HIPAA compliant chat API compared: BAA and price in 2026
TL;DR
A HIPAA compliant chat API in 2026 is any of five SDKs once the vendor signs a business associate agreement, and none of them signs one on its free plan. We compared Stream, Sendbird, CometChat, Twilio Conversations and PubNub on where the BAA starts and what that tier costs.
- CometChat ranks first: it states a BAA on its Advanced plan at $359 a month billed annually, the lowest published price to a signed agreement, and publishes its SOC 2 Type II audit period.
- Stream includes HIPAA from its $599 a month plan, billed annually for 10,000 monthly active users.
- Twilio Conversations costs $0.05 per active user, but HIPAA needs Security or Enterprise Edition, sold through sales.
- Sendbird lists HIPAA with a BAA from its $349 Starter plan, priced as Custom; PubNub signs only on its custom-priced Pro plan.
Messaging apps and chat APIs are different purchases
The guides that rank for HIPAA messaging compare finished apps. Blaze, Hiver and Hypercare review TigerConnect, Spruce, OhMD and similar products, and two of the three rank themselves first. None covers the SDKs a product team uses to put chat inside its own app.
That purchase carries different risk. When you embed a chat API, the vendor stores your messages and becomes your business associate. The HIPAA Journal counted 710 large healthcare breaches in 2025, and 35.8% of them occurred at business associates. Your chat vendor joins that chain the day the first message carries PHI.
Vendors may soon have to prove their safeguards every year
HHS proposed its Security Rule overhaul on December 27, 2024. Its fact sheet would require business associates to verify, at least every 12 months, that their technical safeguards are deployed, through a written analysis by a subject matter expert and a written certification. It would also require encryption of ePHI at rest and in transit and multifactor authentication.
The HIPAA Journal reported in July 2026 that final action now shows July 2027. A chat contract you sign this year will still be running then. Ask each vendor now how it would deliver that annual verification to you.
How we compared
We read each vendor's pricing page, HIPAA page and plan comparison on November 5, 2026, and recorded four things:
- Which plan includes a signed BAA, in the vendor's own words.
- The published price of that plan, and what usage it includes.
- The free tier, which never includes a BAA here.
- Security attestations the vendor states, such as SOC 2.
Ranking follows how cheaply and clearly you can reach a signed BAA at a published price. Prices change often, so confirm them on the linked pages before you budget. Mercury Development builds apps on these SDKs and has no commercial relationship with any of the five.
Five chat APIs at a glance
| Chat API | BAA starts at | Published price of that tier | MAU included | Free tier | Stated attestations |
|---|---|---|---|---|---|
| CometChat | Advanced | $359 a month billed annually | Tier you select, $0.10 per extra MAU | Build, 100 MAU, no BAA | SOC 2 Type II |
| Stream | Second paid plan | $599 a month billed annually | 10,000 | Build, 1,000 MAU, no HIPAA | SOC 2, ISO 27001 |
| Twilio Conversations | Security or Enterprise Edition | Usage from $0.05 per active user, edition via sales | Pay per active user | First 200 active users | Not graded here |
| Sendbird | Starter | $349 a month billed annually, BAA priced as Custom | 5,000 | Trial, no BAA | SOC 2, ISO 27001 |
| PubNub | Pro | Custom | Custom MAU packages | Free, 200 MAU, no BAA | Not graded here |
MAU means monthly active users.
1. CometChat
CometChat states it plainly: "We sign a Business Associate Agreement (BAA) on the Advanced plan and above," and "A signed BAA is required before you send protected health information (PHI) through CometChat." It reports a SOC 2 Type II audit covering July 1, 2025 to June 30, 2026. AI features run on a provider you configure with your own keys, so that provider needs its own BAA.
Price: per its pricing page, Advanced costs $359 a month billed annually, Basic $239 without a BAA, and the free Build plan includes 100 MAU for development. Watch-out: the $359 price belongs to a user tier the page does not name, and extra users cost $0.10 per MAU, so price your expected user count before comparing.
2. Stream
Stream's pricing lists HIPAA as included from its second paid plan, at $599 a month billed annually or $675 monthly, with 10,000 MAU and 500 concurrent connections. Start costs $399 annually with the same usage and no HIPAA. Its telemedicine page calls the service "HIPAA ready with BAA" and lists SOC 2 and ISO 27001.
