By Alpit Patel and the aibrevo team · October 20, 2026 · 5 min read
Is Pipedrive HIPAA Compliant? What the Terms Say and What to Use Instead
Quick answer
No. Pipedrive's Terms of Service (current as of September 16, 2026) say its services are not designed to comply with HIPAA, and customers agree not to store sensitive information, which the terms define to include health data. Pipedrive publishes no Business Associate Agreement. Healthcare teams can use it only for business contacts that hold no patient information.
Part of the guide: Pipedrive guide
Key takeaways
- Pipedrive is not HIPAA compliant. Section 7.3 of its Terms of Service says the services are 'not designed to comply with industry-specific regulations such as the Health Insurance Portability and Accountability Act (HIPAA)'.
- The same section goes further: customers agree not to use Pipedrive to collect, store, manage or process Sensitive Information, and the terms define that to include health and genetic data.
- We found no Business Associate Agreement on Pipedrive's website, and the terms leave compliance with industry rules, including for call recording and AI features, to the customer.
- Pipedrive's security is not the issue. Its Data Processing Addendum (updated July 2, 2026) lists ISO/IEC 27001 and 27701 certification, audits against AICPA Trust Services Criteria, and AES-256 encryption at rest. HIPAA needs a BAA on top of security.
- A healthcare business can still use Pipedrive for B2B sales, such as selling equipment or services to clinics, as long as no patient information goes into it.
No, Pipedrive is not HIPAA compliant. Its own Terms of Service say the service is “not designed to comply with industry-specific regulations such as the Health Insurance Portability and Accountability Act (HIPAA),” and they go one step further: customers agree not to store sensitive information in Pipedrive at all, and the terms define that to include health data. We read Pipedrive’s Terms of Service (current as of September 16, 2026) and its Data Processing Addendum (updated July 2, 2026) on October 20, 2026.
What do Pipedrive’s terms say about HIPAA?
Section 7.3 of the Pipedrive Terms of Service, “Sensitive Information and Unlawful Client Data,” contains two sentences that settle the question:
“Client acknowledges that the Pipedrive Services have not been designed to process or manage Sensitive Information and accordingly Client agrees not to use the Pipedrive Services to collect, store, manage or process Sensitive Information.”
“Pipedrive Services are not designed to comply with industry-specific regulations such as the Health Insurance Portability and Accountability Act (HIPAA) or the Federal Information Security Management Act (FISMA). It is Client’s sole responsibility to ensure that Client’s use of the Pipedrive Services including features such as call recording and AI Functionality is in compliance with all applicable laws…”
The definitions section says Sensitive Information includes “health and genetic data,” along with identifiers such as Social Security numbers, financial data such as card and bank details, information about children, biometric data and other categories treated as special under GDPR.
So the restriction is broader than HIPAA. Even a business that is not a HIPAA covered entity, such as a wellness coach or a gym, agrees not to put members’ health information into Pipedrive.
Does Pipedrive sign a Business Associate Agreement?
We found no BAA on Pipedrive’s website. Its legal documents list the Terms of Service, Supplemental Terms, an Acceptable Use Policy, a Privacy Notice and a Data Processing Addendum. The DPA is written for privacy laws such as GDPR and the UK and Brazil transfer rules, not HIPAA.
Under HIPAA, a covered entity (a provider, health plan or clearinghouse) can only let a vendor store or process protected health information if the vendor signs a Business Associate Agreement. With no BAA and terms that forbid health data, there is no compliant way to put PHI in Pipedrive. HHS explains who counts as a covered entity and a business associate in its HIPAA guidance for professionals.
Is Pipedrive secure, even if it is not HIPAA compliant?
Yes, by the usual measures. Pipedrive’s Data Processing Addendum lists:
| Control | What the DPA says |
|---|---|
| Certification | ISO/IEC 27001:2013 for its information security management program, and ISO/IEC 27701:2019 for privacy |
| Independent audits | External audits against the AICPA Trust Services Criteria (security, availability, confidentiality, privacy) |
| Encryption at rest | AES-256 |
| Encryption in transit | Transport Layer Security with HTTP Strict Transport Security |
That is a good security baseline. It does not make Pipedrive HIPAA compliant, because HIPAA compliance for a vendor depends on the signed BAA and on the vendor accepting PHI, and Pipedrive’s terms say it does not.
Who can still use Pipedrive in healthcare?
The test is simple: will any record identify a patient together with their health, care or payment for care? If not, Pipedrive can work.
| Use case | Patient or health data in the CRM? | Pipedrive fit |
|---|---|---|
| Medical device or software company selling to clinics | No: clinic staff and purchasing contacts | Fits |
| Healthcare staffing agency tracking hospital clients | No for client deals; candidate health checks must stay out | Fits with a clear field policy |
| Practice tracking referral partners and vendors | No, if notes never mention patients | Fits |
| Clinic, med spa or dental office following up with patients | Yes: patients, appointments, treatments | Does not fit |
| Wellness, fitness or coaching business logging client health goals | Yes: health data under Pipedrive's terms, even without HIPAA | Does not fit |
If you keep Pipedrive for B2B work, write the rule down for your team: no patient names, no clinical notes, no screenshots or attachments from patient systems, and no call recordings of patient conversations. The terms specifically mention call recording and AI features as areas where compliance is your responsibility.
What should a healthcare team use instead of Pipedrive?
Pick a CRM that signs a BAA on the plan you will actually buy, then configure it the way the BAA requires. Two we have documented in detail:
- monday.com: HIPAA is available on the Enterprise tier (listed as Ultimate on the monday CRM pricing page) after an admin accepts monday’s BAA and activates HIPAA. Third-party integrations fall outside the BAA. Details in is monday.com HIPAA compliant.
- GoHighLevel: HIPAA requires HighLevel’s paid HIPAA add-on, the BAA, and turning HIPAA on in each sub-account. Details in is GoHighLevel HIPAA compliant.
For larger providers and multi-location groups, Salesforce and Dynamics 365 are the usual shortlist; our healthcare CRM guide covers where the CRM should stop and the EHR should take over. Whichever vendor you choose, ask for the BAA, the list of features it covers, and whether integrations are excluded, all in writing.
Moving off Pipedrive because of HIPAA
If patient data has already gone into Pipedrive, treat it as an incident for your compliance lead to assess, then plan the move: export, decide which records belong in the new system, and delete the rest from Pipedrive. Our Pipedrive guide and CRM migration guide cover export and field mapping, and the Pipedrive team can scope a move on a free call.
Sources
- Pipedrive, Terms of Service, current as of September 16, 2026 (definitions; section 7.3), read October 20, 2026.
- Pipedrive, Data Processing Addendum, last updated July 2, 2026, read October 20, 2026.
- U.S. Department of Health and Human Services, HIPAA for professionals.