HIPAA compliant CRM: which CRMs sign a BAA, on which plan?

By Mikhail Oskola, founder of Retailbox Automation.

Checked: every vendor page cited here on 16 October 2026: legal, help, trust and pricing pages, in USD, plus HHS and eCFR for the rules. Not legal advice.

A CRM is HIPAA compliant only when the vendor signs a business associate agreement (BAA) and you set it up correctly. As of 16 October 2026, Salesforce, HubSpot, monday.com, Zoho CRM, HighLevel, Dynamics 365, Zendesk, Airtable and ClickUp will sign one, each on a specific plan. Pipedrive's terms say it isn't designed for HIPAA, and Freshsales sits outside Freshworks' BAA.

Which CRMs sign a HIPAA BAA?

Each row is what the vendor says about itself on its own legal, help, trust or pricing pages, read on 16 October 2026. Review sites and AI answers were not used as sources. The vendor pages behind each row are linked under the table.

Compare the price of the plan that carries the BAA, not the entry plan. At HubSpot, monday.com, Airtable, ClickUp and Zendesk the BAA sits on an upper tier, and at monday.com, Airtable and ClickUp that tier has no public price.

• Salesforce: https://www.salesforce.com/company/legal/business-associate-addendum/ and https://help.salesforce.com/s/articleView?id=xcloud.manage_your_pro_suite_compliance.htm&type=5
• HubSpot: https://knowledge.hubspot.com/account-security/store-sensitive-data and https://legal.hubspot.com/hubspot-product-and-services-catalog
• monday.com: https://monday.com/crm/pricing and https://monday.com/l/privacy/hipaa-baa/
• Zoho CRM: https://www.zoho.com/hipaa.html and https://www.zoho.com/crm/comparison.html
• HighLevel: https://help.gohighlevel.com/support/solutions/articles/48000983084-hipaa-compliance-with-highlevel and https://www.gohighlevel.com/terms-of-service
• Microsoft Dynamics 365: https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech
• Zendesk: https://support.zendesk.com/hc/en-us/articles/4408832117786-Advanced-Compliance
• Airtable: https://www.airtable.com/company/health-info-datasheet and https://support.airtable.com/docs/understanding-hipaa-at-airtable
• ClickUp: https://help.clickup.com/hc/en-us/articles/6327673904663-Compliance-and-General-Protection-Data-Regulation-GDPR, https://clickup.com/terms/ai and https://help.clickup.com/hc/en-us/articles/30565324050199-Use-AI-Notetaker-to-take-notes-and-record-SyncUps
• Insightly: https://www.insightly.com/privacy-policy/ and https://www.insightly.com/terms-of-service/
• Freshworks: https://crmsupport.freshworks.com/support/solutions/articles/238735-hipaa-configuration-guide
• Pipedrive: https://www.pipedrive.com/en/terms-of-service and https://trustcenter.pipedrive.com/

What makes a CRM HIPAA compliant?

Two things: a BAA from the vendor, and your own setup. HHS treats a cloud vendor that holds patient data for you as a business associate: "When a covered entity engages the services of a CSP to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA." That holds "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." (https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html, checked 16 Oct 2026)

There is no government certificate to look for. HHS says it does "not certify any persons or products as "HIPAA compliant."" (https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/be-aware-misleading-marketing-claims/index.html) A "HIPAA certified" badge on a CRM's website is marketing. The signed BAA is the document that counts.

Your setup is the other half. The Security Rule's technical safeguards (45 CFR 164.312) ask for five things: access only for people and programs that have been granted it, records of activity in the system, protection from improper change or deletion, proof that a user is who they claim to be, and protection for data sent over a network (https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312). In a CRM, our reading is that these map to user roles and field permissions, the audit log, single sign-on or two-factor login, and encrypted connections to every app that reads the data.

This is not legal advice. Vendor terms change, so confirm the plan and the BAA with the vendor and your compliance lead before any patient data goes in.

