By Alpit Patel and the aibrevo team · October 17, 2026 · 12 min read
Is monday.com HIPAA Compliant? Plan, BAA, Setup and What Is Not Covered
Quick answer
monday.com offers HIPAA on its Enterprise tier (called Ultimate on the CRM pricing page). An admin accepts monday's Business Associate Agreement and activates HIPAA under Administration, Security, Compliance. Third-party integrations are outside the BAA, and monday documents encryption at rest and in transit, not end-to-end encryption.
Part of the guide: monday CRM guide
Key takeaways
- monday.com's support article says HIPAA is available on its Enterprise plan. On the CRM pricing page checked October 17, 2026, HIPAA compliance is listed under Ultimate, which that page calls a new name for the Enterprise tier. Ultimate is custom priced.
- The BAA applies only if you use the enterprise tier and have enabled the HIPAA compliance feature. An admin accepts it under Administration, Security, Compliance, then clicks Activate HIPAA Compliance. The BAA text on monday's site is dated February 7, 2022.
- Third-party services are outside the BAA. The BAA says the customer is solely responsible for any PHI exchanged with a third-party integration, and monday's HIPAA article says any third-party app you connect must be HIPAA compliant too.
- monday documents AES-256 encryption at rest and TLS 1.3 (minimum TLS 1.2) in transit. We found no mention of end-to-end encryption in its June 2026 security white paper, so assume monday's systems can process your data. Bring your own key is a separate Guardian add-on for Enterprise.
- monday lists SOC 1 Type 2, SOC 2 Type 2, SOC 3 and five ISO certificates, plus TX-RAMP. We found no monday.com entry in the FedRAMP marketplace data we checked on October 17, 2026.
monday.com can be used for protected health information (PHI), but only on its Enterprise tier, with a signed Business Associate Agreement (BAA) and HIPAA activated by an admin. On the monday CRM pricing page that tier is called Ultimate and is custom priced. Plans below it are not covered. The BAA also leaves third-party integrations out, so connecting Gmail, Outlook or Zapier to a HIPAA account is your responsibility.
Checked on October 17, 2026. We opened monday’s HIPAA support article, the BAA on monday’s legal portal, the Trust Center and security compliance hub, the Security and privacy FAQ, the AI FAQ, the secure configuration checklist, the Guardian add-on article, the June 2026 security white paper, and the monday CRM pricing and healthcare pages. We also searched FedRAMP’s marketplace data. Nothing here is legal advice; ask your compliance officer to review the BAA.
Which monday.com plan do you need for HIPAA?
You need the Enterprise plan. monday’s article “monday.com and HIPAA” says: “HIPAA is available on monday.com on our Enterprise plan,” and warns that if you later downgrade, you will no longer be covered under the HIPAA compliance program. Its security white paper (June 2026 revision) says the same: HIPAA-compliant account configuration is for customers on the Enterprise plan.
On the monday CRM pricing page, the Ultimate plan lists “HIPAA compliance” under its extras, with the footnote “Ultimate is a new name for our Enterprise tier.”
| CRM plan | Price shown (checked Oct 17, 2026) | HIPAA listed? |
|---|---|---|
| Basic | $12 per seat per month, annual billing | No |
| Standard | $17 per seat per month, annual billing | No |
| Pro | $28 per seat per month, annual billing | No |
| Ultimate (formerly Enterprise) | Custom price, contact sales | Yes, “HIPAA compliance” |
Source: monday.com CRM pricing page, 10 seats selected, yearly billing, read October 17, 2026. Prices are per seat per month and vary by seat bucket. See monday CRM pricing explained and our plan limits research.
Two limits of what monday publishes: it does not publish an Ultimate price or a minimum seat count on the pages we opened, and its CRM pricing page lists HIPAA only on Ultimate. If a sales rep offers HIPAA on another plan, get that in writing in the BAA or order form.
Does monday.com sign a BAA, and what does it cover?
Yes. monday publishes a HIPAA Business Associate Agreement for the Enterprise plan with the HIPAA feature enabled. The text on its legal portal shows “Last Updated: February 07, 2022,” so ask monday whether a newer version exists for your account.
