Is Zapier, Jira, HubSpot, Salesforce or Twilio HIPAA compliant?

None of these tools is HIPAA compliant by default, and none is automatically ruled out. Whether a practice can put protected health information (PHI) in Zapier, Jira, HubSpot, Salesforce, Twilio, Notion or Airtable depends on four things: whether the vendor signs a business associate agreement (BAA), which plan or product that BAA requires, which features it covers, and how you configure and connect the tool. Below is a dated, sourced check of each app against those four questions. There is also a section on the gap most teams miss: data moving between two tools can leave BAA coverage even when both tools are covered.

Quick answer: which of these tools will sign a BAA

Vendor HIPAA policies change, and plan names change with them. Treat every cell below as valid only on the date in the last column. Before relying on any row, check it against the vendor's current trust or compliance page. For more popular tools checked for HIPAA, see the hub.

Tool	BAA available?	Required plan or product	Covered features	Last verified
Zapier	Confirm with vendor	Check which Zapier plan, if any, is BAA-eligible	Check the BAA's covered-features list	Date on Zapier's current HIPAA page
Jira (Atlassian)	Confirm with vendor	Check which Atlassian Cloud plan, if any, is eligible	Check which Atlassian products are covered	Date on Atlassian's current HIPAA page
HubSpot	Confirm with vendor	Check which tier, if any, is required	Check covered features and any sensitive-data settings	Date on HubSpot's current HIPAA page
Salesforce	Confirm with vendor	Check whether Health Cloud, Service Cloud and Marketing Cloud are each in scope	Check the covered-services list	Date on Salesforce's current HIPAA page
Twilio	Confirm with vendor	Check the account setup required	Check SMS, Voice and Video eligibility separately	Date on Twilio's current HIPAA page
Notion	Confirm with vendor	Check which Notion plan, if any, is eligible	Check the covered-features list	Date on Notion's current HIPAA page
Airtable	Confirm with vendor	Check which Airtable plan, if any, is eligible	Check the covered-features list	Date on Airtable's current HIPAA page

The short version per tool:

• Zapier: Confirm on Zapier's current trust or legal page whether it signs a BAA and on which plan; until you have that in writing, keep PHI out of Zaps.
• Jira / Atlassian: Confirm whether Atlassian signs a BAA, on which Cloud plan, and whether Jira is a covered product.
• HubSpot: Confirm whether HubSpot signs a BAA, which tier it requires and which features it covers, and check the date on the page you read.
• Salesforce: Confirm which services the Salesforce BAA covers, checking Health Cloud, Service Cloud and Marketing Cloud one by one.
• Twilio: Confirm which products Twilio lists as HIPAA-eligible, checking SMS, Voice and Video separately.
• Notion and Airtable: Confirm BAA availability and the required plan for each tool separately.

Four questions that decide whether a tool is HIPAA-ready

A tool's brand does not decide HIPAA readiness. These four questions do, in this order. If you need a refresher, here is what a business associate agreement (BAA) is.

1. Will the vendor sign a BAA, and on which plan or contract? Under HIPAA, a vendor that creates, receives, maintains or transmits PHI on your behalf is a business associate. You need a BAA with that vendor before PHI goes in. Many vendors offer a BAA only on a specific tier, an add-on or a separately negotiated contract. A practice on the wrong plan has no BAA, even if the vendor "offers HIPAA."

2. Which products and features does the BAA cover? BAAs list covered services. Features commonly excluded or handled separately include:

• AI features
• add-ons
• marketplace or third-party apps
• beta features
• some mobile or email functions

Read the covered-services list, not the marketing page.

3. What configuration does the vendor require? Most BAAs assume you turn on specific safeguards. Typical requirements:

• SSO or two-factor authentication
• role-based access
• retention settings
• audit logging
• sometimes a flag that marks the account or fields as holding sensitive data

Skipping these can put you outside the terms you signed.

4. What does the practice still own? HIPAA is shared responsibility. The vendor provides safeguards. The practice decides who can see PHI, what goes into the tool, how access is removed when someone leaves, and what staff are trained to do. No tool makes a practice compliant by itself. Your privacy officer or counsel should review each BAA before you rely on it. This page is not legal advice.

Zapier and HIPAA

Current position: Check Zapier's current trust or legal page for its HIPAA and BAA policy, the plan it applies to, and the date the page was last updated.

Automation tools carry more HIPAA risk than most apps because moving data is their whole job. A Zap that takes a new intake form submission, creates a CRM contact and posts a message to a team channel has copied the same data into three places. Each of those apps needs its own BAA if the data includes PHI. The automation platform needs one too, because it processes the data in transit and may keep a record of it in task history.

Uses that usually work without PHI:

• Posting "New ticket assigned to Facilities" when a Jira issue is created
• Sending an internal reminder that the monthly supply order is due
• Copying a staff PTO request from a form into a shared calendar
• Notifying the billing team that a payment report is ready, without amounts or patient names. For payment tools themselves, see Stripe, Square and HIPAA.

