Is HubSpot HIPAA Compliant? Healthcare Guide | CRO:NYX

Healthcare teams rely on HubSpot to manage inquiries, automate follow-ups, and track results. But when patient information, referrals, and intake details involve protected health information (PHI), HIPAA compliance becomes a critical consideration.

So, is HubSpot HIPAA compliant? It can be, when properly configured. HubSpot supports HIPAA compliance on Enterprise plans with Sensitive Data enabled and a Business Associate Agreement (BAA) in place. However, compliance isn't automatic.

As a HubSpot Diamond Partner, we help healthcare providers, treatment organizations and health tech companies implement, set up and manage their HubSpot portals. In this guide, we'll explain how HubSpot supports HIPAA compliance, what data belongs in your CRM versus your EHR, and how to configure your portal properly.

Key takeaways

• HubSpot supports HIPAA compliance for Enterprise customers who turn on Sensitive Data, identify as a HIPAA covered entity or business associate, and accept HubSpot's Business Associate Agreement (BAA).
• Compliance is shared. HubSpot provides the controls, but how you configure, connect and govern your portal decides whether you're compliant.
• PHI belongs only in Sensitive Data properties and protected attachments, never in standard fields, notes you haven't planned for, or the files tool.
• HubSpot's BAA covers HubSpot only. Every connected tool that touches PHI needs its own BAA.
• HIPAA is a US law. If you operate in Canada, the UK, the EU, Australia or the Cayman Islands, different privacy laws apply, and your data center choice matters from day one.

Is HubSpot HIPAA compliant?

Yes, conditionally. No software is "HIPAA compliant" on its own, and there's no official HIPAA certification for a platform. What HubSpot offers is the ability to support a HIPAA-compliant setup when three things are true at the same time:

1. You're on an Enterprise subscription. Sensitive Data is available on Enterprise editions of Marketing, Sales, Service, Content, Data, Revenue Hub and Smart CRM.
2. Sensitive Data is turned on and HIPAA is selected. In your security settings, you choose Health/Medical Data and confirm you're a HIPAA covered entity or business associate.
3. You've accepted HubSpot's BAA. It's included as Annex I of HubSpot's Sensitive Data Terms and applies when you store PHI subject to HIPAA.

If any of these requirements is missing, storing PHI in your portal could create significant compliance risks.

Even with all three in place, HubSpot's terms are clear that you're responsible for deciding whether your use meets your compliance obligations. For covered entities, HubSpot acts as a business associate under the BAA, but your organization remains responsible for meeting its HIPAA obligations. That's why setup and governance matter as much as the license.

HubSpot Sensitive Data: what it protects and where it stops

Sensitive Data is the feature set that makes HIPAA possible in HubSpot. Knowing what it covers, and what it doesn't, is the difference between a compliant portal and a false sense of security.

What you get

• Sensitive and Highly Sensitive Data properties. Custom properties built to hold regulated data. Highly Sensitive values require users to click to decrypt before viewing or editing.
• Field-level permissions. Super Admins can restrict who can view or edit each sensitive property, so only the right teams see PHI.
• Audit logs. Super Admins can review user actions on sensitive property values.
• Protected attachments. Files uploaded to records, notes, file properties, forms and imports after Sensitive Data is on get an extra layer of encryption and can't be shared externally without login.
• Secure forms. HubSpot and non-HubSpot forms can collect sensitive data, which is encrypted and synced into the CRM.
• Limited HubSpot employee access. HubSpot support staff can't view sensitive property values or protected attachments.
• No AI training. Accounts with Sensitive Data on are automatically opted out of HubSpot AI model training.

