HIPAA-compliant crm: vendors with a BAA compared

Of the six CRM vendors listed here, five sign a BAA only on specific plans, add-ons or covered services, and one, Pipedrive, does not. None signs on every plan. The table below gives the plan, how to obtain the BAA, the cost, and the controls the vendors publish. HIPAA Compliant Wiki is published by Chanty, Inc.; Chanty is a team chat tool, not a CRM, and is not part of this table.

HIPAA-compliant crm: vendors with a BAA compared (summary)

The pattern across the category is that BAA availability depends on edition, add-on or named covered services. A vendor's BAA may apply to one product line (HubSpot's Marketing Hub, monday.com's work management product) and not to others. Entry-level and free tiers are usually outside it. The wording on this page is therefore "BAA available on plan X for services Y", never a blanket statement about a vendor.

• Conditional: the vendor signs a BAA, but only on specific plans, add-ons or covered services.
• No: the vendor does not sign a BAA.

The full list of categories is at HIPAA-compliant software by category.

Quick answer: which CRM platforms sign a BAA, and from which plan

One line per vendor. Order is not a ranking. Each vendor name links to its own check; all vendor HIPAA checks are in the directory.

• GoHighLevel: conditional. BAA available on any plan with the HIPAA Compliance add-on.
• HubSpot: conditional. BAA available on Marketing Hub Enterprise.
• Zoho CRM: conditional. BAA available from the Standard plan.
• monday.com: conditional. BAA available on Enterprise, for the work management product.
• Salesforce: conditional. BAA covers the HIPAA Covered Services named in it; edition eligibility is not stated.
• Pipedrive: no. No BAA plan or route is listed.

Comparison table

Vendor	Verdict	BAA from plan	How to obtain	Pricing from	Encryption at rest	Audit log	SSO	SOC 2	Last verified
GoHighLevel	Conditional	Any plan with HIPAA Compliance add-on	Self-serve: purchase add-on, sign BAA in Settings > Compliance (Agency view); HIPAA activates automatically, each sub-account enabled manually	$97/month Starter plan + $297/month HIPAA add-on ($2,970/year)	Yes	Yes	Not published by the vendor	Not published by the vendor	2026-10-28
HubSpot	Conditional	Marketing Hub Enterprise	A Super Admin turns on Sensitive Data Protection in Settings > Security > Sensitive Data, selects Health/Medical Data and the 'We are a HIPAA-covered entity or business associate' checkbox, then accepts the Sensitive Data Terms and the Business Associate Agreement in the same flow (a PDF copy is available for Enterprise customers).	$150/seat/month (Sales Hub Enterprise or Service Hub Enterprise; plus one-time $3,500 Enterprise onboarding)	Yes	Yes	Yes	Yes	2026-10-19
Zoho CRM	Conditional	Standard	Request Zoho's BAA template by email to [email protected]; the signed BAA specifies which Zoho services are covered.	Standard edition (lowest edition listing HIPAA compliance; price shown regionally, e.g. INR 800/user/month on the pricing page fetched)	Yes	Yes	Not published by the vendor	Yes	2026-10-28
monday.com	Conditional	Enterprise (work management)	Admin clicks "I Accept" in the platform when enabling the HIPAA compliance feature, or countersigns the online BAA via DocuSign; applies only to enterprise-tier subscriptions with the feature enabled.	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor	Yes	2026-10-28
Salesforce	Conditional	HIPAA Covered Services listed on the Business Associate Addendum Restrictions page (edition eligibility not stated)	Contact your Salesforce account representative; customer and Salesforce sign a BAA that names the HIPAA Covered Services. Salesforce's standardized BAA is tied to its master subscription agreement.	Not published by the vendor	Yes	Yes	Not published by the vendor	Not published by the vendor	2026-10-19
Pipedrive	No	—	—	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor	2026-10-28

Reading the table:

• Price is for the tier that carries the BAA, not the entry price. GoHighLevel's BAA depends on the add-on. HubSpot's depends on Marketing Hub Enterprise plus the onboarding fee.
• Zoho's price is regional. The INR figure is the listed price; a USD price is not given.
• "Not published by the vendor" means the control is not listed in the vendor's entry. It does not mean the control is absent from the product. Ask the vendor in writing before you rely on it.

