Last verified: October 2026, against Salesforce's official BAA, product and pricing pages. General information, not legal advice; confirm with your compliance officer or attorney.
Is Salesforce HIPAA compliant? Salesforce can be used with patient information, but only on services listed in its Business Associate Addendum, after you sign a BAA that names them, and with the configuration Salesforce requires. About 90 people a month in the US ask this exact question (keyword difficulty 3; Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026). The harder question for an independent practice is whether it's worth the setup.
Short answer: is Salesforce HIPAA compliant?
Short answer (verified October 2026): Salesforce offers a Business Associate Addendum for its "HIPAA Covered Services," a published list that includes Sales Cloud, Service Cloud, Health Cloud, Experience Cloud and Salesforce Shield (Salesforce BAA restrictions page (opens in a new tab), last updated September 30, 2026). Coverage applies only when "Customer and Salesforce must sign a BAA that includes the HIPAA Covered Service," and customers must "encrypt all PHI" sent through the services and, where within their control, stored in them. Some features are excluded.
In practice: a signed BAA naming your Salesforce products, plus correct configuration, makes Salesforce usable for PHI. Without both, keep patient information out.
Salesforce's BAA and the services it covers
The restrictions page groups covered services by product family. The ones a practice is most likely to consider:
| Product | On the covered list? | Restrictions noted |
|---|---|---|
| Sales Cloud, Service Cloud | Yes | General restrictions apply |
| Health Cloud | Yes | General restrictions apply |
| Experience Cloud (portals) | Yes | General restrictions apply |
| Marketing Cloud Engagement | Yes | Marketing Cloud Einstein features in Marketing Cloud Next are not covered |
| Einstein Bots and other Einstein services | Yes, with restrictions | No PHI in Einstein Bots utterance records; Data Masking must be enabled for several AI features |
| Slack Enterprise | Yes, with restrictions | Requires the "Slack - HIPAA Enabled" option and bars communicating with patients |
| Tableau Server, Tableau Bridge | No | Listed as not covered |
Two more conditions matter. PHI use must follow Salesforce's acceptable use policies, and customers are responsible for the HIPAA compliance of third-party LLM providers they connect to Einstein GPT services. Covered services also apply only on Salesforce's own infrastructure, Hyperforce or other public cloud infrastructure, not on-premises deployments.
For what the BAA itself should contain, see business associate agreements.
Health Cloud vs Sales Cloud for practices
HIPAA doesn't require a healthcare edition. Both Sales Cloud and Health Cloud are on the covered list. The difference is features and price.
- Health Cloud is described by Salesforce as "the AI-first platform purpose-built for healthcare," with a patient 360 view, care plans, referral and appointment management, and FHIR-based integrations (Health Cloud (opens in a new tab)). Listed prices start at $350 per user per month for Sales & Service Core, billed annually, and run to $700 for the Max editions.
- Sales Cloud is a general CRM. Listed prices run from $25 per user per month (Starter Suite) to $550 (Max), most billed annually (Sales Cloud pricing (opens in a new tab)).
Salesforce says these prices are for information only. The BAA page names services, not editions, so confirm with Salesforce that the edition you buy is included in the BAA you sign.
Encryption, Shield and audit features to verify
The Security Rule expects access controls, audit controls and, where reasonable, encryption (45 CFR 164.312 (opens in a new tab)). In Salesforce, the relevant add-on is Salesforce Shield, "a paid add-on bundle" whose components can also be bought separately (Salesforce Shield (opens in a new tab)):
- Platform Encryption: encrypts sensitive data at rest, with bring-your-own-key options.
- Event Monitoring: tracks user activity and can block risky behavior.
- Field Audit Trail: keeps change history for selected fields.
- Data Detect: scans orgs for sensitive data.
The BAA page lists Shield as a covered service but doesn't make it a general prerequisite. It does require you to encrypt PHI where within your control. Ask Salesforce, in writing, how your edition meets that requirement with and without Shield, and how long standard login and field history are retained.
Is Salesforce practical for an independent practice?
It can work, but count the cost honestly.
Hypothetical arithmetic: three front-desk users on Health Cloud at the listed $350 per user per month is 3 × $350 × 12 = $12,600 a year, before Shield, setup help or integrations. On Sales Cloud the license line can be lower, but the configuration work is the same.
That work is the real barrier. Roles, profiles, field-level security, encryption choices, integrations with your website forms, and a policy for AI features all need someone who knows Salesforce. If no one on your team has configured Salesforce before, budget for outside help.
Lighter-weight alternatives
If your main need is capturing website inquiries and seeing where they come from, compare BAA scope and plan requirements across simpler tools in HIPAA compliant CRM options. Our dated checks cover is Zoho HIPAA compliant and is HubSpot HIPAA compliant, and the healthcare CRM guide explains what a practice needs in the first place.
Alternative (facts only): Medfy's base plan includes a patient CRM and inbox for website forms and messages, access-controlled, under a BAA Medfy signs with each practice. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada. It is not an enterprise CRM.
To see how your current site captures inquiries, start with the free marketing audit.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Does Salesforce sign a BAA?
Yes. As of October 2026, Salesforce offers a Business Associate Addendum for a published list of HIPAA Covered Services, including Sales Cloud, Service Cloud and Health Cloud. Coverage applies only when the signed BAA includes the service you use, and you must follow Salesforce's restrictions, including encrypting PHI. Some features, mostly AI, analytics and Heroku options, are excluded. Have your compliance officer review the BAA before importing patient data.
Do I need Salesforce Health Cloud for HIPAA?
No. HIPAA doesn't require a healthcare edition. Salesforce's BAA list includes Sales Cloud and Service Cloud as well as Health Cloud. Health Cloud adds healthcare features such as patient records views, care plans and referral management, at a higher price per user. Choose it for the features, not for compliance, and confirm with Salesforce that the edition you buy is in your signed BAA.
Is Salesforce too complex for a small practice?
Often, for the job a small practice needs done. Salesforce can be configured for patient intake, but getting roles, field permissions, encryption and integrations right usually takes an experienced administrator or consultant, and every user adds a monthly license. If your need is capturing website inquiries and seeing their source, a lighter tool with a BAA may cover it. Weigh the setup work honestly.