Where it stops

This is the part most guides skip, and where we see the most mistakes:

• Some tools don't support Sensitive Data at all, including chatbots, personalization tokens, playbooks and sandboxes.
• The files tool is never protected. Extra protection depends on where a file is stored. Files on records, notes, file properties and forms are covered; anything uploaded to the files tool, or attached from it, uses standard security, even after Sensitive Data is on. PHI should never live there.
• Timing matters too. Even in a covered location, only files uploaded after Sensitive Data is turned on get the extra protection. Files uploaded before then keep standard security, so re-upload any that contain PHI.
• Workflows have limits. You can use sensitive properties in filter-based enrollment and branches, but not in copy property actions, personalization tokens or event-based triggers on sensitive values.
• Breeze AI won't use sensitive values, and HubSpot advises against putting sensitive information into AI prompts.
• Default properties can't be converted. PHI needs new custom sensitive properties, not existing fields like notes or lifecycle stage.
• Your data center is locked. Once you indicate you store HIPAA data, your account can't migrate to another HubSpot data center.

None of these are dealbreakers. They're design constraints. The best healthcare portals are built around them from the start rather than discovering them after launch.

What to store in HubSpot, and what to leave in your EHR

The safest HubSpot portal is the one that holds only the PHI it actually needs. HubSpot is built to manage relationships, follow-up and reporting. Your EHR or practice management system is built to hold the clinical record. Keep them in their lanes.

A good rule: if marketing, admissions or business development doesn't need it to do their job, consider keeping it outside HubSpot

Two cautions catch teams out:

• Context can make ordinary data PHI. An email address on its own is just contact data. The same email tied to "inquired about our outpatient program" is health information about an identifiable person.
• Free text is the leak. Notes, call logs, email threads, meeting notes and task descriptions are where PHI slips in without anyone planning it. Set clear rules and train your team on what they can and can't type into these fields.

How to set up HubSpot for HIPAA compliance, step by step

Here's the process we recommend for healthcare organizations. The order matters, especially when making decisions about data residency and sensitive information

1. Map your data first. List every place PHI enters, lives and leaves: forms, calls, emails, referrals, integrations, imports. Decide what HubSpot actually needs and what stays in the EHR. This becomes the blueprint for everything else.
2. Confirm your data center. Before you flag HIPAA data, make sure your portal is hosted where it needs to be. Once HIPAA is indicated, you can't move it.
3. Ensure you have Enterprise. Sensitive Data is only available on Enterprise subscriptions.
4. Turn on Sensitive Data and accept the BAA. Select Health/Medical Data, confirm your HIPAA status, and accept the Sensitive Data Terms and BAA.
5. Build sensitive properties. Create new custom Sensitive or Highly Sensitive properties for each PHI field, and mark those that contain PHI. Don't repurpose existing fields.
6. Lock down access. Set field-level permissions on every sensitive property, limit who can access workflows, and require two-factor authentication for all users.
7. Clean up what's already there. Move any PHI out of standard properties, notes and the files tool. Re-upload any older sensitive files so they get the newer protection.
8. Rebuild forms and automations. Point forms at sensitive properties, and review every workflow, notification and email so PHI never appears in a personalization token, subject line or alert.
9. Review every integration. Confirm each connected app has its own BAA (more on this below) and only receives the minimum data it needs.
10. Train your team and write it down. Document what goes where, who can access what, and what to do if PHI ends up in the wrong place. Then review access and audit logs on a regular schedule.

Already on HubSpot? How a partner helps you fix it without breaking things

Retrofitting a live portal is harder than starting fresh. Your existing properties feed workflows, lists, reports, forms and integrations your team relies on every day. Change one field the wrong way and lead routing stops, a dashboard goes blank, or an integration quietly fails. Turning on Sensitive Data also changes how parts of HubSpot behave. For example, some notifications stop showing previews, and accounts that share data with other portals through multi-account management can no longer act as the source.

