Does Slack AI sign a BAA?
Only on some plans or setups
Slack covers PHI under a BAA only on Enterprise plans that buy the 'Slack - HIPAA Enabled' SKU, and only once Slack confirms the org is HIPAA-enabled. Slack and Salesforce's BAA documents name messages, files, huddles, and clips as PHI-permitted but never say whether Slack AI features are covered.
Not fully covered by the BAA: Third-party AI apps from the Slack Marketplace.
- Business associate
- Slack (Salesforce)
- Tool
- Slack AI
- Plans with a BAA
- Enterprise (Enterprise+ / Enterprise Grid) with 'Slack - HIPAA Enabled' SKU
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Free / Pro / Business+ | No BAA | Not offered | BAA coverage requires an enterprise-level Slack plan.[1],[2] |
| Enterprise (Enterprise+ / Enterprise Grid) with 'Slack - HIPAA Enabled' SKU | Conditions apply | Through sales | For workspaces from March 20, 2023 on, the customer must buy the HIPAA Enabled SKU and sign the BAA. Coverage applies only to orgs that Slack has confirmed as HIPAA-enabled. Customers must follow the Slack Guide for HIPAA Entities.[1],[2],[3] |
| GovSlack / GovGrid | No BAA | Not offered | Salesforce says GovGrid plans are not currently eligible for BAA coverage.[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Slack (Salesforce) says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Slack AI summaries, recaps, search answers, file summaries, translationsEnterprise (Enterprise+ / Enterprise Grid) with 'Slack - HIPAA Enabled' SKU | Not stated | Neither the Slack Guide for HIPAA Entities nor the Salesforce BAA Restrictions mentions Slack AI. Slack's HIPAA marketing page describes Slack AI but says nothing on BAA coverage.[1],[2],[3] |
| Huddle notes (AI transcription/summary)Enterprise (Enterprise+ / Enterprise Grid) with 'Slack - HIPAA Enabled' SKU | Not stated | PHI is allowed in huddle contents, but neither document says whether AI-generated huddle notes are covered.[1],[2] |
| Slackbot AI agent, Enterprise search, Agentforce in SlackEnterprise (Enterprise+ / Enterprise Grid) with 'Slack - HIPAA Enabled' SKU | Not stated | Neither BAA document mentions these. The Guide says custom Slackbot responses must not contain PHI, but that rule is about canned responses rather than the AI agent.[1],[2] |
| Third-party AI apps from the Slack MarketplaceEnterprise (Enterprise+ / Enterprise Grid) with 'Slack - HIPAA Enabled' SKU | Excluded | Slack has no BAA with App Directory third parties. The customer has to decide whether it needs its own BAA with each vendor.[1] |
Workspace and collaboration AI that offer a BAA
- Adobe Acrobat AI AssistantBAA on: Acrobat Studio for enterprise: Analyzer in Acrobat, Acrobat Studio for enterprise: Knowledge Base in AcrobatSome plans only
- Airtable AIBAA on: Enterprise ScaleSome plans only
- Asana AIBAA on: AsanaGov, Enterprise+Some plans only
- Atlassian Rovo / Atlassian Intelligence (Confluence, Jira)BAA on: Enterprise, Standard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence)Some plans only
- Box AIBAA on: Enterprise / Enterprise Plus / Enterprise AdvancedSome plans only
- ClickUp BrainBAA on: EnterpriseSome plans only
All BAA-ready alternatives to Slack AI
Sources
- Slack Guide for HIPAA Entities
- Business Associate Addendum Restrictions
- Configure Enterprise Grid to be HIPAA-compliant
- Guide to AI features in Slack
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.