HIPAA compliant CRM? CRMs that sign a BAA
CRMs that sign a BAA — on which editions, how you put the agreement in place, and which features you must switch on or keep away from patient information.
CRM and patient relationship management at a glance
A CRM can hold patient information under HIPAA when the vendor signs a BAA that covers the CRM product and edition you use, and you switch on its health-data settings and keep PHI out of the features the BAA excludes — often email marketing, chat, AI and some integrations. We compare 5 products in CRM and patient relationship management. 1 signs a Business Associate Agreement (Microsoft Dynamics 365). 3 sign one only for certain plans or products (HubSpot, Salesforce, Zoho CRM). 1 does not (Pipedrive). Every value links to the vendor's own documentation and shows when it was checked.
| Sign a BAA | Microsoft Dynamics 365 |
|---|---|
| Only some plans or products | HubSpot, Salesforce, Zoho CRM |
| No BAA | Pipedrive |
4 more facts
| Products compared | 5 |
|---|---|
| Compared on | BAA without a sales process, BAA on entry-level team plans |
| Commissions | None — no vendor pays us |
| Facts checked since | 2026-10-17 |
Comparison
Alphabetical. No vendor pays us for listings, rankings or referrals — methodology.
| Product | Signs a BAA | BAA without a sales process | BAA on entry-level team plans |
|---|---|---|---|
| HubSpot | Conditional | Yes | No |
| Microsoft Dynamics 365 | Yes | Yes | Not verified |
| Pipedrive | No | Not verified | Not verified |
| Salesforce | Conditional | No | Not verified |
| Zoho CRM | Conditional | No | Not verified |
Found an outdated or wrong fact? Report it
What to check before you choose
- A BAA that names your product and edition
- CRM vendors usually limit the BAA to higher editions and list the covered products. A BAA for the platform does not cover every add-on (164.502(e)).
- Health-data settings
- Several CRMs have a setting that marks PHI fields and limits where they can go. Switch it on before importing patient data — some cannot be switched off later.
- Marketing to patients
- HIPAA marketing generally requires the patient's authorization (164.508(a)(3)). Appointment reminders and many treatment or own-service communications fall outside the definition of marketing (164.501), but payment from a third party for a communication can change the answer. Check each campaign's purpose and any remuneration before sending — a CRM makes it easy to cross that line.
- Integrations, email and AI
- Every app connected to the CRM that receives PHI needs its own basis, usually a BAA. Check which email, SMS, chat and AI features the BAA excludes.
- Tracking on forms and landing pages
- Web forms and tracking scripts that feed the CRM can send patient information to advertising platforms — check them under the online tracking guidance.
Common mistakes
- Importing patient lists into a standard CRM edition the BAA does not cover.
- Sending marketing emails to patients from a CRM without checking whether an authorization is needed.
- Connecting the CRM to an email or ad platform that has no BAA.
How we compare
- BAA without a sales process
- You can put the BAA in place yourself — it is included in standard terms or accepted in account settings — rather than requesting it and waiting for approval.
- BAA on entry-level team plans
- The BAA is available on the vendor's entry-level business or team plan, not only on enterprise tiers.