Is HubSpot HIPAA compliant? Which CRMs sign a BAA? We checked 18 vendors.

The short answer

No software is "HIPAA compliant" on its own

HIPAA doesn't certify software. A covered entity, such as a clinic that bills insurance electronically, must have a signed BAA with any vendor that creates, receives, stores or transmits protected health information (PHI) for it. So the useful question isn't "is this tool HIPAA compliant?" It's "will this vendor sign a BAA, on which plan, and what does that plan cost?"

That is what the table answers. We read each vendor's own pricing page, help center or legal terms on 20 October 2026. Where a vendor's site didn't confirm the answer, we say "Not confirmed" and link what we found. Vendor terms change often, so check the linked page before you sign anything.

Vendor by vendor

Is HubSpot HIPAA compliant?

HubSpot will sign a BAA, but its knowledge base lists only Enterprise subscriptions for storing sensitive data. A Super Admin turns on health data storage, ticks "We are a HIPAA-covered entity or business associate," and accepts the BAA. For a five-person support team on Service Hub Enterprise, that is at least $750 a month in seats plus the $3,500 onboarding fee, before any other hub. HubSpot is a strong platform, and if you already run on Enterprise, the BAA is there for you.

Is Salesforce HIPAA compliant?

Salesforce signs a Business Associate Addendum for a long list of "HIPAA Covered Services," including Sales Cloud, Service Cloud and Health Cloud. Coverage applies only to services named in the BAA you sign. Starter Suite isn't on the list we read. Salesforce doesn't publish what the BAA requires in edition or price, so ask your account executive before you put PHI in.

Is Zendesk HIPAA compliant?

Zendesk signs a BAA through its Advanced Compliance add-on, on Suite Professional and above. Its pricing page marks Suite Professional ($115 per agent per month, annual) as "HIPAA enabled," and the help center says the add-on can be bought separately or come with your plan. The BAA doesn't cover Marketplace apps, third-party services or early-access features. Our Zendesk alternative page compares the two help desks side by side.

Is Freshdesk HIPAA compliant?

Freshworks says it "may" sign a BAA covering Freshdesk, Freshchat, Freshcaller and Freshdesk Omnichannel. The BAA depends on you keeping its mandatory configuration in place, including IP whitelisting and SSO. Freshworks' own pages don't name the required plan. Third-party guides say Enterprise ($89 per agent per month, annual), so confirm it in writing. More in our Freshdesk alternative guide.

Is GoHighLevel HIPAA compliant?

HighLevel sells HIPAA as a $297-a-month add-on on any agency plan. It is included on Enterprise. Once switched on, it can't be cancelled, refunded or downgraded, and agency owners then enable it per sub-account. For an agency on the $97 Starter plan, that takes the bill to $394 a month. See our GoHighLevel alternative page if that is your situation.

Is monday CRM HIPAA compliant?

monday.com isn't one of the 18 rows, but buyers ask, so we checked. Its published BAA says it applies "only" to customers "using the enterprise tier subscription" with the HIPAA compliance feature turned on (monday.com BAA, last updated February 2022). Enterprise pricing is through sales.

Zoho, Help Scout, Keap and the rest

• Zoho: request the BAA by email. Neither help page we read ties it to an edition, so ask before you buy.
• Help Scout: Pro only, with a 10-user minimum, plus a separate addendum to use AI features with PHI.
• Keap: a BAA after you enable HIPAA Security Controls, but Keap's own memo says email, SMS and VoIP aren't covered.
• HoneyBook and Dubsado: both say they aren't HIPAA compliant. Fine for non-health work, not for PHI.
• Pipedrive: no vendor statement found. Treat it as a non-PHI CRM unless Pipedrive signs a BAA with you.

Scheduling and practice tools: SimplePractice, Jane, Vagaro, Mindbody, Boulevard, Zenoti

Vertical tools are friendlier. SimplePractice includes the BAA from sign-up. Jane signs on request. Vagaro and Zenoti offer a BAA to med spa clients. Boulevard is the exception: its BAA applies only with the "HIPAA Coverage" add-on, whose price isn't published. Mindbody's pricing page says nothing about HIPAA; third parties say it signs on request. Our HIPAA scheduling software guide goes deeper on that group.

Before you sign

HIPAA BAA requirements: what to check in any vendor's BAA

A signed BAA is the start, not the finish. HHS settled with Raleigh Orthopaedic Clinic for $750,000 in 2016 and with the Center for Children's Digestive Health for $31,000 in 2017 over missing BAAs (HIPAA Journal, HHS). Use this checklist with every vendor:

1. Which products does it cover? Zendesk excludes Marketplace apps. Freshworks covers four named products. Keap excludes email, SMS and VoIP.
2. Which plan is required, and in writing? If the answer is "Enterprise," price the whole team on Enterprise.
3. Is there an add-on, and can you remove it? GoHighLevel's can't be cancelled. Boulevard's BAA ends if you drop the add-on.
4. Are AI features covered? Help Scout needs a separate addendum.
5. What settings must you keep on? Freshworks makes the BAA depend on mandatory configuration.
6. Where is data hosted, and is it encrypted in transit and at rest?
7. Your side: access controls, staff training and your own risk analysis. No BAA covers those for you.

Do you even need a BAA?

Under HIPAA, a health care provider is a covered entity if it sends health information electronically in a standard transaction, such as an insurance claim or eligibility check (HHS). A cash-only provider who never does may fall outside HIPAA (ASHA). State laws still apply, such as Washington's My Health My Data Act, and the FTC's Health Breach Notification Rule can reach health apps. If you aren't sure, ask your compliance advisor. If you're a business associate serving a covered entity, such as an agency with a clinic client, you need BAAs too.

Where JBMOnboard360 fits

JBMOnboard360 is a CRM with scheduling, intake forms, invoicing and a help desk. It is HIPAA-ready: a BAA is included on every plan, US customers are hosted on AWS in the United States (with an AWS BAA in place), data is encrypted in transit and at rest, and daily backups are copied to a second US region. You still own your policies, training and risk analysis. Read more on our HIPAA-ready CRM page.

It is not an EHR. It doesn't do clinical charting or insurance billing, it doesn't process US card payments, and it doesn't send SMS. Its AI concierge answers general WhatsApp enquiries, like prices, hours and callback requests. Health information should never go over WhatsApp.