Uses that need a confirmed BAA chain end to end:

• Anything triggered by an intake, referral or appointment form
• Anything that copies patient names, dates of service, phone numbers or insurance details

Alternatives some teams consider: Make and n8n. Check each vendor's current BAA position, and whether a self-hosted setup fits your IT team, before moving PHI through either. Self-hosting moves the infrastructure responsibility to you. It does not remove the need for safeguards on the server, the connected apps and the data flows.

Jira (Atlassian) and HIPAA

Current position: Check Atlassian's current trust page for its HIPAA policy, which Jira Cloud plans are eligible, which Atlassian products are covered, and the date the page was last updated.

In outpatient practices, Jira usually runs internal work:

• IT tickets ("Printer at front desk 2 offline")
• facilities requests
• EHR configuration change requests
• operations projects such as opening a new location

Most of this work never needs patient information. That is the easiest way to keep Jira out of HIPAA scope.

Rules that keep Jira tickets PHI-free:

• No patient names, MRNs, dates of birth or dates of service in ticket titles, descriptions or comments.
• Reference the source system instead: "See EHR task queue, item flagged by Dr. Lee's MA on 3/14," not the patient's details.
• No screenshots of the EHR, schedules or claims screens as attachments unless your BAA covers Jira and attachments.
• Check automation rules and email notifications. They can copy ticket text into inboxes and other apps.

Confluence and Marketplace apps: Confluence often sits beside Jira and holds SOPs and runbooks. Confirm whether it is in the same BAA scope. Marketplace apps from third-party developers may process your data under their own terms, so confirm whether each one is covered before it touches tickets that could hold PHI.

HubSpot and HIPAA

Current position: Check HubSpot's current trust or legal page for whether it signs a BAA, the tier required, the features covered, any sensitive-data settings, and the date the page was last updated.

HubSpot questions usually come from practices using it for marketing: newsletters, website forms, appointment-request landing pages and ad tracking. That is where PHI most often slips in. A form that asks "What brings you in?" or a list segmented by procedure type can create PHI. The same goes for website tracking on condition-specific pages, which can disclose health information to the tracking vendor; have your privacy officer review current HHS guidance on online tracking technologies.

If no BAA is in place, practices commonly keep these out of HubSpot:

• Reason for visit, symptoms, diagnoses or procedure interest
• Appointment dates linked to a named contact
• Insurance details or member IDs
• Lists or segments defined by condition ("knee replacement leads")
• Tracking pixels on pages about specific conditions or patient portals

On "is HubSpot HIPAA compliant 2025" or "2026": the year in the search matters because vendor positions change. Look at the date on HubSpot's current trust or legal page and compare it with the date in the table above. If they differ, the vendor's page wins.

Salesforce and HIPAA

Which products are in scope: Check Salesforce's current covered-services list for its BAA, including whether Health Cloud, Service Cloud and Marketing Cloud each appear on it, and note the date.

Salesforce is a family of products, and a BAA does not cover all of them by default. A practice group might run patient relationship work in one product and email campaigns in another. Each needs to appear on the covered-services list.

How to make Salesforce HIPAA-ready:

1. Sign the BAA for the specific Salesforce services that will hold PHI.
2. Turn on encryption options as your agreement and your risk assessment require, and confirm with Salesforce which products or add-ons that involves.
3. Restrict access with profiles, permission sets and field-level security. For example, a marketing user should not see clinical fields.
4. Enable audit trails and field history tracking for PHI fields.
5. Review connected apps and AppExchange packages, which may fall outside the BAA.

Configuration responsibility sits with the practice or its implementation partner. Budget admin time accordingly.

On CDISC: some searches pair HIPAA with CDISC. CDISC is a set of data standards used in clinical research. It is not a HIPAA requirement. The two answer different questions.

Twilio and HIPAA

Scope by product: Check Twilio's current list of HIPAA-eligible products, including whether SMS, Voice and Video are on it, the account setup required, and the date the list was last updated.

Twilio is a developer API, not a finished app. Your HIPAA readiness depends on Twilio's BAA scope, and also on how your developer or vendor built the application on top of it. That includes what is logged, where message bodies are stored and who can access them. If you want a finished video product instead, see Zoom, FaceTime and HIPAA.

SMS caveat: even with a BAA, a text to a patient travels through carrier networks and lands on the patient's personal phone. Both are outside any vendor's control. Practices that text patients often rely on patient consent and minimum-necessary content, such as "Reminder: appointment tomorrow at 10:00. Reply C to confirm" rather than visit details; ask your privacy officer how current HHS guidance on texting patients applies to your practice.

Patient messaging is a separate category from internal staff chat. A tool for texting patients and a tool for front desk, billing and clinic managers to coordinate are evaluated differently. Many practices use one of each. If you are evaluating the staff side, see team chat tools compared on HIPAA.

