monday.com offers a BAA only on its enterprise tier: Enterprise for work management and Ultimate for monday CRM, with the HIPAA compliance feature enabled. Free, Basic, Standard and Pro have no BAA, so PHI should not go there.
Is monday.com HIPAA compliant? Verdict: conditional
Conditional A BAA is available on the enterprise tier (CRM: Ultimate) with the HIPAA compliance feature enabled; the main exclusion is third-party services and marketplace apps. Checked 2026-10-28.
Short answer
monday.com signs a BAA only for the enterprise tier. An account admin accepts it in the product, or the customer countersigns the online BAA through DocuSign. Enterprise and Ultimate pricing is by quote. Lower tiers are not covered by the BAA, so a clinic on Pro that keeps patient names, appointment notes or referral details in boards is storing PHI without a BAA.
See all vendor HIPAA checks for how other tools compare.
Which plans include a BAA
A Business Associate Agreement (BAA) is the contract that lets a vendor handle PHI on your behalf. For monday.com it is tied to plan and to a feature setting.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | No | Not applicable | Not applicable |
| Basic | No | Not applicable | Not applicable |
| Standard | No | Not applicable | Not applicable |
| Pro | No | Not applicable | Not applicable |
| Enterprise (work management) | Yes | Admin clicks "I Accept" when enabling the HIPAA compliance feature, or the customer countersigns the online BAA via DocuSign | Not published by the vendor; Enterprise pricing is by quote |
| Ultimate (monday CRM) | Yes | Same as Enterprise | Not published by the vendor; Ultimate pricing is by quote |
What the BAA covers and what it excludes
Covered
- The monday.com platform on the enterprise tier with the HIPAA compliance feature enabled.
- For monday CRM, the Ultimate tier with the same feature enabled.
Excluded
- Third Party Services and marketplace apps.
- All non-enterprise tiers: Free, Basic, Standard and Pro (and, for CRM, tiers below Ultimate).
The BAA page states that third-party providers do not provide PHI services on behalf of monday.com. If a clinic connects a marketplace app that reads board data, that connection is outside monday.com's BAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
"Not published" means the checked sources do not state it, not that the control is absent. A control list does not decide whether PHI may be used. The signed BAA does.
How to use monday.com with PHI
- Confirm you are on Enterprise (work management) or Ultimate (monday CRM). Check the plan name on the account, not just the quote.
- Enable the HIPAA compliance feature before any PHI enters a board, such as intake trackers, referral pipelines or patient follow-up lists.
- Accept the BAA in the product, or countersign it via DocuSign, before the first PHI is entered.
- Keep marketplace apps and third-party integrations away from PHI unless each vendor has signed its own BAA. This includes automation tools; see the Zapier HIPAA status.
- Manage user access: remove departed staff and former contractors promptly, and limit who can open boards that hold patient data.
- Set a written policy on what may go in boards and item updates, and train staff on it. A front-desk team that pastes full patient records into free-text columns needs clear rules.
Compliance depends on the signed BAA, your configuration and your policies, not on the plan alone.
Alternatives with a BAA
These are CRM and work-management tools that also offer a BAA under conditions. Each is conditional, not an unconditional yes.
- GoHighLevel: BAA on any plan with the HIPAA Compliance add-on.
- HubSpot: BAA on Marketing Hub Enterprise.
- Salesforce: HIPAA Covered Services are listed on the Business Associate Addendum Restrictions page; edition eligibility is not stated.
- Zoho CRM: BAA on the Standard plan.
Compare more options in HIPAA-compliant software by category.
Sources
- HIPAA Business Associate Agreement – monday.com Legal Portal — BAA page, checked 2026-10-28. "shall only apply to you if you are using the enterprise tier subscription"
- HIPAA Business Associate Agreement – monday.com Legal Portal — BAA page, checked 2026-10-28. "Third Party Services providers do not provide services concerning PHI on behalf of monday.com"
- monday CRM pricing — Pricing page, checked 2026-10-28. "Ensure compliance with the Health Insurance Portability & Accountability Act (HIPAA)"
- monday.com Trust Center — Trust center, checked 2026-10-28. "HIPAA Business Associate Agreement"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status for other vendors.
FAQ
Is monday.com HIPAA compliant on the Free, Basic, Standard or Pro plan?
No BAA is available on those plans, so they should not hold PHI. A BAA is available on the enterprise tier with the HIPAA compliance feature enabled.
Is monday CRM HIPAA compliant, and on which tier is the BAA available?
A BAA is available for monday CRM on the Ultimate tier with the HIPAA compliance feature enabled. Pricing is by quote.
How do I sign the monday.com BAA?
An admin clicks "I Accept" when enabling the HIPAA compliance feature, or you countersign the online BAA via DocuSign. Do this before PHI enters the account.
Are monday.com marketplace apps and integrations covered by the BAA?
No. Third Party Services and marketplace apps are excluded. Any app that touches PHI needs its own BAA with that vendor.