Is HubSpot HIPAA compliant?
CRM, marketing and service platform. HubSpot's BAA is accepted in the account's Sensitive Data settings, available with Enterprise subscriptions.
HubSpot signs a Business Associate Agreement only under specific conditions. Sensitive Data is available with Enterprise subscriptions; a Super Admin turns it on in Settings > Security > Sensitive Data, ticks Health/Medical Data and "We are a HIPAA-covered entity or business associate", and accepts the Sensitive Data Terms and the BAA.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: HubSpot Knowledge Base — Store sensitive data in HubSpot · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
| Signs a BAA | Conditional | HubSpot Knowledge Base — Store sensitive data in HubSpot |
|---|---|---|
| Plans that include a BAA | Enterprise subscriptions (Marketing, Sales, Service, Data and Content Hub, Smart CRM) | HubSpot Knowledge Base — Store sensitive data in HubSpot |
What you still have to configure
- Create PHI fields as Sensitive Data properties and answer "Yes, this data contains Protected Health Information (PHI)". source
Limitations
- Sensitive Data properties can't be used in personalization tokens, sandboxes, chatbots or playbooks, and Sensitive Data settings can't be switched off once on. source
- Do not store PHI files in HubSpot's Files tool. After Sensitive Data is on, only attachments uploaded through the supported routes — a record's Attachments section, notes, emails from a contact, the mobile app, file properties, forms and imports — get the extra encryption; existing uploads do not gain it automatically. HubSpot doesn't restrict an attachment URL shared with another signed-in user of your account, so don't share those URLs with users who shouldn't see the file. source
- Turning on Sensitive Data does not authorize PHI in every Breeze AI feature: HubSpot asks you not to put sensitive information in Breeze prompts and configured inputs. Accounts with Sensitive Data are automatically opted out of HubSpot AI model training. Check the permitted scope of a specific AI feature before using it with PHI. source
Against our criteria
| BAA without a sales process | Yes — Accepted in account settings by a Super Admin. | HubSpot Knowledge Base — Store sensitive data in HubSpot |
|---|---|---|
| BAA on entry-level team plans | No — Enterprise subscriptions only. | HubSpot Knowledge Base — Store sensitive data in HubSpot |
Alternatives
- Microsoft Dynamics 365 →BAA: yes
- Pipedrive →BAA: no
- Salesforce →BAA: conditional
- Zoho CRM →BAA: conditional