Salesforce will sign a HIPAA Business Associate Addendum (BAA) for a defined list of its services, but the BAA does not make your org compliant on its own. The agreement covers specific products and comes with conditions, such as encrypting health information. Everything else, including who can see what, how data is configured and which third-party tools touch it, remains your responsibility.
This guide is for healthcare nonprofits and community health organizations. It explains what a BAA is, what Salesforce's published list covers, and what your team still has to do. It is general information, not legal advice. Have your compliance officer or counsel review your own agreement. Sources below were checked in November 2026, and Salesforce updates its list often.
What a BAA is
HIPAA is the US federal law that protects health information. When a healthcare provider, health plan or similar "covered entity" uses a vendor that handles protected health information (PHI) for it, that vendor is a business associate. The Department of Health and Human Services (HHS) says a covered entity must get satisfactory assurances in writing, usually in a contract, that the business associate will safeguard the PHI (HHS, checked November 2026). That contract is the business associate agreement, or BAA.
HHS says the agreement must set out permitted uses of PHI, require safeguards, require reporting of incidents and breaches, and extend the same duties to subcontractors, among other terms.
HHS also states that a cloud provider that stores or processes electronic PHI for a covered entity is a business associate and needs a BAA. That holds even if the provider only stores encrypted data and has no key (HHS cloud computing guidance, checked November 2026).
Not every nonprofit is a covered entity. A community organization that serves clients but is not a provider, plan or business associate of one may not be subject to HIPAA directly. Many are, though, because they bill health plans or receive data from hospitals and plans. Ask your counsel which applies to you.
What Salesforce offers
Salesforce publishes a page, Business Associate Addendum Restrictions (last updated September 30, 2026 when we checked), listing the services that can be used with PHI under its BAA and the conditions that apply. Its compliance site, compliance.salesforce.com, directs customers to that list and says to contact your account representative about the addendum.
Coverage applies only when your signed BAA includes the service and you follow the conditions. If the BAA and the web page conflict, the BAA controls.
What the list covers
The list is long and changes over time, so read the live page rather than a summary like ours. As of the version we checked in November 2026, covered services included:
- Sales Cloud and Service Cloud
- Health Cloud
- Nonprofit Cloud Services
- Experience Cloud
- Lightning Platform
- Salesforce Shield
- Salesforce Data 360
- MuleSoft
- Tableau Cloud
- Slack Enterprise plans
Salesforce's change log, dated July 31, 2026, notes additions such as Nonprofit Cloud and Salesforce Contracts (Salesforce change log, checked November 2026). The product Salesforce now calls Agentforce Nonprofit (formerly Nonprofit Cloud) appears on the page under the earlier name, so check how your edition is listed and confirm with Salesforce.
Some items are explicitly outside the BAA, including certain Einstein and Marketing Cloud features, Tableau Server and Bridge, and Heroku Common Runtime. If a tool is not on the covered list, do not put PHI in it until Salesforce confirms in writing.
Conditions that come with the BAA
The restrictions page puts several duties on you. Based on the version we checked:
- Encrypt PHI. Customers must encrypt PHI sent through covered services and, where they control storage, PHI stored in them, following HHS guidance.
- Follow acceptable use policies. This includes Salesforce's AI acceptable use policy where AI features apply.
- Use data masking for AI features where it is within your control.
- No clinical use of certain AI services. Several AI and analytics services are not for medical advice, diagnosis, treatment or inferring health conditions.
- Own the third parties. You are responsible for the HIPAA compliance of third-party telephony, language model providers, e-signature tools and outside data sources you connect.
- Service-specific rules. Slack, Heroku, MuleSoft and others each have their own requirements.
These conditions are why "Salesforce is HIPAA compliant" is the wrong way to say it. The accurate version is that Salesforce offers a BAA for listed services, subject to conditions, and your compliance depends on your configuration and your agreement.
What is still your job
HHS is clear that signing a BAA is only the entry requirement. Customers must still conduct their own risk analysis and manage risk, and HHS recommends that provider and customer confirm in writing how each will meet Security Rule requirements (HHS cloud computing guidance). For a Salesforce org, that usually means the following.
Control who can see PHI
HIPAA's minimum necessary standard means people should see only what their job needs. In Salesforce that is your sharing model, profiles, permission sets and field-level security. Powerful permissions such as View All Data skip sharing rules entirely. We explain the permissions that matter in who can see your clients' health data in Salesforce, and how to build access in layers in permission sets vs profiles.
Encrypt and protect sensitive fields
The BAA requires encryption of PHI where you control storage. Salesforce offers Shield Platform Encryption for this purpose, and it is on the covered list, but it is an add-on with its own tradeoffs. Our plain-language take is in is Salesforce Shield worth it.
Audit access and offboard quickly
Review who has access at least quarterly. Deactivate users the day they leave. Log who exports data.
Manage integrations and vendors
Every connected app, integration and consultant with access to PHI needs scrutiny. Consultants who touch production data may need their own downstream business associate agreements with you. Standards such as HL7 and FHIR are common ways to exchange health data, and each connection should be reviewed for what it exposes. See HL7 vs FHIR.
Protect your sandboxes
Sandboxes can contain copies of real records. Mask or remove PHI before developers or testers use them.
Train your people and document your decisions
A policy nobody follows protects no one. Document your risk analysis, your configuration choices and your training.
Which Salesforce products are used for PHI
Healthcare nonprofits often use Health Cloud for care coordination, or Agentforce Nonprofit or a custom setup on the Lightning Platform for program and case management. Which product is right depends on your workflows, not on the BAA. Both Health Cloud and the platform itself appear on Salesforce's list. For one example of how community health teams use Health Cloud, see Health Cloud for community health.
A short checklist before you load PHI
- Confirm your signed BAA exists and lists every Salesforce service you plan to use.
- Read the current restrictions page and note the conditions that apply.
- Decide what PHI you truly need in Salesforce.
- Set up encryption, sharing and field-level security.
- Review integrations, AI features and third-party tools.
- Document your risk analysis and train your users.
Frequently asked questions
Does Salesforce sign a HIPAA BAA?
Yes, for a defined list of services. You request the addendum through your Salesforce account representative, and coverage applies only to services your signed BAA includes.
Is Salesforce HIPAA compliant?
That is not a simple yes or no. Salesforce offers a BAA for listed services under stated conditions. Whether your use is compliant depends on how you configure the org and what your agreement says.
Does the BAA cover every Salesforce product?
No. Some products and features are excluded, and the list changes over time. Check the current restrictions page and confirm with Salesforce.
Do we need Shield to use Salesforce with PHI?
The BAA requires encryption of PHI where you control storage, but it does not name one tool as the only option. Discuss your encryption approach with Salesforce and your compliance advisor.
Can we use AI features with PHI?
Only those covered by your BAA, and with the conditions Salesforce lists, such as data masking and no clinical use for certain services. Review the restrictions page before enabling any AI feature.
Is this legal advice?
No. It is general information. Your counsel or compliance officer should review your BAA and your configuration.
Want a second set of eyes on your setup?
We can review how PHI is stored, shared and exported in your Salesforce org and tell you what to fix first. Book a free Salesforce health check.