You can sign in either of two ways: countersign the online version through DocuSign, or, if you are the admin, click I Accept on the monday.com platform when you enable the HIPAA feature. The BAA says it becomes effective when you click I Accept on the platform, even if you signed the online version earlier.
| The BAA says monday will | Detail from the text |
|---|---|
| Limit use and disclosure of PHI | Only as the agreement permits or the law requires, and only the minimum necessary |
| Keep safeguards in place | Administrative, physical and technical safeguards to protect PHI it creates, receives, stores or transmits |
| Flow terms to subcontractors | Agents and subcontractors must accept restrictions no less strict than monday’s |
| Give you access to PHI | Within 15 days of a written request |
| Amend PHI | Within 15 days of a written request |
| Provide an accounting of disclosures | Within 30 days of a written request, covering the prior six years |
| Report security incidents | Reports incidents it becomes aware of, and treats routine unsuccessful attempts (pings, port scans, failed log-ins) as already notified |
| Report breaches of unsecured PHI | Without unreasonable delay and no later than 30 days after it becomes aware |
| Return or delete PHI on termination | If feasible, through a deletion option in the platform |
Source: monday.com HIPAA Business Associate Agreement, dated February 7, 2022, read October 17, 2026.
What the BAA excludes or puts on you:
- Third-party services. Section 7(a) says the platform lets you exchange information with third-party services that “may or may not be compliant with HIPAA.” If you use them, you are “solely liable and responsible” for the exchange, including any PHI. Those providers are not monday’s business associates, and monday disclaims liability for them.
- Minimum necessary. You must give monday only the minimum PHI needed for the function.
- Notice of privacy practices and restrictions. You must pass monday your notice of privacy practices and any agreed restriction on use or disclosure.
- Plan scope. It applies only on the enterprise tier with the HIPAA feature enabled.
How do you set up HIPAA in monday.com?
An account admin does it. monday’s article gives these steps:
- Click your profile picture, top right, and choose Administration.
- Go to the Security section and choose Compliance.
- Click the BAA link, review it and accept it.
- Click Activate HIPAA Compliance.
- Turn on Redact Content in Email & Reply Updates once HIPAA is active. After this, an email about an update you were tagged in hides the update text, and the reader has to click Reply in monday.com and log in to read it.
To deactivate, use Deactivate HIPAA Compliance on the same page. All admins in the account get an email when HIPAA is deactivated. Also know that on all HIPAA-compliant Enterprise plans, the broadcast feature (sharing a board view publicly) is disabled to prevent accidental disclosure of PHI.
Activation is the start. monday’s secure configuration checklist (published March 26, 2026) says customers are responsible for configuring their own security controls and data. For a clinic, the items that matter most are:
| Control | What the checklist says | Why it matters for PHI |
|---|---|---|
| SSO (SAML 2.0) and 2FA | SAML single sign-on; 2FA by text message or authenticator app | Removes shared passwords |
| IP restrictions | Limit access to a list of approved IP addresses | Keeps the account to clinic networks |
| Session duration | Set an automatic log-out interval | Protects shared front-desk machines |
| Board, workspace and column permissions | Control who can view or edit each, including individual columns | Lets you hide diagnosis or insurance columns from sales users |
| Audit log and activity log | Admin report of security activities; per-board history | Evidence for reviews |
| Limit admins | Keep the number of admins to the minimum | Fewer people who can turn HIPAA off |
| Integrations | Optional and can be disabled in the admin section; limit who can add them | Closes the third-party gap |
| AI permissions | Disable AI at account or workspace level, or restrict it by role | Keeps PHI away from AI features you have not approved |
Source: monday.com Support, monday.com secure configuration checklist, checked October 17, 2026. SAML SSO is for Enterprise; see the security FAQ.
