BAA guide
Is Salesforce HIPAA compliant?
Plan by plan, from Salesforce's own pages.
Only on a plan where the vendor signs a BAA. Salesforce is not HIPAA compliant on its own. Sales Cloud: Salesforce lists Sales Cloud as a HIPAA Covered Service. The customer and Salesforce must sign a BAA that includes it, and the customer must follow the BAA restrictions. Service Cloud: Salesforce lists Service Cloud as a HIPAA Covered Service. The customer and Salesforce must sign a BAA that includes it, and the customer must follow the BAA restrictions. Health Cloud: Salesforce lists Health Cloud as a HIPAA Covered Service. The customer and Salesforce must sign a BAA that includes it, and the customer must follow the BAA restrictions.
Checked against Salesforce's own pages, linked in the table.
Which Salesforce plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| Sales Cloud | BAA only if the condition is met | Salesforce lists Sales Cloud as a HIPAA Covered Service. The customer and Salesforce must sign a BAA that includes it, and the customer must follow the BAA restrictions. | For Customer's use of a HIPAA Covered Service to be covered by the BAA: (1) Customer and Salesforce must sign a BAA that includes the HIPAA Covered Service; and (2) Customer must comply with the terms of the BAA and this article, to the extent applicable.salesforce.com |
| Service Cloud | BAA only if the condition is met | Salesforce lists Service Cloud as a HIPAA Covered Service. The customer and Salesforce must sign a BAA that includes it, and the customer must follow the BAA restrictions. | For Customer's use of a HIPAA Covered Service to be covered by the BAA: (1) Customer and Salesforce must sign a BAA that includes the HIPAA Covered Service; and (2) Customer must comply with the terms of the BAA and this article, to the extent applicable.salesforce.com |
| Health Cloud | BAA only if the condition is met | Salesforce lists Health Cloud as a HIPAA Covered Service. The customer and Salesforce must sign a BAA that includes it, and the customer must follow the BAA restrictions. | For Customer's use of a HIPAA Covered Service to be covered by the BAA: (1) Customer and Salesforce must sign a BAA that includes the HIPAA Covered Service; and (2) Customer must comply with the terms of the BAA and this article, to the extent applicable.salesforce.com |
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Does Salesforce sign a BAA?
Yes. Salesforce offers a HIPAA Business Associate Addendum for its HIPAA Covered Services. Its compliance site says customers can contact their account representative about a BAA.
Which Salesforce products does the BAA cover?
Only the HIPAA Covered Services Salesforce lists, such as Sales Cloud, Service Cloud, and Health Cloud. Salesforce says the BAA must include the specific covered service you use.
Are there Salesforce features the BAA does not cover?
Yes. Salesforce says the Discover feature in Lightning Platform and the Marketing Cloud Einstein features in Marketing Cloud Next are not covered by the BAA. It also requires Data Masking in the Einstein Trust Layer for Agentforce and Prompt Builder, to the extent within the customer's control. Rivvi is an AI workspace for healthcare teams. Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA.
Related
- Is HubSpot HIPAA compliant?
- Is Zoom HIPAA compliant?
- Is Google Drive HIPAA compliant?
- Is Gmail HIPAA compliant?
- Is Microsoft Teams HIPAA compliant?
- Is Microsoft 365 HIPAA compliant?
- BAA directory: every tool Rivvi checked
- What makes a chatbot HIPAA compliant
- HIPAA compliant AI: which tools sign a BAA
- Check another AI tool against its BAA terms
Source: Salesforce's own pages, linked in the table. Checked . Last updated . How Rivvi sources data. Spot an error? hello@rivvi.ai.
Free to start. Most teams are using it the same day.
Get started for free