HIPAA compliant chat for clinicians in 2026: when to build custom

TL;DR

HIPAA compliant chat for clinicians in 2026 is a commodity purchase when the job is conversation: Spruce Health sells it from $24 per user a month, and Microsoft offers its HIPAA business associate agreement to covered entities by default. It stops being a simple purchase when the conversation is also the record. Intraoperative neurophysiological monitoring (IONM) is the clearest case, and the logic carries to any team that documents events while they happen.

• Medicare pays remote IONM under G0453 only for undivided attention to one patient, in 15-minute units.
• Novitas requires that chat logs, where they exist, show ongoing times of conversation for that patient.
• A 2019 systematic review found synoptic operative reports more complete than narrative ones.
• In our own clinical communication requirement records, every one named an administrative surface next to the chat.

Where an off-the-shelf messenger is the right answer

Secure messaging between clinicians is a solved product category, and the prices show it. Spruce Health lists its Basic plan at $24 per user per month and its Communicator plan at $49, with a business associate agreement included in every trial and paid plan. Doximity makes Dialer free for verified U.S. clinicians, though it is built for reaching patients rather than for team chat. Microsoft makes its HIPAA business associate agreement available by default to covered entities and business associates, and Teams sits inside that scope.

If your problem is staff texting each other on personal phones, buy one of these this quarter. You will not out-engineer a company whose whole roadmap is that problem.

The fine print shows where the category ends. Slack supports HIPAA only on Enterprise Grid with a signed BAA, bars PHI from some fields and may not be used to communicate with patients or their families. Messengers carry conversations. They do not know what a procedure is or which minutes belonged to which patient.

Between the messenger and a custom build sits a third tier: enterprise clinical communication platforms sold to hospitals, with role-based routing, on-call schedules and EHR connectors. For hospital paging and consult traffic, start there. The test is the same as for a custom build: can it capture your typed events, hold your role model and produce your time evidence? If it can, buy it.

The Security Rule rewrite is 21 months old and still proposed

On January 6, 2025 the HHS Office for Civil Rights published a proposed overhaul of the HIPAA Security Rule. The HHS fact sheet lists the changes: drop the split between required and addressable specifications, require encryption of ePHI at rest and in transit, require multi-factor authentication. As of October 2026 the Federal Register carries no final rule, and HHS states that the current rule remains in effect.

For a custom build that is a reason to act now. Encryption is addressable today under 45 CFR 164.312. Under the general rules in 164.306 that means a risk assessment decides: implement it, or document why it is not reasonable and appropriate and adopt an equivalent alternative where one is. If the proposal lands near its published form, that option disappears. Encryption at rest and MFA on every clinician login are cheap in sprint one and expensive in year two. Build to the proposal.

Orders moved first. CMS memo QSO-24-05 of February 8, 2024 made texting of patient information and orders among the care team permissible through a HIPAA compliant secure texting platform. The Joint Commission followed on June 5, 2024 with a condition that matters more to architecture than any cipher: texted orders must be dated, timed, authenticated and promptly captured in the EHR. A messenger with no reliable path into the record, whether an interface or a defined manual step, turns every texted order into a transcription risk.

How we built this breakdown

Three rules, applied to everything below.

• Regulatory and payer facts come from the regulation, the contractor policy or the society guideline itself.
• Engineering examples are work we published as case studies, linked so you can check them.
• Where we publish our own numbers, any group with fewer than three data points is not published.

One disclosure. Mercury Development builds custom healthcare software, so we have a stake in where the build line falls. The guides ranking for this topic are vendor lists, such as GetStream's fair roundup of 10 HIPAA compliant chat apps. None we checked asks what happens when the chat has to become the clinical record.

Messenger, chat API or custom build at a glance

Chat APIs are the middle path. Twilio requires Security Edition or Enterprise Edition for HIPAA accounts plus a signed BAA, and Stream describes its telehealth offering as HIPAA ready with a BAA. You buy messaging infrastructure, usually with client SDKs. The clinical rows below the first are still yours.

