Is HubSpot HIPAA compliant? Only inside the edges of its BAA

By Edward Pinela · Founder, Lightray AI · 6 October 2026

Partly. HubSpot will sign the agreement HIPAA requires, but only on its Enterprise tier, and only for some of its tools. Contact records, email and forms can sit inside it; chat transcripts, call recordings and meeting notes sit outside it. For a practice, the real work is keeping patient information on the right side of that line.

This is general information to help you ask better questions, not legal advice. Vendor terms change, so the agreement you sign is the source of truth for what is covered, and the person who should sign off is your compliance officer or healthcare counsel.

What does a HubSpot BAA actually cover?

A defined list of tools on an Enterprise account, not the whole platform. The CRM's contact records, marketing email and forms can hold patient information once the agreement is signed and the account is set up as it requires. Chat transcripts, call recordings and meeting notes are excluded, so patient details must never reach them.

Two terms carry the rest of this page. Protected health information (PHI) is health information that identifies a patient — a name next to an appointment reason is enough. A business associate agreement (BAA) is the contract HIPAA requires between a healthcare organisation and any vendor that creates, receives, stores or transmits PHI on its behalf; the HHS guidance on business associates (opens in new window) sets out what it has to contain.

Why do the plan and the tool both matter?

Because a BAA is a contract about specific services, not a badge on the brand. If your account is on Starter or Professional, there is no agreement at all, and no PHI should go in. On Enterprise, the agreement reaches only the tools it names; everything else in the same login is an uncovered service as far as HIPAA is concerned.

That is easy to lose sight of inside one product. A receptionist does not think of the chat inbox and the contact record as different vendors' worth of risk — they are tabs in the same screen. Under the agreement they are not equivalent, and the account has to be set up, and staff trained, so that the difference holds in daily use.

How do you get HubSpot to sign a BAA?

Move to an Enterprise tier first; Starter and Professional accounts cannot sign one. A super admin then opens Settings › Security › Sensitive Data, turns it on, ticks Health/Medical Data, confirms the account is a covered entity or business associate, and accepts HubSpot's Sensitive Data Terms and BAA in the app. The tool limits below still apply.

Which HubSpot tools can hold patient data?

The table sorts the tools a practice is most likely to use. Treat it as a starting map, then check each row against the covered-services list in the agreement you actually sign — that list, not this page or any sales conversation, decides what is in scope.

The chat row is the one that catches practices out. A website chat widget feels like a sales tool, but a prospective patient will happily type their symptoms into it. Once they do, that PHI is sitting in a tool outside the agreement, whatever your intentions were when you switched chat on.

What does this mean for a practice already on HubSpot?

You can manage patient contacts in HubSpot, but you cannot treat it as a clinical record. On Enterprise with a signed BAA, names, contact details and form submissions can live in the CRM and drive covered email. Consultation notes, recorded calls and chat conversations about care cannot, and they belong in your EHR instead.

In practice that means a short list of changes. Decide which properties may hold health information and restrict who sees them. Switch off call recording for patient-facing lines. Put a plain notice in the chat widget asking people not to share medical details, and hand clinical questions to staff on a covered channel. Then list every connected app, because each one that reads contact records needs its own agreement.

If you find patient information has already gone somewhere it should not — a chat transcript, a recorded call, an uncovered integration — do not quietly delete it. Whether that needs assessing as a potential breach is a question for your compliance officer, and the records are the evidence they will need to answer it.

When is a HIPAA-native platform the better choice?

When the work you most need to automate lives in the tools HubSpot excludes. If patient conversations happen over chat, if you rely on recorded calls, or if staff need to log what was discussed, a platform whose agreement covers those channels — or a dedicated healthcare CRM — fits the practice instead of fighting it.

GoHighLevel is one option, but only with its HIPAA add-on enabled, a signed agreement and careful configuration; our guide to GoHighLevel and HIPAA explains what that covers and where it stops. For the wider feature and cost-of-ownership trade-off between the two, see HubSpot vs GoHighLevel. A dedicated healthcare CRM narrows the choice further but is usually built around clinical workflows from the start. Whichever you pick, get the agreement in writing, naming the product and plan you will use, before any PHI goes in.

What we build, and what we do not claim

There is no government HIPAA certification for software or consultants, and we hold none. What we do is map where patient data enters and moves through your HubSpot account, separate the covered tools from the excluded ones, rebuild the workflows that cross the line, and hand over documentation your compliance officer can review. They decide what is acceptable; we build to that decision.

Where to go next

For HubSpot workflows, integrations and clean-up work, the HubSpot automation consultant page covers what we do. And for the clinical side of automation — referrals, prior authorisation and claims admin under a BAA — see AI automation for healthcare practices.

Common questions about HubSpot and patient data