What is covered by monday’s HIPAA program and what is not?
| Area | Covered? | What monday documents |
|---|---|---|
| Boards, items, docs in a HIPAA-activated Enterprise account | Yes, under the BAA | HIPAA article and BAA |
| Mobile app | Yes from iOS 3.331 and Android 3.190715 | HIPAA article |
| monday AI | Yes if you have an executed BAA | AI FAQ (published December 11, 2024). AI can be switched off per account, workspace or role |
| Email notifications | Partly | Content redaction option once HIPAA is active |
| Public board sharing (broadcast) | Disabled on HIPAA Enterprise plans | HIPAA article |
| Third-party integrations and apps (Gmail, Outlook, Slack, Zapier, marketplace apps) | No | BAA section 7(a); HIPAA article says each must be HIPAA compliant |
| Plans below Enterprise | No | HIPAA article; pricing page |
| Mass emails, sequences, Emails & Activities sync, file attachments | Not separately documented | We found no page that lists these as in or out of scope. Ask monday to confirm in writing |
| Data you upload that you should not | Your responsibility | Under the BAA you give only the minimum PHI necessary |
Sources: monday.com Support and legal pages listed below, checked October 17, 2026.
Email deserves a closer look for a CRM. A CRM works by syncing a mailbox, and the mailbox is a third-party service. Our guides on connecting Gmail and Outlook to monday.com explain what syncs. Whether that mail provider has its own BAA with you is a question for your compliance team, not something monday’s BAA settles.
Is monday.com encrypted, and is it end-to-end encrypted?
It is encrypted at rest and in transit. It is not documented as end-to-end encrypted. monday’s Security and privacy FAQ (last modified September 17, 2026) and white paper say:
- Data at rest uses AES-256. Keys are stored in AWS Key Management Service, with an annually rotated customer master key encrypting customer data.
- Data in transit across open networks uses TLS 1.3, at minimum TLS 1.2.
- Passwords are hashed with a multi-round bcrypt function and salted.
- Backups are encrypted with AES-256, retained 25 days in the same region and 7 days remote.
- monday AI uses the same protections: AES-256 at rest and TLS 1.3 in transit.
We searched the white paper for “end-to-end” and found no match. The documented model is that monday holds the encryption keys by default, and it says customer data is “generally not accessed” for running the service and that access follows need-to-know and least privilege. That is a strong operational control, but it is not end-to-end encryption, where only you hold the keys.
If you want more key control, monday’s Guardian add-on, which its article says is for Enterprise customers only, offers Tenant-Level Encryption (a dedicated key per account) and Bring Your Own Key (you manage the key lifecycle and can revoke access), plus data leak prevention and multi-SSO. We did not find a Guardian price on the pages we opened.
What certifications does monday.com hold?
monday’s security compliance hub (trust.monday.com) lists these. It does not show an issue date per certificate on the public page; dates appear in the documents behind the access request.
| Certification or program | Listed on the hub | Notes |
|---|---|---|
| SOC 1 Type 2, SOC 2 Type 2, SOC 3 | Yes | Hub posted “New SOC reports for FY25” on November 26, 2025; the white paper says SOC 2 maps to HIPAA security requirements |
| ISO/IEC 27001:2022 | Yes | Information security |
| ISO/IEC 27017:2015 | Yes | Cloud security controls |
| ISO/IEC 27018:2019 on the hub, 27018:2014 in the white paper | Yes | The two monday pages disagree on the year; ask for the certificate |
| ISO/IEC 27032:2023, ISO/IEC 27701:2019 | Yes | Cybersecurity and privacy management |
| HIPAA | Listed on the hub and the security FAQ | HIPAA is a law. The listing means monday offers the program above, not that a government body certified it |
| TX-RAMP | Yes | Texas program for state and local government |
| CSA STAR Level 1 | Yes | Self-assessment |
| GDPR, CCPA, LGPD, PIPEDA, APPI, EU-US DPF | Yes | Privacy programs |
| Third-party penetration test | Updated documentation added May 18, 2026 | Annual |
Sources: trust.monday.com, monday.com Trust Center, monday Security and Privacy white paper (revision June 2026), Security and privacy FAQ. Read October 17, 2026.
Is monday.com FedRAMP certified?
