HubSpot
CRM
CRM, forms and a tracking code. HIPAA use needs an Enterprise subscription with Sensitive Data turned on and the BAA accepted.
CRM
Salesforce Health Cloud and your treatment center website
Healthcare CRM on the Salesforce platform. Web-to-Lead turns a website form into leads; the BAA covers named services only.
- Read against the vendor's own pages
- BAA on specific plans
- Checked October 15, 2026
What it is
Salesforce's CRM for healthcare organizations, used to manage patient and referral relationships and care workflows on the Salesforce platform.
How it connects to a website
- Form posting
Salesforce's Web-to-Lead generates HTML form code for your website that creates lead records in Salesforce.
- Published API
Salesforce's Health Cloud page describes FHIR APIs and pre-built integrations.
What KhanWork does with it
- Connect the website form to Salesforce, either with Web-to-Lead for simple lead capture or through your form tool's Salesforce integration.
- Pass the campaign source into hidden fields so every lead shows where it came from, without adding health questions to the website form.
- Work alongside your Salesforce admin, who owns objects, permissions and the BAA scope.
Setup, as the vendor documents it
- In Salesforce Setup, search for Web-to-Lead, turn it on and choose the default lead creator.
- Create the Web-to-Lead form: pick the fields, set the thank-you URL and, ideally, turn on reCAPTCHA.
- Generate the HTML and place it on the website form, then send a test submission and confirm the lead arrives.
Source: Salesforce Help, Generate Leads from Your Website with Web-to-Lead. Menus and labels change; follow what you see in your account.
What to watch out for
Where patient details can slip out with Salesforce Health Cloud, and what the vendor's own documents say to switch on, switch off or ask for.
Coverage is per service
Salesforce's BAA restrictions page says a service is covered only when you and Salesforce sign a BAA that includes it. Confirm that every service your lead records touch is named.
Transmission security is on you
The same page makes the customer responsible for the secure transmission of PHI to and from the covered services. Serve the form over HTTPS and keep it to contact basics.
Some features are carved out
Salesforce lists exclusions, such as Einstein features in Marketing Cloud Next and the Discover feature in Lightning Platform, and leaves third-party telephony and AI providers to the customer. Check before switching anything on for PHI.
Spam eats the Web-to-Lead allowance
Salesforce Help describes a daily limit on Web-to-Lead submissions. Turn reCAPTCHA on so bots do not use it up.
Frequently asked questions
Salesforce's Health Cloud page says it is, and Salesforce lists Health Cloud as a HIPAA Covered Service. Coverage still depends on a signed BAA that names the services you use.
Yes. Salesforce's Web-to-Lead generates form code that creates lead records. Many form tools also have their own Salesforce integrations.
Your Salesforce admin or implementation partner. We deliver the website form, its fields and the source tracking, and test that leads arrive.
Sources
- Salesforce, Health Cloud (opens in a new tab) (checked )
- Salesforce, Business Associate Addendum Restrictions (opens in a new tab) (checked )
- Salesforce Help, Generate Leads from Your Website with Web-to-Lead (opens in a new tab) (checked )
Not legal advice. This page reports what the vendor publishes. Nothing here implies a partnership with Salesforce. Confirm plans and the BAA in writing with the vendor, and let your compliance lead or counsel decide what counts as PHI in your workflows. For the terms, see BAA, PHI, HIPAA and 42 CFR Part 2 in the glossary.