What an intraoperative monitoring team needs from chat

IONM puts the communication problem in its sharpest form. The technologist sits in the operating room; the interpreting physician is often somewhere else. The American Clinical Neurophysiology Society's Guideline 11A puts the technologist in the room while data is acquired, lets the physician follow the data in real time from a remote location, and tells the team to notify the surgical team and the anesthesiologist of significant changes immediately. Alerts issued should be noted. It also recommends no more than three concurrent cases per physician and warns that post-hoc analysis cannot replace real-time interpretation.

The ASNM guideline for the supervising professional calls the roles IONM-T and IONM-P and describes a remote model in which a continuous, HIPAA compliant feed of all live data is available to the physician. Call them technologist and reader if you like: two people, two locations, one patient. Inpatient spine cases using neuromonitoring rose from 31,762 in 2008 to 125,835 in 2014 in national inpatient sample estimates.

Now add Medicare. CMS created G0453 for remote monitoring, billable only for undivided attention by the monitoring physician to a single beneficiary, per 15 minutes, with no more than four units in a 60-minute period. The Novitas policy L35003 requires routine real-time auditory or written communication between the supervising physician and the operating room. Then comes the sentence to read twice: if chat logs are available, they must include ongoing times of conversation and reflect the dedicated time for that particular beneficiary.

So the chat log becomes part of the billing evidence, though never all of it. The CMS FAQ asks the physician to document and differentiate the exclusive, continuous minutes of time, and that needs its own record. A thread that mixes three rooms and records only message times answers none of the questions an auditor will ask.

Structured events instead of free text

Free text is how clinical communication starts and why it breaks. A message that says "lost left TcMEP, told surgeon, MAP up" is readable at 10:42 and nearly useless at month end. Nobody can count it, chart it against the surgical timeline or prove which minutes it belonged to.

A 2019 systematic review of synoptic versus narrative operative reports found completion higher in synoptic reports, and mandatory fields pushed completion close to 100%. A Delphi panel of 15 spine deformity surgeons built consensus guidelines for responding to neuromonitoring events with 105 items, 53 of them in a response algorithm. A response algorithm with 53 agreed items is a form, whether or not anyone draws it as one.

So model the event first, then let people talk about it. That means a small typed vocabulary the technologist can hit in one or two taps under pressure: baseline acquired, signal change by modality, alert to the surgeon, intervention, recovery, case closed. Each event carries the case, the patient, the author, the time and the reader on duty. Billable minutes live in a separate attention log, where the reader opens and closes a session per patient; events corroborate that log and never replace it. Free text survives as a note on an event. The reader sees a timeline per case instead of a scroll per room.

Roles and permissions are most of the product

HIPAA's technical safeguards at 45 CFR 164.312 require a separate name or number that identifies and tracks each user, an emergency access procedure, plus audit controls that record and examine activity. Automatic logoff and encryption are addressable today. In a clinical communication build those lines turn into a management portal: credentials for technologists and readers, case assignment, concurrency limits, report export, plus deactivation on the day someone leaves.

Concurrency is where configuration beats code. The society guideline above allows up to three concurrent cases, while Novitas states that more than one patient can no longer be monitored during the same fifteen-minute interval. Hard-code the limit and every payer rule change becomes a release.

Our medical billing case study shows the same layer in production: operators add rejection codes and workflows themselves and limit codes by user class, over a secure channel designed so that patients' confidential information is never stored on the user side. Copy that last property for clinician chat: the phone shows the record, the server keeps it.

Screen share is a data path that needs BAA coverage

Screen sharing gets listed next to chat as if it were a button. In remote monitoring it is how a reader sees waveforms, which makes it a PHI stream. Whoever carries it must be covered by a BAA, sometimes the agreement you already hold with the chat vendor and sometimes a separate one, and someone has to decide about recordings.

Two decisions sit behind that button. First, whose pipe: the monitoring system's own remote viewer, or a video vendor under a BAA, such as Zoom, which says it executes business associate agreements for HIPAA programs. Second, whether sessions are recorded and where recordings live. HHS is explicit that a cloud provider storing encrypted ePHI is a business associate even without the decryption key. Every service that keeps a recording, a log or a message sits inside your compliance boundary.