Here's how we approach it as a HubSpot partner:

1. Audit what you have. We find where PHI already lives across properties, notes, call logs, email threads, attachments, the files tool, forms and connected apps. You get a clear picture of your current exposure before anything changes.
2. Map the dependencies. For every field that needs to move, we trace what uses it: workflows, lists, reports, forms, sequences, templates and integrations. This is the step that prevents things from breaking.
3. Build a risk-ranked plan. The highest-risk exposure gets fixed first. We also confirm your data center before HIPAA is flagged, since that choice can't be reversed.
4. Test before it goes live. HubSpot sandboxes don't support Sensitive Data, so we plan and test structural changes in a sandbox first, then roll out in production in controlled stages using test records.
5. Move the data carefully. We create the new sensitive properties, migrate values, repoint every workflow, form and report to the new fields, and only retire the old fields once everything is verified.
6. Clean up legacy PHI. We remove PHI from places it shouldn't be, move documents out of the files tool, and re-upload older sensitive attachments so they get the newer protection.
7. Rework integrations. We confirm BAAs (or DPAs outside the US), tighten field mappings and sync direction, and remove anything that sends PHI where it doesn't need to go.
8. Roll out with your team, not around them. Changes happen in planned windows, permissions are updated, and your team is trained on what's changed and why.
9. Document and hand over. You get a record of how your portal is configured, who can access what, and what to review going forward. Your compliance and security team will want this.

The goal is to create a more secure, compliance-ready HubSpot environment while minimizing disruption to your existing workflows.

HubSpot integrations, AI and website tracking: where HIPAA compliance usually breaks

In our experience, the HubSpot portal itself is rarely the problem. The risk lives in what's connected to it.

The BAA chain

HubSpot's BAA covers HubSpot. That's it. HubSpot's terms state that data processed by third-party products is handled under those third parties' own policies. So every tool that sends PHI to HubSpot, or receives it, is part of your compliance chain and needs its own BAA. Common examples:

• Scheduling and booking tools
• Call tracking and phone systems
• Form builders and intake tools
• Middleware and sync tools
• Data enrichment, analytics and reporting tools
• Your EHR integration

Apply least privilege to integrations the same way you do to people. Only sync the fields a tool truly needs, avoid two-way sync unless there's a reason for it, and audit app permissions regularly.

EHR integrations

Connecting HubSpot to your EHR can close the loop between an inquiry and an admission or appointment. Done well, HubSpot receives a status or milestone ("admitted", "appointment booked") rather than the clinical detail. That gives marketing and growth teams the reporting they want without pulling the clinical record into the CRM.

AI with sensitive data

AI is where healthcare teams feel the most tension. They want the efficiency, but they're worried about privacy. With Sensitive Data on, Breeze won't use sensitive property values, and AI training is switched off. Before using external AI tools to process PHI, confirm that appropriate agreements, security safeguards, data retention policies and review procedures are in place. The answer isn't to avoid AI. It's to decide deliberately what data it can reach.

Website tracking

Tracking pixels and analytics on healthcare websites deserve their own review. US regulators have issued guidance on tracking technologies on healthcare sites, and while a federal court set part of it aside in 2024, the risk hasn't gone away. Look carefully at tracking on patient portals, appointment pages, symptom or condition pages, and intake forms, and decide what HubSpot tracking code and ad pixels should and shouldn't run there.

Beyond HIPAA: HubSpot data residency and privacy laws in other countries

HIPAA only applies to US covered entities and their business associates. If you serve patients or customers in other countries, or plan to expand, different rules apply, and a HIPAA-only setup won't cover you.

The good news is that HubSpot's Sensitive Data isn't a US-only feature. Its terms apply to information considered sensitive under applicable law, and you can store sensitive data in any HubSpot data center you use. HubSpot currently hosts data in the United States, Europe, Canada and Australia. What changes by region is the agreement and the law.

