Salesforce Journey Builder is a feature of Salesforce’s Marketing Cloud that helps organizations create and manage personalized customer journeys across multiple channels.

With Salesforce Journey Builder, organizations can design and automate customer interactions, track engagement, and gain insights into customer behavior, enhancing their marketing strategies and improving customer experiences.

Is Salesforce Journey Builder HIPAA compliant? Yes, based on our research, Salesforce Journey Builder can be HIPAA compliant.

 

What changed this year?

As of September 2026, Salesforce's documentation continues to identify Journey Builder as part of Marketing Cloud Engagement, a service included in Salesforce's HIPAA Covered Services. The current documentation also outlines requirements for customers using HIPAA-covered services, including signing a business associate agreement (BAA) and complying with applicable service restrictions.

 

Will Salesforce Journey Builder sign a business associate agreement (BAA)?

Yes, Salesforce will sign a business associate agreement for Salesforce’s Marketing Cloud, which can be reviewed here.

 

What does the Salesforce Journey Builder BAA cover?

The Salesforce BAA covers the use and disclosure of protected health information (PHI), stating, “For Customer’s use of a HIPAA Covered Service to be covered by the BAA: (1) Customer and Salesforce must sign a BAA that includes the HIPAA Covered Service; and (2) Customer must comply with the terms of the BAA and this article…”

Their BAA includes:

  • Protection of PHI: Customers must use HIPAA Covered Services consistently with Salesforce's applicable policies.
  • Encryption: Customers are responsible for secure transmission of PHI and must encrypt PHI transmitted using HIPAA Covered Services and, to the extent within their control, stored in those services.
  • Contractual compliance: The customer and Salesforce must sign a BAA that includes the relevant HIPAA Covered Service.

 

What does the Salesforce Journey Builder BAA exclude?

Salesforce's BAA coverage is conditional. Customers must ensure that their use of PHI complies with Salesforce's applicable policies, the BAA, and the service-specific requirements. Coverage of a Salesforce service does not, by itself, infer that every configuration, integration, or marketing activity is HIPAA compliant.

More specifically, healthcare organizations should verify their intended Journey Builder use case, data flows, integrations, and security configuration against the applicable contractual terms before processing PHI.

 

Conclusion

Salesforce Journey Builder can be HIPAA compliant when used within Salesforce's HIPAA Covered Services and in accordance with the applicable BAA, service restrictions, and customer responsibilities.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a business associate agreement?

A business associate agreement (BAA) is a legally binding contract establishing a relationship between a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and its business associates. The purpose of this agreement is to ensure the proper protection of personal health information (PHI) as required by HIPAA regulations.

 

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting the privacy and security of certain health information, known as protected health information (PHI).

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.