If video with patients is the core of the product, compare our shortlist of telemedicine app development companies.

Export to the EMR and the practice management system

EMR integration tends to arrive as one line of scope with no standard attached. Turn it into three exports before anyone estimates.

1. The clinical record. HL7 FHIR defines the Communication resource as a record of information transmitted from a sender to a receiver, and notes that Communication instances are part of the patient record while AuditEvents are not. It is a record format; messages still travel over your own transport. That line is your data model: conversations go to the record, access logs stay in the audit trail.
2. The report. A signed case report travels as a document, indexed through FHIR DocumentReference, or through the HL7 version 2 document management chapter where the receiving system still speaks v2.
3. The billable time. Practice management needs units per patient per case, calculated from the reader's attention log, cross-checked against the event timeline and never retyped.

Ship the export first, integrate second. Bidirectional interfaces run on the receiving vendor's calendar.

Teams that build those interfaces are ranked in our list of EHR/EMR development companies.

What a custom build costs and when not to build one

Public anchors first. ScienceSoft puts the cost of implementing secure messaging in healthcare at $80,000 to $800,000+. RaftLabs estimates that HIPAA architecture adds $20,000 to $40,000 to any baseline messaging build. These are vendor estimates with a shared shape: compliance is a fixed cost, workflow depth the variable one.

Set that against $24 per user per month and the decision rule writes itself. If the workflow is the conversation, buy. If the conversation is evidence for a clinical record or a claim, the event model, the role model and the exports are the product, and no subscription sells those.

The bad-fit signal we name early is a budget fixed before anyone listed the roles. Sized against messenger subscriptions, it buys a messenger. Fine when a messenger is what you need; poor when your auditor needs a timeline.

For the wider budget picture, our guide to healthcare app development cost shows what HIPAA adds to each product type.

What our own requirement records show

Counted by hand in September 2026 across our healthcare requirement records where people exchange messages, calls or shared screens inside care delivery. Notification-only messaging, maintenance of an existing messaging product and non-human care were excluded. Record counts stay unpublished under our client agreements; shares are rounded to five points. Three patterns are large enough to publish.

• Every one named an administrative surface next to the chat: account creation, role permissions, moderation or an oversight dashboard. Chat never arrived alone.
• Around 70% asked for video or screen sharing alongside text.
• Around 45% named EMR, EHR or practice management data, and none of those named an interface standard. No HL7 version 2, no FHIR, no vendor API.

A fourth pattern, typed event capture during a live procedure, had fewer than three data points, so it is not published here.

The third finding moves budgets. Integration that is a word in the request becomes a negotiation with a third party during the build, so name the target system, the format and the direction before the estimate.

Why we design the event model before the chat screen

Opinion, stated plainly. On a clinical communication build we would rather ship a plain chat window over a correct event model than a polished messenger over free text.

The reason is reversibility. A chat interface can be redesigned in a sprint. A year of unstructured messages cannot be turned into structured events afterwards, because the structure was never captured. You can only guess at it with text mining and defend the guess to an auditor.

Two limits. This applies where communication feeds a record, a report or a claim. And it does not justify a custom build for a team that needs to stop texting on personal phones next week. That team should buy a messenger and revisit when the workflow outgrows it.

Written by Alexey Rodionov, Lead Front-end Developer at Mercury Development since 2020. Alexey is a Google Developer Expert in Web Technologies and a Chromium contributor whose code ships in Chrome DevTools, Google's Bubblewrap and Microsoft PWABuilder. The requirement reviews behind this article, where incoming clinical communication requests are read for user roles, record structure and integration points, come from the engineering practice he works in.

Send us your event list and we will map the build

List the people who sign in, the events they must capture and where each record has to end up. We will come back with the event model, the role matrix and the exports that list implies, plus the parts we would leave to an off-the-shelf messenger.