Conditional A BAA is available through a Salesforce account representative for the HIPAA Covered Services listed on Salesforce's BAA Restrictions page, while on-premises deployments and named Einstein, Tableau and Heroku components are excluded (last verified 2026-10-19). The BAA is tied to named services, not to the Salesforce brand, so the answer for your org depends on which products and features you use.
Short answer
Salesforce offers a BAA on request for Sales Cloud, Service Cloud, Health Cloud, Salesforce Shield, Marketing Cloud Services, Tableau Services, Slack Enterprise Plans and other listed services. Excluded items include customer-premises deployments, Commerce Cloud Einstein, Tableau Bridge, Data Connect and Server, Heroku Common Runtime and Slack GovGrid. The BAA also requires the customer to encrypt all PHI transmitted or stored. The vendor does not state which editions are eligible, so confirm edition eligibility in writing with your account representative before you load PHI.
Which plans include a BAA
The vendor describes coverage by service, not by plan tier.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| HIPAA Covered Services listed on the BAA Restrictions page | Available | Contact your Salesforce account representative | Not published by the vendor |
| Slack GovGrid plans | Excluded | Not applicable | Not applicable |
| Any portion deployed on customer premises | Excluded | Not applicable | Not applicable |
The standardized BAA is tied to the master subscription agreement. Salesforce and the customer must sign a BAA that names the covered service. A BAA is not automatic and does not come with an account by default.
What the BAA covers and what it excludes
Covered services listed by Salesforce:
- Sales Cloud
- Service Cloud
- Health Cloud
- Salesforce Shield
- Marketing Cloud Services
- Tableau Services
- Slack Enterprise Plans
- Heroku (Shield Private Spaces only)
- Service Cloud Voice (first-party and Hyperforce only)
Excluded:
- Any service deployed on customer premises
- Lightning Platform Discover
- Marketing Cloud Einstein features in Marketing Cloud Next
- Commerce Cloud Einstein
- Tableau Bridge, Data Connect and Server
- Heroku Standard Private Spaces and Common Runtime
- Einstein Bots utterance records (no PHI allowed)
- Slack GovGrid
Applied to the product-specific searches:
- Service Cloud: covered. A practice logging patient inquiries as cases is inside the listed service. Service Cloud Voice is covered only in its first-party and Hyperforce form, and Einstein Bots utterance records must not contain PHI.
- Marketing Cloud: Marketing Cloud Services are covered. The Einstein features in Marketing Cloud Next are excluded, so a campaign that uses them cannot include PHI.
- Health Cloud: covered.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Shield is not included at no cost. Because the BAA requires the customer to encrypt PHI, budget for it or document an equivalent method.
How to use Salesforce with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the software alone. Use this shared-responsibility checklist before any PHI enters the org. More step-by-step material is in the HIPAA guides.
- Sign the BAA naming the exact covered service before you load PHI.
- Check each cloud and feature in use against the exclusion list, including Einstein features, Tableau Bridge, Data Connect and Server, and Heroku runtimes.
- Encrypt all PHI transmitted or stored, as the BAA requires.
- Configure access and audit settings so that only the staff who need PHI can reach it.
- Keep PHI out of excluded features, such as Einstein Bots utterances.
- Review third-party add-ons and connected apps separately. The BAA covers Salesforce's listed services, not other vendors.
- Train staff on which fields and channels may hold PHI.
Alternatives with a BAA
Verdicts are conditional and depend on plan.
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| GoHighLevel | Conditional | Any plan with HIPAA Compliance add-on |
| HubSpot | Conditional | Marketing Hub Enterprise |
| monday.com | Conditional | Enterprise (work management) |
| Zoho CRM | Conditional | Standard |
For other tools, see HIPAA-compliant software by category.
Sources
- HIPAA – Salesforce Compliance Site — Trust center, checked 2026-10-19. "Customers who want to build healthcare applications on Salesforce that comply with US HIPAA can contact your account representative regarding a Business Associate Addendum (BAA)."
- Business Associate Addendum Restrictions — BAA page, checked 2026-10-19. "Customer and Salesforce must sign a BAA that includes the HIPAA Covered Service"
- Business Associate Addendum Restrictions — BAA page, checked 2026-10-19. "the HIPAA Covered Services do not include any portion of such Services that are deployed on Customer's premises."
- Business Associate Addendum Restrictions — BAA page, checked 2026-10-19. "Customer must encrypt all PHI: (1) transmitted using the HIPAA Covered Services"
- Salesforce HIPAA FAQs (PDF, updated November 2019) — Vendor page, checked 2026-10-19. "Do we enter into BAAs with our customers? Yes. For customers that: (1) are subject to HIPAA as covered entities or business associates; and (2) submit protected health information to the HIPAA Covered Services as Customer Data, we have developed our standardized BAA that satisfies the HIPAA requirements and is tied to the particular services we offer"
- Salesforce Shield | Salesforce — Vendor page, checked 2026-10-19. "Platform Encryption (AES-256 field- and file-level encryption at rest with customer-managed keys)"
- Salesforce Shield | Salesforce — Vendor page, checked 2026-10-19. "Salesforce Shield is a paid add-on bundle"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Does Salesforce sign a BAA, and how do I get one?
Yes, for listed HIPAA Covered Services. Contact your Salesforce account representative. The standardized BAA is tied to your master subscription agreement, and Salesforce and the customer must sign a BAA that names the covered service. The vendor does not publish the BAA price.
Are Service Cloud, Marketing Cloud and Health Cloud covered by the BAA?
Service Cloud, Health Cloud and Marketing Cloud Services are on the covered list. The Einstein features in Marketing Cloud Next are excluded, and Service Cloud Voice is covered only in its first-party and Hyperforce form.
Which Salesforce features and deployments are excluded from the BAA?
Excluded are:
- Any portion deployed on customer premises
- Lightning Platform Discover
- Marketing Cloud Einstein features in Marketing Cloud Next
- Commerce Cloud Einstein
- Tableau Bridge, Data Connect and Server
- Heroku Standard Private Spaces and Common Runtime
- Einstein Bots utterance records (no PHI allowed)
- Slack GovGrid
Does signing a BAA make my Salesforce org HIPAA compliant?
No. The BAA covers only the named services. You remain responsible for encrypting all PHI transmitted or stored, configuring access and audit settings, keeping PHI out of excluded features and managing third-party add-ons. Slack Enterprise Plans are covered, but Slack GovGrid is not.