Why Apple's encryption leadership does not make iMessage a HIPAA-compliant channel for healthcare communication.
Get started for freeiMessage offers industry-leading encryption, including post-quantum protections, but Apple explicitly prohibits the use of iCloud services to transmit protected health information and will not sign a BAA for messaging. Healthcare teams that text about patients through iMessage are operating outside HIPAA. BloomText is purpose-built for healthcare messaging and includes a signed BAA on every plan.
BloomText vs iMessage
| Feature | BloomText | iMessage |
|---|---|---|
| Signed Business Associate AgreementApple's iCloud Terms of Service explicitly prohibit covered entities from using iCloud to create, receive, maintain, or transmit PHI. | Included | Not included |
| Lawful channel for transmitting PHIApple's iCloud Terms prohibit PHI, iMessage syncs with iCloud, and Apple does not offer a BAA for consumer messaging. | Included | Not included |
| Conversation audit trailiMessage provides no organizational audit trail or admin visibility into conversations. | Included | Not included |
| Admin user removal with data revocationiMessage has no organizational admin controls. Messages persist on individual devices. | Included | Not included |
| Works on Windows and AndroidiMessage is limited to Apple devices. BloomText supports Windows, Mac, iPhone, and Android. | Included | Not included |
| No patient app download requirediMessage requires an Apple device on both ends. BloomText patients reply via standard SMS. | Included | Not included |
iMessage uses end-to-end encryption with AES, RSA, and Apple's post-quantum PQ3 protocol. By consumer messaging standards, iMessage security is among the best available. But HIPAA compliance is not a measure of encryption strength. The HIPAA Security Rule requires a signed Business Associate Agreement, administrative safeguards, access controls, audit logging, and breach notification procedures. Apple provides none of these for iMessage.
Apple's iCloud Terms of Service prohibit covered entities from using iCloud to create, receive, maintain, or transmit protected health information. Because iMessage syncs with iCloud and Apple does not offer a Business Associate Agreement for its consumer messaging services, there is no path to using iMessage in a HIPAA-compliant way. Apple has not published any healthcare compliance program or BAA for iMessage independent of iCloud.
iMessage is the default messenger for iPhone users. When healthcare staff need to communicate quickly, they reach for what is already on their phone. The result is patient information flowing through a channel with no BAA and no compliance program. BloomText gives staff a messaging experience that feels just as immediate — with desktop and mobile apps, push notifications, and read receipts — while keeping every message inside a HIPAA-compliant platform with a signed BAA.
Comparison last verified May 21, 2026. Sources: BloomText pricing, Apple iCloud Terms of Service, HHS HIPAA Security Rule, HHS FAQ: encrypted ePHI and BAA requirements.
