Conditional (checked 2026-10-19) HubSpot offers a business associate agreement on Enterprise tiers through its Sensitive Data feature. Free tools, Starter and Professional are not covered. The main exclusion is a set of features where Sensitive Data properties are unavailable, so PHI has to stay out of them.
HubSpot's status depends on the plan, on the signed agreement and on how the account is configured. It is not a property of the product. This page reports HubSpot's published terms and is neither legal advice nor an audit. See all vendor HIPAA checks for other tools. Disclosure: this directory is published by Chanty, Inc., which has no relation to this check.
Short answer
HubSpot's business associate agreement (BAA) is Annex I of its Sensitive Data Terms. A Super Admin accepts it in the app, and it applies to data stored in Sensitive Data properties on eligible Enterprise tiers.
Sensitive Data properties are unavailable in personalization tokens, sandboxes, chatbots, playbooks and the Snowflake data share. A clinic cannot use them in a "Hi {first name}, your {procedure} is due" email token, for example.
For pricing context, Enterprise starts at $150 per seat per month (Sales Hub or Service Hub Enterprise) plus a one-time $3,500 onboarding fee.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Marketing Hub Enterprise | Yes | Super Admin accepts the Sensitive Data Terms and BAA in-app | Not published by the vendor |
| Sales Hub Enterprise | Yes | Same | Not published by the vendor |
| Service Hub Enterprise | Yes | Same | Not published by the vendor |
| Data Hub Enterprise | Yes | Same | Not published by the vendor |
| Content Hub Enterprise | Yes | Same | Not published by the vendor |
| Smart CRM Enterprise | Yes | Same | Not published by the vendor |
| Revenue Hub Enterprise | Yes | Same | Not published by the vendor |
| Free tools | No | Not available | Not applicable |
| Starter (any hub) | No | Not available | Not applicable |
| Professional (any hub) | No | Not available | Not applicable |
The acceptance process:
- A Super Admin opens Settings > Security > Sensitive Data and enables the feature.
- They tick Health/Medical Data and the checkbox stating the organization is a HIPAA covered entity or business associate.
- They accept the terms and the BAA.
- Enterprise customers can get a PDF copy of the BAA.
Minimum seats: Not published by the vendor.
What the BAA covers and what it excludes
Covered:
- Sensitive and Highly Sensitive Data properties marked as PHI on contacts, companies, deals, tickets and custom objects.
- Features marked as Covered Services in HubSpot's Product & Services Catalog.
Excluded, where Sensitive Data properties are unavailable:
- Personalization tokens
- Sandboxes
- Chatbots
- Playbooks
- The Snowflake data share
- Calculation, rollup and property sync properties
- HubSpot user properties
- Service Hub QA score and Customer experience score
Prohibited data: biometric data, and financial data used for directly processing payments. A practice should not store card details or fingerprint templates in HubSpot, even on an eligible tier.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Yes |
| Data residency | Regional data centers in the US, EU, Canada and Australia |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Data residency: regional data centers in the US, EU, Canada and Australia.
How to use HubSpot with PHI
- Use an eligible Enterprise tier. Free, Starter and Professional have no BAA, so a form-fed contact list on those plans cannot hold PHI.
- Have a Super Admin accept the BAA before any PHI is loaded or imported.
- Store PHI only in properties marked Sensitive Data. Free-text notes, standard properties and unmarked custom fields are outside that coverage.
- Keep PHI out of the excluded features: personalization tokens, sandboxes, chatbots, playbooks and the Snowflake data share. Check that a sandbox is never seeded with a production export.
- Configure SSO and access controls so only the people who need Sensitive Data properties can see them. Remove access when staff leave.
- Review every connected integration. Data sent out of HubSpot is not covered by HubSpot's BAA. Automation tools need their own agreement, as in Is Zapier HIPAA compliant?.
- Train staff on the prohibited data types and on where PHI may and may not be entered. Use the HIPAA guides for policy templates and background.
Compliance depends on the signed BAA, your configuration and your policies, not on the product alone.
Alternatives with a BAA
These tools have a conditional verdict in the directory:
- ActiveCampaign: conditional, Enterprise
- Constant Contact: conditional, all plans on request
- GoHighLevel: conditional, with the HIPAA Compliance add-on
- monday.com: conditional, Enterprise work management
- Piwik PRO: conditional, Enterprise
Conditions differ by vendor, so read each check before relying on it. Browse HIPAA-compliant software by category for CRM and marketing tables.
Sources
- Store Sensitive Data in HubSpot — Help article, checked 2026-10-19. "To store HIPAA-covered data, you must select both the Health/Medical Data checkbox and the We are a HIPAA-covered entity or business associate checkbox."
- HubSpot Sensitive Data Terms — Terms, checked 2026-10-19. "This Business Associate Agreement (“BAA”) is made part of the agreement between HubSpot, Inc. and Customer"
- HubSpot Business Associate Agreement (PDF copy) — BAA page, checked 2026-10-19. "For Enterprise Customers that would like to receive a pdf copy of the HubSpot Business Associate Agreement (BAA), we have made this copy available to you for your convenience. The HubSpot BAA is included in the HubSpot Sensitive Data Terms available at https://legal.hubspot.com/sensitive-data-terms as Annex I."
- Sensitive Data Management for CRM | HubSpot — Vendor page, checked 2026-10-19. "The HubSpot BAA is included by reference in the Sensitive Data Terms"
- Security and Compliance | HubSpot — Trust center, checked 2026-10-19. "HubSpot supports SAML-based SSO with major identity providers including Okta, Azure AD, and OneLogin."
- Sales Hub Pricing | HubSpot — Pricing page, checked 2026-10-19. "$150/mo/seat"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Is HubSpot CRM HIPAA compliant?
Conditionally. HubSpot offers a BAA on Enterprise tiers for Covered Services and for data in Sensitive Data properties. A CRM on Free, Starter or Professional has no BAA and should not hold PHI. Even on Enterprise, compliance depends on the signed BAA, your configuration and your policies.
Does HubSpot sign a BAA on Starter or Professional plans?
No. The BAA is part of the Sensitive Data Terms for Enterprise tiers. Free tools, Starter and Professional are not covered.
How do I get the HubSpot BAA?
A Super Admin enables Sensitive Data in Settings > Security > Sensitive Data. They tick Health/Medical Data and the HIPAA-covered entity or business associate checkbox, then accept the terms and BAA. Enterprise customers can get a PDF copy. Any extra cost or minimum seat count is Not published by the vendor.
Can I use chatbots, personalization tokens or sandboxes with PHI in HubSpot?
No. Sensitive Data properties are unavailable in chatbots, personalization tokens, sandboxes, playbooks and the Snowflake data share, so PHI should not be used there. Calculation, rollup and property sync properties, HubSpot user properties, and the Service Hub QA score and Customer experience score are also excluded.