HIPAA-Compliant Workspaces

Chat Data has been usable for protected health information for a while, backed by a Business Associate Agreement. The catch was that the agreement described the boundary, and staying inside it was down to you: knowing which AI models were covered, which messaging channels were safe to connect, which features sent data somewhere the agreement didn't reach. One teammate picking a different model on a Tuesday afternoon was all it took to step outside it, and nothing on screen would tell you.

Now the workspace keeps track of that boundary for you.

What's New

• What can't be covered is turned off — Turn HIPAA on for a workspace and the options no agreement can cover stop being available. AI models outside our agreement, consumer messaging apps that don't offer one, and response formats that render through an uncovered provider are refused when you try to save them, with a plain explanation of why.
• Unsupported channels are disconnected when you switch it on — If the workspace already has WhatsApp, Telegram, Discord, LINE, Messenger or Instagram connected, those integrations are removed as part of enabling HIPAA. They can't be covered by an agreement, and leaving them connected would keep a live route for conversations. Plan for this before you enable — those agents stop serving those channels.
• What you can cover yourself is flagged, not hidden — Some providers, such as Slack and Zendesk, will sign an agreement with you directly. Those stay available, and we tell you on the connection screen that they're compliant only while you hold that agreement. The same applies to anything you wire up yourself, like your own backend or MCP server, and to the Send Email step in workflows: you write those messages, so what goes into them stays your call.
• Settings you already had keep working, with a notice — For everything that isn't a blocked channel — an AI model, an app action, a live-chat setting — we don't break your working setup. It keeps running, and the next time that agent handles a conversation the workspace owners get a notice naming the agent, the exact item, and the one change that resolves it, at most once a day per item.
• Compliance you can see at a glance — A shield badge marks HIPAA workspaces in the switcher, so anyone with access to several workspaces can tell instantly which rules they're working under.
• Two-factor sign-in for workspace members — Everyone who signs in to Chat Data and works in the workspace uses a second factor, with setup guided the first time. Customers you give portal access to sign in through your own setup, so that side stays yours to manage.
• Full detail in your email notifications — Escalations, offline messages, transcripts and digests arrive complete, with message text, attachments and lead details, delivered under our agreement with Amazon Web Services. Text alerts deliberately leave the conversation out; open the dashboard to read it.

How to Use

• Check your channels first — If you're using WhatsApp, Telegram, Discord, LINE, Messenger or Instagram, decide where those conversations should go before enabling, because those connections are removed on activation.
• Ask us to enable it — HIPAA workspaces and the Business Associate Agreement are available on the Standard plan and above. Contact support and we'll put the agreement in place and switch it on.
• Finish your 2FA setup — Everyone on the team is prompted at sign-in.
• Act on any notices — Each one names the agent, the item and the fix, so you can clear them individually rather than auditing everything yourself.
• Carry on building — From then on the workspace keeps the boundary in view. If something can't be covered, you'll find out when you try to save it, not in an audit months later.

The agreement hasn't changed. What's changed is that you no longer have to hold it in your head.