Best for: patient and provider chat at scale with a known MAU budget. Watch-out: the pricing page does not mention the BAA itself, so confirm in writing that the $599 plan includes a signed agreement, not only HIPAA features.
3. Twilio Conversations
Twilio Conversations costs $0.05 per active user per month after the first 200 free, falling to $0.0475 above 5,000 and $0.045 above 10,000. Twilio made Conversations, for chat and SMS channels, HIPAA eligible in 2020.
The catch is the account. Twilio's HIPAA documentation says "HIPAA Accounts require Twilio Security Edition or Enterprise Edition," bought through sales, plus a signed BAA. It also says "Signing a BAA alone does not make your application HIPAA-compliant." Best for: products that mix in-app chat with SMS. Watch-out: the edition price is not published, so the per-user rate is not your real cost.
4. Sendbird
Sendbird markets HIPAA compliant one-to-one and group chat and names Accolade, Included Health and Teladoc as virtual care users. Its pricing page lists Starter at $349 and Pro at $499 a month billed annually, each with 5,000 MAU. In the compliance table, "HIPAA w/ BAA" reads Custom on Starter, Pro and Enterprise and is absent from the free trial. SOC 2 and ISO 27001 are checked on every plan.
Best for: virtual care products that want a vendor with large telehealth references. Watch-out: the BAA is available from Starter but priced as Custom, so $349 is not your HIPAA price until sales quotes the agreement.
5. PubNub
PubNub's plan comparison lists a "Business Associate Agreement (BAA) for HIPAA compliance" on Pro only, not on Free or Starter. Its HIPAA page says it "will enter into a Business Associate Agreement (BAA) with customers subject to HIPAA regulations." Starter costs $98 a month for 1,000 MAU, and Pro is custom.
Best for: apps where chat is one of several real-time features, such as presence or live device data. Watch-out: PubNub is a real-time messaging platform, so plan for more chat UI work than with a chat-specific SDK.
What a BAA does not cover
A BAA makes the vendor responsible for its part. Your part stays yours.
- Encryption does not remove the BAA. HHS says a cloud service provider that stores only encrypted ePHI is still a business associate even without the key, per its cloud computing guidance.
- Third parties inside the SDK need their own coverage. CometChat's AI features and any push or analytics service you route messages through sit outside the chat vendor's BAA unless the vendor says otherwise.
- Your app still needs access control, audit logs and offboarding. Twilio's warning applies to every vendor here.
Which chat API fits your app
- Lowest published price to a signed BAA: CometChat.
- Predictable cost for about 10,000 monthly users: Stream.
- Chat plus SMS to patients: Twilio Conversations.
- Large telehealth references for a procurement review: Sendbird.
- Chat beside presence and live device data: PubNub.
For clinician workflows where messages must become part of the clinical record, our guide to HIPAA chat for clinicians covers when an SDK stops being enough.
What our healthcare pipeline shows
These shares come from healthcare and telehealth companies that evaluated custom development with us. A theme counts only when at least three companies raised it independently. Around 15% said their product had to satisfy privacy, security, data residency and sometimes medical device rules at once.
Chat requests in that pipeline rarely arrived as chat alone. One clinical communication request listed chat next to a database, a management portal and screen sharing, and asked for basic EMR or practice management integration with automated record keeping. Budgets stated for first versions of HIPAA communication products ran from $10,000 to $25,000 at the low end to under $90,000. Price the BAA tier against those numbers before you choose an SDK.
Price the BAA tier, not the free tier
Every free tier here is a development sandbox. The bill that matters starts at the plan that signs the BAA, and that plan costs between $359 a month and a custom quote. Teams that prototype on a free tier and discover the jump at launch either delay go-live or ship PHI without an agreement.
So pick the SDK on three numbers: the price of the BAA tier, the MAU it includes and the overage rate. Get all three in writing before sprint one, and put the annual safeguard verification into the contract while you are at it.
Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The pipeline records behind this article's healthcare buyer section sit in the operations he oversees.
Building chat into a health app? Start with the BAA map
Tell us your expected monthly users, the channels you need and which roles send messages. We will map which SDK tier signs a BAA for that load, which other services need their own agreement, and what the chat build adds to your app.