No No BAA is available on any Pipedrive plan, and Pipedrive's Terms of Service bar all CRM features from holding health data. Last verified 2026-10-28.
Short answer
Pipedrive's Terms of Service say the services are not designed to comply with HIPAA. In them, the client agrees not to store Sensitive Information, which includes health data. No plan comes with a Business Associate Agreement (BAA) (see the HIPAA glossary: BAA and PHI for both terms).
In practice, do not enter PHI into Pipedrive on any plan. That covers patient names tied to a condition, referral notes with diagnoses, and appointment details linked to a treatment. For other tools, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Essential | Not available | None offered | Not applicable |
| Advanced | Not available | None offered | Not applicable |
| Professional | Not available | None offered | Not applicable |
| Power | Not available | None offered | Not applicable |
| Enterprise | Not available | None offered | Not applicable |
No add-on or higher tier is listed with a BAA in the sources below.
What the BAA covers and what it excludes
Covered services: none. No BAA exists, so no Pipedrive service is covered.
Excluded features: all CRM features. The Terms of Service prohibit storing Sensitive Information, which includes health and genetic data. That prohibition applies to deals, contacts, notes, activities, synced email, files and custom fields alike. A clinic cannot treat any one module as a safe place for patient information.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | US, EU (AWS Frankfurt, Dublin, US East, US West) |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Security controls do not substitute for a BAA. Without a BAA, encrypted transport does not make Pipedrive an approved place for PHI.
How to use Pipedrive with PHI
Pipedrive offers no BAA, and the Terms prohibit health data. The only compliant approach is to keep PHI out. A checklist for a clinic or a digital-health team:
- Keep PHI out of every field, note, email sync, file attachment and custom field.
- Limit records to non-health business data, such as a referring practice's name, a vendor contact or a sales stage, with no patient identifiers or conditions.
- Train staff on what counts as health data, for example a note reading "Mrs. Lopez, post-op knee follow-up."
- Review integrations and imports for PHI leakage. An automation that pushes form submissions into Pipedrive moves data outside it, so check the source first (see Is Zapier HIPAA compliant?).
- Offboard or purge any PHI already entered, including email-sync history and attachments.
- Document the decision in the vendor inventory: no BAA, PHI prohibited, owner named.
Compliance depends on a signed BAA, configuration and policies, and Pipedrive offers no BAA. More step-by-step material is in HIPAA guides.
Alternatives with a BAA
These CRMs have BAA terms of their own. "Conditional" means plan, add-on and service limits apply, so read each vendor's check page before putting PHI in.
- GoHighLevel: conditional; BAA with the HIPAA Compliance add-on on any plan.
- HubSpot: conditional; Marketing Hub Enterprise. See Is HubSpot HIPAA compliant?
- monday.com: conditional; Enterprise work management.
- Salesforce: conditional; HIPAA Covered Services on its BAA Restrictions page. Edition eligibility is not stated.
- Zoho CRM: conditional; Standard.
The full comparison is in HIPAA-compliant software by category, under CRM.
Sources
- Pipedrive Terms of Service — Terms, checked 2026-10-28. "Pipedrive Services are not designed to comply with industry-specific regulations such as the Health Insurance Portability and Accountability Act (HIPAA) or the Federal Information Security Management Act (FISMA)."
- Pipedrive Terms of Service — Terms, checked 2026-10-28. "CLIENT AGREES NOT TO USE THE PIPEDRIVE SERVICES TO COLLECT, STORE, MANAGE OR PROCESS SENSITIVE INFORMATION."
- How secure is my data in Pipedrive? — Help article, checked 2026-10-28. "The Pipedrive application employs only secure HTTPS connections, where all information is encrypted."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Is Pipedrive HIPAA compliant?
No BAA is available on any Pipedrive plan. The Terms of Service say the services are not designed to comply with HIPAA. This page reports what the Terms say. It is not a legal finding.
Does Pipedrive sign a BAA on any plan?
No. Essential, Advanced, Professional, Power and Enterprise all list no BAA, and no add-on is listed with one.
Can I store patient or health information in Pipedrive?
No. The Terms prohibit storing Sensitive Information, which includes health data. That applies to every CRM feature, including notes, custom fields and synced email.
Does Pipedrive encrypt data, and does that make it safe for PHI?
The help article describes HTTPS for data in transit. Encryption at rest is not published by the vendor. Encryption does not replace a BAA, so it does not make Pipedrive safe for PHI.
Which CRMs offer a BAA instead of Pipedrive?
GoHighLevel, HubSpot, monday.com, Salesforce and Zoho CRM have BAA terms limited by plan, add-on or service. See the alternatives above and HIPAA-compliant software by category.