirst, it is important to point out that no software platform or messaging app can be truly HIPAA compliant, because HIPAA compliance is not about software.

However, while WhatsApp does offer far greater protection than SMS messages and some other text messaging platforms, we believe WhatsApp is not a HIPAA compliant messaging platform. Many healthcare employees have been asking if WhatsApp is HIPAA compliant, and some healthcare professionals are already using the text messaging app to send protected health information (PHI). When WhatsApp announced it was introducing end-to-end encryption, it opened up the prospect of healthcare organizations using the platform as an almost free secure messaging app, but is WhatsApp HIPAA compliant?

Is whatsapp safe to use 2021