Is Salesforce HIPAA compliant? Sales Cloud, Health Cloud and the BAA

Yes, for the services named in your BAA. Salesforce's restrictions page says: "For Customer’s use of a HIPAA Covered Service to be covered by the BAA: (1) Customer and Salesforce must sign a BAA that includes the HIPAA Covered Service; and (2) Customer must comply with the terms of the BAA and this article, to the extent applicable." The covered list includes Sales Cloud, Service Cloud, Health Cloud, Salesforce Shield and Lightning Platform (https://www.salesforce.com/company/legal/business-associate-addendum/, last updated 30 September 2026, checked 16 Oct 2026). Salesforce's compliance site says to contact your account representative about the BAA.

Health Cloud is offered, not required. Sales Cloud and Service Cloud are on the covered list in their own right, and we found no Salesforce page that makes Health Cloud or Shield a condition. What the page does require is encryption: "Customer must encrypt all PHI: (1) transmitted using the HIPAA Covered Services; and (2) to the extent within Customer’s control, stored in the HIPAA Covered Services." It doesn't say which tool you must use for that.

Some features stay outside the BAA. Salesforce's help article on Pro Suite says: "These features and services offered in Pro Suite Edition aren’t covered by the Business Associate Addendum (BAA): Einstein Activity Capture, Salesforce Inbox, and Einstein Send Time Optimization (STO)." The first two are on by default, so they have to be switched off before patient data goes in.

Sales Cloud Pro Suite lists at $100 per user a month, billed annually (https://www.salesforce.com/sales/pricing/). Health Cloud runs from $350 per user a month for Sales & Service Core to $725 for Sales & Service Max, all billed annually (https://www.salesforce.com/healthcare/cloud/pricing/, checked 16 Oct 2026). The Health Cloud pricing page itself says nothing about HIPAA or a BAA.

HubSpot, monday.com, Zoho CRM and HighLevel: which plan carries the BAA

HubSpot: Enterprise only. Any Enterprise hub qualifies once Sensitive Data is on and both HIPAA checkboxes are ticked, and you accept the BAA in the account settings (https://knowledge.hubspot.com/account-security/store-sensitive-data, checked 16 Oct 2026). The cheapest Enterprise tier on HubSpot's pricing pages is Smart CRM Enterprise, from $75 per seat a month. Sales Hub Enterprise is $150 per seat a month plus a required $3,500 onboarding fee. One AI answer we saw listed call recordings as excluded. HubSpot's catalog marks call recordings and conversation intelligence as included for Sensitive Data.

monday.com: the tier changed its name. monday's CRM pricing page now says "Ultimate is a new name for our Enterprise tier", lists HIPAA compliance only on Ultimate, and prices it as "Custom price, tailored to your organization" (https://monday.com/crm/pricing, checked 16 Oct 2026). monday's BAA and help centre still say Enterprise. It is the same tier.

Zoho CRM: on request, by email to legal@zohocorp.com, and "No PHI should flow through any Zoho application until a signed BAA is in place." (https://www.zoho.com/hipaa.html, checked 16 Oct 2026) Zoho's HIPAA pages still don't name a CRM edition. Its edition comparison lists "HIPAA Compliance" on every paid edition and not on Free. The cheapest paid edition on its US pricing page is Standard, at $14 per user a month billed annually or $20 monthly. A feature listing isn't the BAA, so confirm the edition when you request the agreement.

HighLevel: "The add-on costs US$297 per month and cannot be disabled once purchased." Agencies on any plan can buy it, so the lowest total is the $97-a-month Starter plan plus $297 (https://help.gohighlevel.com/support/solutions/articles/48000983084-hipaa-compliance-with-highlevel, checked 16 Oct 2026). HighLevel's terms make the BAA "contingent upon your active and fully paid subscription to the HIPAA compliance package."

The full exclusions for these four, and what they mean for workflows between tools, are in HIPAA-compliant automation tools.