We found no evidence that it is. We checked the GSA’s FedRAMP marketplace data (last changed May 19, 2026, 650 products) and the product list on fedramp.gov on October 17, 2026. Neither had a monday.com entry, while products such as Smartsheet Gov and Asana did appear. monday’s own Trust Center lists TX-RAMP, which is a Texas program and not FedRAMP. If a federal contract requires FedRAMP, ask monday sales for its status in writing and do not rely on a vendor-comparison site.
Is monday CRM a fit for a clinic?
It can be, for the relationship side of a practice. monday’s own healthcare CRM page says monday CRM “is designed to support HIPAA-compliant workflows” for referrals, scheduling and outreach “while clinical documentation stays secure,” and its FAQ advises storing clinical details in an EHR or EMR while tracking relationship and workflow data in the CRM. It ends with “Always confirm your specific compliance requirements with your internal compliance team.”
| Your situation | Likely fit |
|---|---|
| Tracking referral sources, partner clinics, marketing leads and non-clinical follow-up, with no diagnosis or treatment detail | monday CRM on any plan can work, because no PHI is stored. Keep PHI out of notes and files |
| Appointment reminders, intake forms and follow-up that include patient names tied to a service | Treat this as PHI. Use Enterprise with the BAA and HIPAA activated, and confirm each connected tool |
| A team that needs patient text messaging, forms and email in the same system | Check each channel’s BAA. monday’s BAA does not cover third-party tools you connect |
| Clinical notes, diagnoses, treatment plans | Use your EHR. A CRM should reference a patient, not duplicate the record |
| Small clinic that cannot take Enterprise pricing or a sales process | Ultimate is custom priced and sold through sales. A tool with a published HIPAA add-on price may be easier. Compare before you commit |
Our healthcare CRM guide draws the CRM and EHR line in more detail. For a comparison with another platform that markets itself to clinics, see is GoHighLevel HIPAA compliant, which covers its separate setup and BAA arrangement. We do not restate it here. Whether you are choosing between monday CRM and monday work management, see monday CRM vs monday work management, because HIPAA coverage is tied to the plan tier, not the product name.
When to bring in help
Bring in help when PHI will touch more than one tool: the CRM, a mailbox, a form tool and a texting service. Each link needs its own agreement and its own configuration, and the weakest link sets your exposure. Our monday.com implementation service scopes the build and integrations; you can book a call at cal.com. Your lawyer or compliance officer, not an agency, decides whether a setup meets HIPAA.
Sources
All checked on 2026-10-17.
- monday.com Support, monday.com and HIPAA: Enterprise plan requirement, activation steps, broadcast disabled, email redaction, mobile versions, third-party apps.
- monday.com, HIPAA Business Associate Agreement: scope, signing options, obligations, third-party exclusion. Last updated February 7, 2022.
- monday.com, CRM pricing: Basic, Standard, Pro and Ultimate prices, HIPAA compliance listed under Ultimate, Ultimate as new name for Enterprise.
- monday.com, Security compliance hub: certification list, SOC report update November 26, 2025, penetration test update May 18, 2026, cyber insurance update September 8, 2026.
- monday.com, Trust Center: compliance programs, TX-RAMP, CSA STAR, BAA link, security white paper link.
- monday.com, Security and privacy white paper (June 2026 revision): encryption, ISO and SOC detail, HIPAA, TX-RAMP.
- monday.com Support, Security and privacy on monday.com: FAQs: encryption methods, customer data handling, mobile cache, SSO plans (last modified September 17, 2026).
- monday.com Support, AI FAQs: monday AI and HIPAA, encryption, model data retention.
- monday.com Support, monday.com secure configuration checklist: shared responsibility, security controls, AI permissions (published March 26, 2026).
- monday.com Support, Guardian add-on: tenant-level encryption, bring your own key, Enterprise only (last modified April 15, 2025).
- monday.com, monday CRM for healthcare: healthcare positioning, EHR guidance, compliance statement.
- FedRAMP, Marketplace products and the GSA marketplace data (last changed May 19, 2026): no monday.com listing found.