Is Salesforce HIPAA compliant?
CRM platform including Sales Cloud, Service Cloud and Health Cloud. Salesforce signs a Business Associate Addendum through the account team, covering the services on its published list.
Salesforce signs a Business Associate Agreement only under specific conditions. Customers contact their account representative for a Business Associate Addendum; Sales Cloud, Service Cloud, Health Cloud and the Lightning Platform are on the covered services list, covered only if the signed BAA includes them.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: Salesforce — Business Associate Addendum restrictions and covered services · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
| Signs a BAA | Conditional | Salesforce — Business Associate Addendum restrictions and covered services |
|---|
What you still have to configure
- Encrypt PHI you transmit using the covered services and PHI you store within your control, as the BAA restrictions require. source
Limitations
- Coverage is service by service: for example, the Discover feature of the Lightning Platform is not covered. Check the restrictions page before using any add-on with PHI. source
Against our criteria
| BAA without a sales process | No — Through your account representative. | Salesforce Compliance — HIPAA |
|---|---|---|
| BAA on entry-level team plans | Not verified | Not verified yet |
Alternatives
- HubSpot →BAA: conditional
- Microsoft Dynamics 365 →BAA: yes
- Pipedrive →BAA: no
- Zoho CRM →BAA: conditional