Many companies claim HIPAA compliance. That doesn't mean much, though, unless they're willing to sign a BAA with their customers. I don't have direct experience with this and our Slack usage, but I'm guessing this is where the disconnect is.