Is Salesforce HIPAA compliant?
Yes, if you sign Salesforce's business associate addendum through your account representative and it names the specific Salesforce service you are putting patient information into.
Applies to Salesforce (Health Cloud, Sales Cloud, Service Cloud). Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Sign an addendum that names the service you use. Salesforce requires the agreement to include the specific covered service, and that you comply with its restrictions article.
- Check your service is on the covered list. Health Cloud, Sales Cloud, Service Cloud, Experience Cloud, Marketing Cloud Engagement, Lightning Platform, Salesforce Shield, the mobile app and Tableau Cloud are named on the list last updated 18 March 2026.
- Request it through your account representative: there is no self-serve acceptance screen.
- Encrypt patient information yourself. Salesforce makes the customer responsible for encrypting information transmitted through the services and, where within your control, stored in them.
- Where you control it, enable and maintain data masking in the Einstein Trust Layer configuration.
- Treat anything deployed on your own premises as outside the agreement.
Does Salesforce sign a business associate agreement?
Yes. Salesforce offers one. No edition is named. Coverage is granted service by service: the signed addendum must include the specific covered service you use. Contact your Salesforce account representative and ask for the HIPAA Business Associate Addendum, naming every cloud and service you intend to put patient information into.
What this means in practice
Salesforce grants coverage service by service rather than edition by edition. The covered list is long (Health Cloud, Sales Cloud, Service Cloud, Experience Cloud and Marketing Cloud Engagement are all on it) but nothing is protected until you and Salesforce have signed an addendum naming the specific service you are using.
Two obligations catch practices out. You must encrypt patient information you transmit to Salesforce and, where you control it, what you store there; Salesforce puts that squarely on the customer. And the AI layer is fenced off: Agentforce and Einstein may not be used to diagnose, treat or infer anyone's condition, eligibility or outcome, and Einstein Bots must never see patient information in utterance records.
Because the request runs through an account executive rather than a settings page, allow weeks rather than minutes, and get the executed copy in hand before your first patient record is loaded.
How organizations get this wrong
- Assuming a Salesforce subscription automatically includes the addendum. Nothing is covered until a signed agreement names the specific cloud you use.
- Turning on Agentforce or Einstein to triage patients: Salesforce forbids using them to infer or interpret a health condition or eligibility.
- Connecting Slack through Salesforce and assuming it is covered. Slack counts only once Slack itself confirms the plan is HIPAA-enabled.
- Relying on the platform to encrypt everything. The restrictions article makes encrypting transmitted patient information the customer's own responsibility.
What the agreement does not cover
- Any Salesforce service not named on the covered services list.
- Any portion of a covered service deployed on the customer's own premises.
- Using Einstein or Agentforce as a substitute for medical advice or diagnosis, as a medical device, or to infer or interpret an individual's health condition, status, eligibility or outcome.
- Einstein Bots utterance records, and the answer automation and input recommender features.
- Slack under the Salesforce agreement until Slack itself confirms the plan is HIPAA-enabled.
Keep a record of your Salesforce agreement
Sources
- Business Associate Addendum Restrictions: Salesforce. Published March 18, 2026. Read July 29, 2026.
- HIPAA: Salesforce Compliance: Salesforce. Read July 29, 2026.
Salesforce can change these terms at any time. If something here no longer matches what Salesforce tells you, tell us.