Last verified: October 2026, against HubSpot's Sensitive Data documentation and legal terms. General information, not legal advice — confirm with your compliance officer or attorney.
Is HubSpot HIPAA compliant? Only in one configuration: an Enterprise edition with HubSpot's Sensitive Data feature turned on and its business associate agreement (BAA) accepted. Most practices that use HubSpot run Starter or Professional for newsletters and landing pages, and HubSpot's documentation describes no BAA for those accounts. That's fine for marketing that never touches patient information. It isn't fine for intake or appointment requests.
Short answer from HubSpot's own documentation
Short answer (verified October 2026): HubSpot's BAA comes with Sensitive Data (opens in a new tab), and its catalog says "Customers with an Enterprise edition subscription may enable Sensitive Data." A Super Admin turns it on, ticks both the Health/Medical Data box and "We are a HIPAA-covered entity or business associate," then reads and accepts the Sensitive Data Terms and BAA (opens in a new tab). PHI may then be stored only in properties flagged as PHI, and only in tools HubSpot supports. No BAA route is documented for Starter or Professional.
The BAA is narrow by design. It covers PHI "received and maintained by HubSpot" through services HubSpot "has explicitly authorised" for PHI, and it commits HubSpot to report a breach "no later than ten (10) business days" after discovery.
Which HubSpot plans and settings the answer depends on
| Condition | What HubSpot's pages say |
|---|---|
| Edition | Sensitive Data needs the Enterprise tier of Marketing, Sales, Service, Data or Content Hub, Smart CRM or Revenue Hub |
| HIPAA scope | The product catalog (opens in a new tab) supports PHI "within Smart CRM, Marketing Hub, Sales Hub, Content Hub, and Data Hub," and says HIPAA support "is not available in all areas" |
| Who switches it on | Super Admins only |
| Declaration | Health/Medical Data plus the HIPAA covered entity or business associate checkbox |
| Property setup | Tick the PHI checkbox when you create a property; the setting can't be changed on an existing property |
| Turning it off | Categories can't be removed once selected; PHI properties must be deleted first |
| Data center | Once you've indicated HIPAA data, the account can't migrate to another data center |
Two documents disagree slightly on which hubs qualify, so get your hub, edition and data center confirmed in writing before you sign.
Forms, contacts and email: where PHI enters HubSpot
PHI is health information that identifies a person. At a medical practice, a name plus almost any health detail qualifies, because the fact that someone contacted you is itself revealing.
- Forms. A HubSpot form embedded on your website sends every submission into the CRM. Add a "reason for visit" or "which condition?" field and each submission becomes PHI. HubSpot's tools article (opens in a new tab) says sensitive data from forms "will be encrypted and synced into the CRM securely," but only when the field maps to a Sensitive Data property.
- Contacts and lists. A list called "Botox consults" or a lifecycle stage named after a procedure tells anyone with access who is a patient.
- Email. The tools article doesn't cover marketing email. It does say personalization tokens can't use Sensitive Data properties.
- Chat and AI. Sensitive Data "is not supported" in chatbots. Breeze, HubSpot's AI, works in these accounts but HubSpot advises: "Avoid using Breeze if you don't want Breeze to process your Sensitive Data."
- Files. Files uploaded to the files tool are not protected, only attachments on records.
For how a submission should travel, see HIPAA-compliant forms.
What to configure before storing patient data
- Confirm Enterprise, the hub and your data center with HubSpot, in writing.
- Have a Super Admin turn on Sensitive Data, tick Health/Medical Data and the HIPAA box, and accept the BAA. Keep a dated screenshot.
- Create new properties for PHI with the PHI checkbox ticked. Existing properties can't be converted.
- Remap every form so health questions write only to those properties. Delete questions you don't need.
- Restrict who can view and edit PHI properties, and limit workflow access for those users, as HubSpot recommends.
- Keep PHI out of chatbots, personalization tokens, the files tool and Breeze.
- Review integrations. HubSpot's terms say third-party integrations are hosted under the third party's own policies, so each one needs its own BAA. Automations are a common leak; see Zapier and PHI.
- Export the account activity history on a schedule so you can see who viewed what.
Using HubSpot for marketing without PHI
Plenty of practices use HubSpot safely without a BAA by keeping it upstream of patient care:
- Newsletters to people who opted in through a blog or event sign-up, with fields limited to name and email.
- Content workflows: blog posts, landing pages, webinar registrations, recruiting.
- Lead nurture for people who haven't become patients, without health questions.
Illustrative example: Lakeside Physical Therapy's newsletter form asks for first name, email and "Which topics interest you? Practice news / Running tips / Workplace ergonomics." No symptoms, no injury, no visit reason.
Avoid condition-based segmentation, such as a "knee replacement patients" list, unless the account is covered. Even then, HIPAA requires a patient's written authorization before PHI is used for most marketing (45 CFR 164.508(a)(3) (opens in a new tab)). The details are in HIPAA email marketing rules.
Options if your plan isn't covered
- Upgrade and configure. Enterprise plus the steps above, if HubSpot is central to how you work.
- Split the jobs. Keep HubSpot for marketing and send patient requests to a system that signs a BAA. See HIPAA-compliant CRM for what to look for.
- Compare what your agency proposes. If an agency is pitching another platform, read GoHighLevel and HIPAA first.
Medfy's base plan includes HIPAA-compliant website forms that deliver into a patient CRM and inbox. Medfy signs a BAA with your practice, and patient information is stored in separate, encrypted HIPAA databases in the US or Canada. Read how Medfy stores patient data, or start with a free marketing audit, which flags tracking pixels on your current form pages. More vendor verdicts are in HIPAA checks for marketing software.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Will HubSpot sign a BAA?
Yes, but only through its Sensitive Data feature on an Enterprise edition. A Super Admin turns on Sensitive Data, declares the account a HIPAA covered entity or business associate, and accepts the Sensitive Data Terms and BAA by checkbox. HubSpot's documentation describes no BAA route for Starter or Professional accounts. Confirm the details for your account with HubSpot and with your compliance officer or attorney.
Can we use HubSpot forms on our practice website?
Yes, for questions that carry no health information, such as a newsletter sign-up. A form asking for a reason for visit, symptoms or a condition creates PHI, so it belongs only in an Enterprise account under HubSpot's BAA, mapped to properties flagged as PHI. Otherwise, send appointment requests to a BAA-covered system instead. Check the setup with your compliance officer or attorney.
Is HubSpot email marketing HIPAA compliant?
Newsletters to people who opted in, sent without any health details, don't involve PHI. Email built on patient conditions is different: HubSpot doesn't let Sensitive Data properties fill personalization tokens, and HIPAA generally requires a patient's written authorization before PHI is used for marketing. Keep condition-based campaigns out of HubSpot unless your attorney or compliance officer has approved the setup.
Which HubSpot plan do medical practices need?
It depends on the job. For blogs, landing pages and newsletters with no patient information, any plan works. To store PHI, HubSpot requires an Enterprise edition with Sensitive Data turned on and the BAA accepted, and its catalog notes HIPAA support 'is not available in all areas.' Get the hub and data center confirmed in writing, and review the decision with your compliance officer or attorney.