Notion and Airtable and HIPAA

• Notion: Check Notion's current trust or legal page for BAA availability, the plan required, and the date the page was last updated.
• Airtable: Check Airtable's current trust or legal page for BAA availability, the plan required, and the date the page was last updated.

Clinics often use these for work that does not need PHI:

• front desk SOPs
• opening and closing checklists
• supply trackers
• onboarding checklists for new MAs
• credentialing timelines
• vendor contact lists

That kind of operational content can live in either tool without patient data. The same logic applies to suite tools; see Google Workspace and HIPAA.

Rule of thumb: if a page, table or base could plausibly hold a patient name, date of service, MRN, phone number or insurance ID, confirm BAA coverage first. Watch "temporary" trackers in particular. A no-show follow-up list built in Airtable "just for this week" is PHI the moment someone adds names.

Connecting tools without leaking PHI, and where staff chat fits

Integrations are where well-run practices lose track of PHI. Two tools can each be under a BAA, and the connector between them can still store or route data outside both agreements. Notifications carry the same risk. A Jira update emailed to a personal inbox, or a HubSpot alert posted to a chat channel, copies text into a new system.

Before turning on any integration:

• Map the data flow: source app, connector, destination app, and anything logged in between.
• Keep notifications PHI-free: "New referral received, see EHR queue," not the patient's name and reason for referral.
• Link, don't copy: point to the record in the system of record instead of pasting details.
• Check file connectors separately. Synced drives and previews are their own BAA question; see HIPAA checks for Dropbox and cloud storage.

Practice checklist per tool:

• BAA signed with this vendor, on file with the privacy officer
• Plan or contract confirmed as BAA-eligible
• Features and add-ons in use are on the covered list
• SSO or 2FA, access roles, retention and audit logs configured
• Integrations and notifications reviewed for PHI
• Offboarding process removes access the day someone leaves
• Staff policy says what may and may not go into the tool

Where staff chat fits: for internal staff coordination, Chanty supports HIPAA compliance with a signed BAA on its Business and Enterprise plans. The Free plan does not include a BAA. Chanty's BAA covers the data inside the team space: messages, files, voice notes, tasks and Teambook. Third-party integrations, including Zapier, Jira and HubSpot notifications, are outside Chanty's BAA scope, and each one that touches PHI needs its own BAA with that vendor. Apply the same PHI-free notification rule there. Chanty is a HIPAA-compliant chat for staff, not a patient messaging tool. Full scope and controls are on Chanty security, HIPAA and BAA details.

FAQ

Is Zapier HIPAA compliant in 2025, and will it sign a BAA?

Confirm on Zapier's current trust or legal page whether it signs a BAA and on which plan. Even where an automation platform offers a BAA, every app a Zap touches needs its own BAA before PHI flows through it. Check Zapier's current trust page date before relying on any answer.

Is Jira HIPAA compliant?

It depends on whether Atlassian signs a BAA for your plan and which products that BAA covers. Most clinics use Jira for IT and operations tickets and keep patient identifiers out entirely, which avoids the question.

Is HubSpot CRM HIPAA compliant, and which tier includes a BAA?

Confirm on HubSpot's current trust or legal page whether it signs a BAA, which tier is required and which features are covered. Without a BAA, keep reasons for visit, appointment details, insurance data and condition-based lists out of HubSpot. Also review tracking on condition-specific web pages.

How do you make Salesforce HIPAA compliant?

Sign a BAA covering the specific Salesforce services you use. Then turn on required encryption options, restrict access with field-level security and permission sets, enable audit trails, and review connected apps. Configuration is the practice's or its implementation partner's responsibility.

Is Salesforce Marketing Cloud covered by a BAA?

Only if it appears on Salesforce's current covered-services list for the BAA, so check that list and its date. Do not assume coverage because another Salesforce product is covered.

Is Twilio SMS HIPAA compliant for patient texts?

Twilio's BAA, where in place, applies only to the products Twilio lists as HIPAA-eligible; check whether SMS is one of them and what account setup is required. Carrier networks and patient phones are outside any BAA. Practices typically use patient consent and minimal message content.

Are Notion and Airtable HIPAA compliant?

Confirm BAA availability and the required plan separately on each vendor's current trust or legal page. Both work well for SOPs, checklists and operations trackers that contain no patient data.

If two tools each have a BAA, is the integration between them covered?

Not automatically. The connector, whether a native integration, an automation platform or a marketplace app, may store or process data under its own terms. Confirm that every hop in the data flow is covered, or keep PHI out of the integration.

Does a signed BAA make a tool HIPAA compliant on its own?

No. A BAA is a required contract, not a compliance status. HHS does not certify software as HIPAA compliant. Compliance depends on configuration, access control, staff policy and training, which the practice owns. Have your privacy officer or counsel review each agreement.