Is Your Tool HIPAA Compliant?

Google Workspace can be HIPAA Compliant, but not out of the box. You need a paid Business or Enterprise plan, a signed BAA (available in the Admin console), and the right security settings turned on. The BAA covers Gmail, Drive, Docs, Sheets, Slides, Meet, Calendar, Chat, Forms, Keep, and Vault. Google Analytics is not included.

See: Google Workspace HIPAA compliance guide

Zoom offers HIPAA-Compliant plans for healthcare organizations. You need a paid Healthcare, Business, or Enterprise account, a signed BAA, and HIPAA mode enabled in your settings. The free version does not qualify. Turning on HIPAA mode disables some AI features, including Zoom AI Companion.

See: Zoom HIPAA compliance and health data

Dropbox Business, Business Plus, and Enterprise plans support HIPAA Compliance with a signed BAA. You can sign the agreement electronically through the admin console. Free and personal Plus accounts are not eligible. The BAA must be in place before you upload any files containing PHI.

See: Dropbox HIPAA/HITECH overview

Teams can be HIPAA-Compliant as part of Microsoft 365 Business Premium, E3, or E5. Microsoft includes a BAA in its Online Services Data Protection Addendum, so qualifying customers can accept it without a separate request. The free version of Teams is not covered.

See: Microsoft HIPAA/HITECH compliance

Only Slack Enterprise Grid supports HIPAA Compliance. Pro and Business+ plans do not qualify. Even on Enterprise Grid, PHI use is limited to messages and files, and direct patient communication through Slack is not allowed. For most small and mid-size practices, the pricing makes Slack impractical for handling PHI.

See: Slack and HIPAA

DocuSign supports HIPAA Compliance on Business Pro and Enterprise plans. To get a BAA, contact your account representative. Personal and Standard plans are not eligible. Documents are encrypted in transit and at rest.

See: DocuSign HIPAA compliance overview

Mailchimp is not HIPAA-Compliant. It does not sign BAAs on any plan, and its terms of service prohibit sending protected health information. If you need email marketing for a healthcare practice, you will need a different platform.

See: Mailchimp terms of use

Salesforce can be HIPAA-Compliant on Health Cloud or Enterprise editions of Sales and Service Cloud. A signed BAA is required, and most healthcare deployments also need Salesforce Shield, a paid add-on that covers encryption, event monitoring, and audit logging. Standard and Professional editions are not eligible.

See: Salesforce HIPAA compliance

Calendly does not offer HIPAA Compliance on its standard plans and does not sign BAAs for most customers. Its terms prohibit submitting PHI. Some Enterprise-level organizations may be able to negotiate a HIPAA arrangement, but this is not a standard offering.

See: Calendly security and compliance

Monday.com supports HIPAA Compliance on its Enterprise plan, which requires a minimum of 25 users. You activate HIPAA mode and sign the BAA through the admin console. Free, Basic, Standard, and Pro plans are not covered.

See: Monday.com and HIPAA

ChatGPT is not HIPAA Compliant on the Free, Plus, Pro, or Team plans, and PHI should never be entered into those tiers. OpenAI will sign a BAA, but only for ChatGPT Enterprise or Edu customers on a sales-managed account, or for the API platform when configured for zero data retention – ChatGPT Business does not qualify. To request a BAA, contact OpenAI sales for Enterprise/Edu or email baa@openai.com for the API.

See: How can I get a BAA with OpenAI?

Claude is not HIPAA Compliant on the Free, Pro, Max, or Team plans, so PHI should never be sent through those tiers. Anthropic will sign a BAA for its first-party API and for HIPAA-ready Claude Enterprise plans, but the organization’s Primary Owner must actively enable HIPAA Compliance and accept the BAA in the account’s Data and Privacy settings – it isn’t automatic on a standard Enterprise plan. Even under a signed BAA, features like Console, Workbench, Claude Code seats, and Cowork remain excluded from coverage.

See: Business Associate Agreements (BAA) for Commercial Customers

Perplexity does not offer a HIPAA BAA on its consumer, Pro, or API/Sonar tiers, so PHI should not be entered into those products. A BAA is only available under the negotiated Enterprise Pro or Enterprise Max plans, and Perplexity’s own Enterprise Terms state that PHI may not be processed unless that agreement is executed. Perplexity Health, the consumer wellness feature, is explicitly called out by Perplexity’s help center as not subject to HIPAA.

See: Perplexity Enterprise Terms of Service