Vendors that do not sign a BAA

Pipedrive: verdict no. The vendor entry gives no BAA plan and no route to obtain one.. Until a BAA exists for the product, patient names, appointment notes, referral details and insurance information should not go into it, on any plan.

The same applies to anything not named in a vendor's BAA. Unlisted editions and free tiers of any vendor are not covered unless the vendor's BAA says so. If a clinic is trialing a CRM on a free tier with "test" patient records, those records are PHI; see free plans and BAAs.

What counts as HIPAA-compliant CRM platforms

A CRM becomes a PHI system the moment a patient record, note or appointment lands in it. A new-patient inquiry form that writes a diagnosis or a referral reason into a contact record is enough. From that point the vendor is a business associate, and a signed BAA is required. What a business associate agreement is covers the legal basics.

In practice:

• The BAA must name the CRM product and the edition you buy. It is usually a higher tier or a paid add-on, as the table shows.
• Typical exclusions to check: lower editions, AI features, marketplace apps and free tiers. Email sending is often excluded or handled in a separate product.
• A signed BAA does not make an organization compliant. The customer configures roles and access, trains staff, manages offboarding and signs the BAA before any PHI is loaded.

CDPs and membership management: same test, narrower lists

Customer data platforms and membership or onboarding tools get the same four checks:

1. Is there a BAA?
2. Does it name the product?
3. On which plan?
4. Which features are excluded?

This page lists only the six CRM vendors above. No CDP or membership-management vendor is rated here, and none should be inferred from this table. A CRM listed here does not make a CDP built on it, or a membership module sold separately, covered by the same BAA.

A dental membership plan or a digital onboarding flow usually collects PHI through a form first. For those needs, see HIPAA-compliant forms. For outreach to existing members or patients, see HIPAA-compliant marketing.

How to choose a CRM that can touch PHI

1. Confirm the BAA names the exact product and edition. Ask in writing whether AI features and marketplace apps are covered. How to read a vendor BAA lists the clauses to check.
2. Compare the total cost of the BAA tier or add-on. Include seats and onboarding fees. A 10-seat practice on HubSpot pays per-seat pricing plus a one-time onboarding fee; on GoHighLevel it pays the add-on on top of the base plan.
3. Check audit logs, encryption at rest and SSO against your role-based access needs. If the vendor entry says "Not published by the vendor", request it in writing before purchase.
4. Ask for the SOC 2 report where the vendor offers one, and check data residency against your policy.
5. Treat email, texting and integrations as separate PHI paths. Each needs its own BAA. For campaigns, see HIPAA-compliant email marketing.
6. Keep a dated record of the BAA. Review it when the vendor's terms change.

Related

• HIPAA-compliant software by category: every category table.
• HIPAA-compliant project management: relevant because monday.com's BAA applies to its work management product.
• Guides: what a business associate agreement is and how to read a vendor BAA (linked above).

FAQ

Which CRMs will sign a BAA, and on which plan?

• GoHighLevel: any plan with the HIPAA Compliance add-on.
• HubSpot: Marketing Hub Enterprise.
• Zoho CRM: Standard.
• monday.com: Enterprise, for work management.
• Salesforce: the HIPAA Covered Services named in the BAA; edition eligibility is not stated.

All five are conditional verdicts. None signs on every plan.

Can I use a CRM's free or lowest plan for patient data?

Not on the basis of this table. In every listed row the BAA applies to a specific plan, add-on or named service. Unlisted editions and free tiers are not covered unless the vendor's BAA says so. Do not enter PHI until the BAA covers the exact plan you use.

Does Pipedrive sign a BAA?

No. The verdict is "no", and the vendor entry gives no BAA plan or route. Pipedrive should not be used for PHI under any plan.

Is a signed BAA enough to use a CRM for PHI?

No. The BAA covers the vendor's obligations for the named product and edition. The organization must still configure roles and access, enable the controls it needs, train staff, sign the BAA before loading PHI, and put separate BAAs in place for email, texting and integrations that touch the same records.