Is Pipedrive HIPAA compliant? What healthcare teams on Pipedrive do instead

No. Pipedrive's terms of service say: "Pipedrive Services are not designed to comply with industry-specific regulations such as the Health Insurance Portability and Accountability Act (HIPAA) or the Federal Information Security Management Act (FISMA)." The same section has clients agree not to use Pipedrive to store sensitive information (https://www.pipedrive.com/en/terms-of-service, current as of 16 September 2026, checked 16 Oct 2026). Pipedrive's trust center lists GDPR, ISO 27001 and SOC 2 among others, and no HIPAA.

That leaves two options: keep patient data out of Pipedrive entirely, or move it to a CRM whose vendor signs a BAA. If you move, sign the BAA and switch on the vendor's HIPAA settings before the import. Zoho's line above is a good rule for any vendor: no PHI until the BAA is signed.

The move itself is ordinary CRM work, and what breaks in a CRM migration covers the usual traps. Patient data adds three things to plan:

• Every field that holds PHI. Diagnoses, visit dates and treatment notes often sit in custom fields and free-text notes, not only in the standard ones.
• Attachments and email history. Files and old emails on deals and contacts can carry patient details, and they move with the records unless you leave them out.
• Every integration that reads the CRM. Each app that touches patient data needs its own BAA, so a form tool or email sync that worked with Pipedrive may not be allowed in the new setup.

Airtable, ClickUp and Zendesk: tools teams use as a CRM

Airtable signs on Enterprise Scale only. Its health information datasheet says customers "must be on the Enterprise Scale plan and sign Airtable’s Health Information Exhibit, which includes Airtable’s Business Associate Addendum (BAA) for customers subject to HIPAA" (https://www.airtable.com/company/health-info-datasheet, last updated 23 July 2026, checked 16 Oct 2026). Enterprise Scale has custom pricing. The datasheet rules out patient data in automated email text and in base or workspace names, and says not to use Airtable as a patient portal. Downgrade, and you must remove the data.

ClickUp signs on Enterprise: "ClickUp can support HIPAA compliance for Enterprise customers by agreeing to a BAA (Business Associate Agreement)." (https://help.clickup.com/hc/en-us/articles/6327673904663-Compliance-and-General-Protection-Data-Regulation-GDPR, checked 16 Oct 2026) Enterprise is "Contact sales" on ClickUp's pricing page. ClickUp AI has its own rule: no healthcare use unless you have the BAA and ClickUp has confirmed that your account is set up for healthcare AI use, with Zero Data Retention or other HIPAA-compliant endpoints on for that data (https://clickup.com/terms/ai). In HIPAA Workspaces, AI Notetaker can't take notes for ClickUp's own SyncUp calls. It still works in Zoom, Teams and Google Meet.

Zendesk signs through its Advanced Compliance add-on on Suite Professional, Enterprise or Enterprise Plus: "Advanced Compliance lets you sign a BAA or HDS Exhibit for accounts that may store PHI" (https://support.zendesk.com/hc/en-us/articles/4408832117786-Advanced-Compliance, checked 16 Oct 2026). Suite Professional lists at $115 per agent a month, paid yearly. The add-on price wasn't on the pages we read. Zendesk says "Any other Zendesk products or third party services" are not Healthcare Enabled, integrations and Marketplace apps included. Zendesk Sell, its sales CRM, isn't among the plans the page names.

Two marketing CRMs also publish a HIPAA position:

• Keap, now part of Thryv, offers its standard BAA addendum once you turn on Keap's HIPAA Security Control. Thryv's CRM BAA says the email and SMS features "are not HIPAA-compliant", so patient data can't go through Keap's messaging, and the BAA doesn't cover third-party products. Sources: https://learn.thryv.com/hc/en-us/articles/37506928781325-HIPAA-Security-Controls-for-Keap and https://www.thryv.com/terms/crm-baa/ (checked 16 Oct 2026).
• ActiveCampaign lists "HIPAA support" on its Enterprise plan, and its own blog says it offers "BAAs on eligible plans". Its Conversations product may not hold PHI under any plan. Get the BAA and the list of covered features in writing first. Sources: https://help.activecampaign.com/hc/en-us/articles/14251311251356-Overview-of-ActiveCampaign-plans, https://www.activecampaign.com/blog/hipaa-compliant-marketing and https://www.activecampaign.com/legal/conversations-policy (checked 16 Oct 2026).

