Salesforce offers a Business Associate Addendum through account representatives, and it applies only to listed HIPAA covered services named in the BAA. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Slack GovGrid | Not covered |
| Tableau Server | Not covered |
| Tableau Bridge and Tableau Data Connect | Not covered |
| Interaction Studio (Legacy) | Not covered |
| Sales Cloud and Service Cloud | Covered |
| Health Cloud | Covered |
| Agentforce Contact Center, Agentforce Operations and listed Einstein Services | Covered |
| Marketing Cloud Engagement and Marketing Cloud Next | Covered |
| Marketing Cloud Personalization only when provisioned on AWS infrastructure | Covered |
| Slack Enterprise plans once enablement is confirmed | Covered |
| Tableau Cloud and Tableau Next | Covered |
What the BAA leaves out
- Commerce Cloud Einstein, including Predictive Email
- Lightning Platform Discover feature
- Marketing Cloud Einstein features in Marketing Cloud Next
- Einstein Bots utterance records with PHI, and Answer Automation or Input Recommender with PHI
- Agentforce, Einstein and Tableau for medical advice, diagnosis or treatment, or to infer a health condition
- Slack profile fields, statuses, emoji, workspace and group names with PHI
How to get the BAA
Request it through your Salesforce account representative.
What the vendor says to do
- Have the BAA name each service you use
- Enable Data Masking where within your control for Einstein and Tableau
- Manage third-party LLM providers and telephony yourself where used
- Keep PHI out of support requests on Slack
What we couldn’t confirm
Coverage depends on the service, not the edition. We couldn’t confirm whether Starter Suite or Pro Suite qualify.
Proof from the vendor
- BAA Restrictions and HIPAA Covered Services (last updated September 30, 2026)Covered services, restrictions, exclusions
- HIPAA, Salesforce Compliance SiteBAA requested through account representative
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.