What this means in practice:

• Outside the US, there's no BAA. The equivalent is HubSpot's Data Processing Agreement, plus your own assessment of whether your setup meets local law.
• Check HubSpot's permitted data types. HubSpot only allows certain types of sensitive data, listed in its Product & Services Catalog. Anything outside that list is prohibited, so confirm what you plan to store against it.
• Pick your data center before you start. This matters most for organizations that operate across borders. If you flag HIPAA data, your portal can't move later.
• Treatment organizations need extra care. In the US, substance use treatment records fall under 42 CFR Part 2, which has stricter rules on consent and redisclosure than HIPAA.
• Design for the strictest rule you're subject to. If you serve patients in more than one country, build your portal to the highest standard that applies, not just HIPAA.

Privacy law varies by country, province and state, and it changes. Always confirm your obligations with qualified legal counsel in each market you operate in.

How to choose a HubSpot partner for healthcare

Configuring HubSpot for sensitive data is a series of decisions: which properties are flagged, who gets access, what leaves the portal through an integration, and how it's all documented. Those decisions are your compliance posture. When you're choosing a partner, ask:

• Will you sign a BAA (or DPA outside the US)? Any partner with access to a portal that holds PHI is a business associate.
• Who on your team will access our data, and from where? You should get a clear answer on access controls and cross-border access.
• How will you document our setup? Your compliance or security team will want a record of how the portal is configured and why.
• Have you worked across regions? If you operate outside the US, your partner should understand more than HIPAA.

Get HubSpot working for your healthcare team, the right way

As a HubSpot Diamond Partner, we help healthcare organizations get the most out of HubSpot for healthcare while handling sensitive data properly. That includes inquiry and referral workflows, CRM cleanup, EHR and system integrations, automation and reporting, all built on a compliance-first setup for the regions you operate in.

Not sure where your current portal stands? Start with a HubSpot sensitive data readiness review. We'll map where PHI lives today, flag gaps in your setup and integrations, and give you a clear plan to fix them.

Frequently asked questions

Is HubSpot a HIPAA compliant CRM?

HubSpot can support HIPAA compliance for Enterprise customers who turn on Sensitive Data, confirm their HIPAA status and accept HubSpot's BAA. Compliance also depends on how the portal, integrations and team processes are set up.

Is HubSpot automatically HIPAA compliant on an Enterprise plan?

No. Enterprise is required, but you also need to turn on Sensitive Data, confirm your HIPAA status, accept the BAA, and configure your portal and integrations correctly.

Does HubSpot sign a BAA?

Yes. HubSpot's BAA is part of its Sensitive Data Terms and applies when you store PHI subject to HIPAA. It's accepted in your account settings when you turn on Sensitive Data.

Can we use HubSpot forms to collect patient information?

Yes, as long as Sensitive Data is on and the form fields map to sensitive properties. Collect only what you need, and keep clinical detail in your EHR.

Can we still use personalization and automation?

Yes, with limits. Workflows can use sensitive properties for enrollment filters and branches, but sensitive values can't appear in personalization tokens or be copied between properties. Most healthcare automation runs on non-sensitive data like lifecycle stage, program interest category or engagement.

Can we use HubSpot's AI tools?

Breeze can be used in accounts with Sensitive Data on, but it won't use sensitive property values, and you shouldn't enter sensitive information into prompts. Outside AI tools that touch PHI need their own BAA.

What happens if PHI ends up in the wrong place?

Treat it as an incident. Move or remove the data, check who could access it, and follow your incident response process. Then fix the cause, which is usually a field, form or habit, not the platform.

We're not in the US. Does HIPAA apply to us?

Usually not, unless you're a business associate of a US covered entity. Your local privacy laws apply instead, such as PIPEDA or PHIPA in Canada, GDPR in the EU and UK, the Privacy Act in Australia or the Data Protection Act in the Cayman Islands. HubSpot's Sensitive Data and regional data centers can support those requirements under its Data Processing Agreement.

Can we move our HubSpot data to another region later?

Only if you haven't flagged HIPAA data. Once you indicate you store HIPAA data, your account can't migrate to another data center, so decide on hosting first.

This article is for general information and isn't legal advice. Confirm your obligations with qualified legal counsel.