A general CRM with a BAA, or a healthcare CRM?

It depends on what the CRM has to do. This is our reading of the table above, not a ranking.

Not sure which CRM fits? Take the 6-question CRM picker.

• A general CRM with a BAA fits when you treat patients much like customers: leads from ads and referrals, follow-ups, reminders, a pipeline. Someone has to set up the roles, fields and HIPAA settings.
• A healthcare CRM or practice-management system fits when you need intake forms, scheduling and an EHR connection out of the box and don't want to build them.
• For a small practice, the deciding number is the price of the plan that carries the BAA. Published prices run from $14 a user for Zoho CRM Standard, if Zoho confirms that edition, to $150 a seat plus onboarding for HubSpot Sales Hub Enterprise. monday.com, Airtable and ClickUp quote on request.
• On a CRM that won't sign, such as Pipedrive or Freshsales, keep patient data out, and plan the move before it goes in.

What breaks HIPAA coverage after the BAA is signed

A BAA covers the vendor's covered services, not everything connected to them. Inside the CRM, coverage usually breaks in five places: web forms that feed the CRM from a separate form tool, marketing email and SMS sent from the CRM (Keap's BAA excludes its messaging and monday.com turns off broadcast), connected apps without their own BAA, AI features the vendor excludes (HubSpot chatbots, HighLevel's AI features other than Reviews AI, Insightly's Copilot, ClickUp AI without the extra setup), and test copies such as HubSpot sandboxes, where Sensitive Data properties aren't available.

For the workflow side, where data moves between tools, see HIPAA-compliant automation tools.

FAQ

Is there an official HIPAA certification for CRM software?

No. HHS says it does not certify any person or product as HIPAA compliant, and it does not recognize private certifications for the Security Rule. Look instead for a BAA the vendor signs on the plan you will use, then set up access controls and audit logs yourself.

Does any free CRM plan include a HIPAA BAA?

Not among the CRMs we checked that name a plan. HubSpot needs Enterprise, monday.com its Ultimate tier, Airtable Enterprise Scale, ClickUp Enterprise and Zendesk Suite Professional or higher. Zoho CRM's comparison table shows its HIPAA feature on paid editions only, not on Free. Checked 16 October 2026.

Do I need a BAA if the CRM only holds names and appointment times?

HHS guidance points to yes for a clinic. It says a name alone is not necessarily PHI, but becomes PHI when listed with health care data, "such as an indication that the individual was treated at a certain clinic." A clinic's appointment list links names to care. Confirm your case with your compliance lead.

Is Salesforce Health Cloud required for HIPAA?

No Salesforce page we read requires it. Salesforce's BAA restrictions page lists Sales Cloud and Service Cloud as covered services in their own right, alongside Health Cloud and Shield. You still need a signed BAA that names the service you use, and Salesforce requires you to encrypt PHI.

Is Airtable HIPAA compliant?

On one plan. Airtable supports HIPAA only on Enterprise Scale, after you sign its Health Information Exhibit, which includes the BAA. Enterprise Scale has custom pricing. There is no admin setting: Airtable turns HIPAA on for your organization after the signing. Airtable also says not to use it as a patient portal.

What should be signed before patient data is imported into a new CRM?

The vendor's BAA, on the plan you are actually buying, before the first record moves. Then switch on the vendor's HIPAA settings and sign BAAs with any import tool or integration that will touch the data. Zoho's wording works for any vendor: no PHI until a signed BAA is in place.

Who wrote this

Retailbox runs CRM consulting and training: we help teams pick a CRM, set it up or migrate to a new one, and train the team. That gives us a stake in which CRM you choose, so we kept our services out of the answers above. This article reads each vendor's published terms. It is not a report from one of our projects.

Originally published at https://retailbox-automation.com/blog/hipaa-compliant-crm. Want this built for your team? See CRM consulting and training.