CRM Services

The Salesforce platform can be set up to meet HIPAA compliance standards through certain features that help keep protected health information (PHI) secure in the cloud. Salesforce includes administrative, physical, technical, organizational, and documentation safeguards to protect PHI.Customers can use customer-controlled security features through Salesforce Covered Services. Additionally, Salesforce has security safeguards such as data encryption in transit, ongoing monitoring for security violations, and audit logging to identify changes in activity. Customer administrators can use configurable tools to define permission sets that govern the visibility of data, maintain strict password security, monitor field level history, set security rules to manage data access, define a company-wide sharing model and role hierarchy.In addition to permission sets, customers can define user profiles to limit data record access to authorized employees.It’s a good idea to use the premium set of Salesforce features known as “Salesforce Shield.” These features provide extra monitoring, encryption, and auditing. You might need to enable other features or additional services to ensure the protection of PHI when information is in transit.If you’re planning to use Salesforce for patient information, reach out to your account representative for a signed Business Associate Agreement (BAA). The account representative can also advise you on specific features and settings for HIPAA compliance.

Zapier, a widely used automation tool that connects apps and services to automate workflows, has stated that it does not support HIPAA compliance. Despite its robust encryption measures for data transmission and comprehensive activity logging within its network, Zapier’s functionality doesn’t render it HIPAA compliant. Zapier has stated on its website that it won’t sign a Business Associate Agreement (BAA). Because a BAA is required under HIPAA, this prevents Zapier from handling protected health information (PHI) in a HIPAA-compliant manner.BAAs serve as crucial contractual documents that explicitly define the protocols for storing and exchanging sensitive data between entities. They are an essential component of achieving and maintaining HIPAA compliance. Without a properly executed BAA, an organization cannot use any third-party tool or service to handle sensitive information within the scope of HIPAA regulations.

Zendesk offers two plans — Suite Professional and Suite Enterprise — that the company refers to as “HIPAA enabled.” According to Zendesk, to secure a HIPAA-enabled account, customers must do three things:1.Purchase the Advanced Security Deployed Associated Service or Advanced Compliance Deployed Associated Service Add-on2.Set up specific security configurations outlined by Zendesk3.Sign Zendesk’s Business Associate Agreement (BAA)  On its website, Zendesk provides a list of services eligible for coverage by the BAA

Zoho’s website provides limited information about HIPAA compliance. Even though its tools aren’t for healthcare entities specifically, many of the security features may meet HIPAA requirements.These cloud-based services are comparable to those in Office 365 and Google Workspace, with solutions for word processing, custom applications, project management, live chat, app integration, and an IoT management platform.The company offers technical, physical, and administrative safeguards for all services, but there are questions about whether these privacy features are sufficient for HIPAA regulations.

Covered entities shouldn’t use HubSpot for PHI. On HubSpot’s terms of service page, the company states that its services don’t comply with industry-specific regulations like HIPAA. The terms of service forbid the processing or storage of sensitive health information.