Is Salesforce HIPAA Compliant? What Medical Practices Need to Know

The Short Answer

Salesforce can be HIPAA compliant, but the conditions are specific. You need Professional, Enterprise, or Unlimited edition of Sales Cloud or Service Cloud, and you need to explicitly request a signed Business Associate Addendum from Salesforce. Upgrading your plan does not automatically create compliance — the BAA is a separate step.

Salesforce Essentials does not qualify for a BAA at any price. If your practice is on Essentials and has patient data in the system, that is a compliance issue regardless of how little data is involved.

Which Salesforce Products Support HIPAA

Not all Salesforce products are treated equally under HIPAA.

Sales Cloud and Service Cloud can be covered by a BAA on Professional, Enterprise, and Unlimited editions. These are the standard CRM tiers most practices know. The BAA covers the core platform: contact records, cases, tasks, and the data stored within your Salesforce org.

Salesforce Health Cloud is purpose-built for healthcare. It includes HIPAA controls, patient timeline views, care coordination tools, and provider relationship management. A BAA is available. The starting price is approximately $300/user/month — a 5-provider practice with admin access is looking at $18,000 or more per year before any additional licenses.

Marketing Cloud is not automatically covered. Salesforce offers HIPAA-compliant configurations for Marketing Cloud through separate agreements, but standard Marketing Cloud accounts with patient contact information are not compliant. If your practice sends appointment reminders or health communications through Marketing Cloud, this needs separate review.

AppExchange apps are not covered by your Salesforce BAA. Each app installed in your org is a separate vendor. If an app processes, stores, or transmits PHI, you need to evaluate and potentially sign a BAA with that app’s vendor independently.

The BAA Process

Salesforce does not automatically present a BAA at signup. You need to request one. The process typically involves contacting your Salesforce account executive or customer success manager, or going through Salesforce’s HIPAA compliance documentation portal.

Once in place, the BAA specifies which products and features are covered, what Salesforce’s obligations are for safeguarding PHI, and what your practice’s obligations are on your end — including things like access controls, user authentication, and data retention policies.

A signed BAA does not mean your Salesforce configuration is automatically compliant. It means Salesforce has agreed to its obligations as a business associate. You still need to configure your org appropriately: field-level security on sensitive data, audit trail logging, session settings, and user access controls.

What a Salesforce BAA Does Not Cover

The BAA covers your core Salesforce org. It does not extend to adjacent systems or workflows that touch your Salesforce data.

If a staff member exports a contact list from Salesforce into an Excel file and sends it via personal email, that PHI is now outside the BAA’s scope. If you’re using a third-party app from AppExchange to manage patient intake forms and that vendor hasn’t signed a BAA with you, that data path is not covered.

Marketing Cloud, Pardot, and other Salesforce products outside Sales/Service Cloud require their own compliance evaluation. The marketing team that added patient emails to a nurture campaign may not have known those emails needed to stay out of standard Marketing Cloud.

Task management is another gap. Salesforce cases and tasks can be used to track follow-up work, but Salesforce is not a HIPAA-compliant task management product in the sense that a clinical practice needs. The BAA covers what’s in your CRM; it says nothing about a task list in Asana or a staff checklist in Notion that references patient names.

What Small Practices Actually Need

Most small practices that search “is Salesforce HIPAA compliant” are not running Salesforce already. They’re evaluating whether Salesforce could handle their patient relationship or referral tracking needs in a compliant way.

The honest answer: Salesforce at the qualifying tiers is expensive for a small practice, and the compliance configuration requires ongoing attention. Professional edition starts at approximately $75-80/user/month for basic CRM, before any HIPAA configuration work or third-party implementation support.

Salesforce Health Cloud at $300/user/month is a clinical-grade product that makes sense for mid-size health systems, but it is priced well above what a 5-physician independent practice can justify.

What small practices typically need is two separate tools: a CRM for managing referral pipelines and patient relationships (which may or may not be Salesforce), and a HIPAA-compliant task management tool for the operational work that runs between their EHR and their CRM. That second layer is where PHIGuard fits. We built it because practices kept running into the same gap: their CRM was covered or scoped out of PHI, but the administrative and compliance tasks that don’t fit in the EHR had nowhere to go. PHIGuard starts at $20/month flat for up to 10 staff with a BAA at every tier.