Which CRMs Are HIPAA Compliant? HubSpot and AlternativesWhat HubSpot, Salesforce and Zoho CRM say about a BAA, and the settings a practice must turn on.

HubSpot, Salesforce and Zoho CRM each offer a Business Associate Agreement (BAA), but each one attaches conditions that a practice must meet first. A CRM fits HIPAA only if the vendor signs a BAA and the practice turns on the right settings. We read each vendor's own pages on October 9, 2026. We could not confirm Pipedrive.

HIPAA compliant CRMs at a glance

• HubSpot: supports patient data on Enterprise editions. The BAA is "included by reference in the Sensitive Data Terms."
• Salesforce: offers a BAA on request through the account representative.
• Zoho CRM: sends its BAA template on request by email. An admin must enable the HIPAA settings.
• Pipedrive: we found no HIPAA or BAA statement on the pages we could read. We give no verdict.
• Ahrefs shows 700 US searches a month for "hipaa compliant crm" (checked October 9, 2026).

What makes a CRM HIPAA compliant?

Two things: a signed BAA and the right configuration. A CRM vendor that stores patient information for a practice is a business associate. HHS lists this example: a "Cloud service provider engaged to create, receive, maintain, or transmit electronic PHI." HHS says a practice may disclose PHI to a business associate once it obtains "satisfactory assurances, in the form of a contract or other written arrangement." HHS last reviewed that page on July 30, 2026.

No software is compliant by itself. The practice still controls who has access, which fields hold patient data, and which other tools connect to the CRM.

Is HubSpot HIPAA compliant?

Only if you hold an Enterprise edition and turn on Sensitive Data settings. HubSpot's help page lists the feature under Enterprise editions of its hubs. HubSpot's product page says the BAA is "included by reference in the Sensitive Data Terms" for customers "storing protected health information in their account."

A Super Admin does the setup. HubSpot's instructions say: "Toggle the Sensitive Data Protection switch on." The admin then selects the health data and HIPAA checkboxes and accepts the terms. Each property that holds patient data gets the label "Yes, this data contains Protected Health Information (PHI)."

Some tools stop working with those properties. HubSpot states: "Sensitive Data properties are unavailable in certain tools, including personalization tokens, sandboxes." The same page names chatbots and playbooks.

HubSpot's product page describes the feature as "the foundation to operate in compliance with regulations like GDPR and HIPAA." Read the word foundation with care. The setting protects the fields you label. It does not review your forms, your workflows or your staff's notes. Free-text fields are the usual gap, because staff can type patient details into any of them.

What CRM is HIPAA compliant?

The table shows what four vendors publish. Zoho, for example, lets an admin mark up to 25 PHI fields per module.

Is Salesforce healthcare CRM HIPAA compliant?

Only if you sign Salesforce's BAA and stay inside its covered services. Salesforce's compliance page says customers "can contact your account representative regarding a Business Associate Addendum (BAA)." The page points to a separate list of "BAA Restrictions and HIPAA Covered Services." We could not read that list today. Ask your representative for it before you buy.

Is Zoho CRM HIPAA compliant?

Only if you obtain Zoho's BAA and enable its HIPAA settings. Zoho states: "As a Business Associate, Zoho CRM ensures its customers have the ability to comply with HIPAA." Its FAQ says a customer can request the BAA template at legal@zohocorp.com. The pages we read do not say which editions qualify.

Setup has limits. An admin can select up to 10 modules and mark up to 25 PHI fields in each. Zoho keeps audit logs for 60 days by default. Zoho says it is "your responsibility and best practice to export logs periodically."

How do you set up a CRM for patient data?

Work through five steps. Connected tools need the same care as the CRM. HubSpot notes that HIPAA data is not supported in its Snowflake data share integration.

1. 1

   Decide what belongs in the CRM

   List the patient details you need for follow-up. Leave clinical notes in the health record system.

2. 2

   Get the BAA first

   Sign or accept the vendor's BAA before any patient data enters the CRM. Save a copy.

3. 3

   Turn on the HIPAA settings

   Enable the vendor's sensitive data or HIPAA mode. Label each field that holds patient information.

4. 4

   Limit access and integrations

   Give each user the least access needed. Check that every connected tool has its own BAA.

5. 5

   Check what the website sends

   Review each form, chat widget and tracker that feeds the CRM. Remove health questions from forms that lack a BAA.

How Webpatch helps

Most patient data reaches a CRM through the website. Webpatch builds and manages websites for healthcare practices. We map each form, chat widget and tracking script to the vendor that receives its data. We check whether a BAA covers that vendor. We run The Webpatch Tracker Check to find scripts that send visitor data to ad platforms. Two related guides go deeper: Which Online Forms Are HIPAA Compliant? and Is Your Website's Tracking HIPAA-Compliant?

We are not a law firm. We work alongside your compliance adviser. Contact Webpatch to review how your website feeds your CRM.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.