Is HubSpot HIPAA‑Compliant for Healthcare Lead Forms? Read This Before You Collect PHI

Short answer: HubSpot can support HIPAA‑regulated healthcare lead capture, but only when you use eligible Enterprise features and configure them precisely for Protected Health Information (PHI). Without those safeguards, you should not collect PHI in HubSpot forms. ([hubspot.com](https://www.hubspot.com/healthcare))

As of September 2026, HubSpot provides an independent HIPAA attestation you can review as part of vendor due diligence; the platform’s role is to help you meet obligations, not to certify your organization. ([trust.hubspot.com](https://trust.hubspot.com/))

To process PHI, you must enable Sensitive Data settings, identify your HIPAA status, and accept HubSpot’s terms (including the Business Associate Agreement where applicable). ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/store-sensitive-data))

HubSpot Subscription Plans Overview

Sensitive Data capabilities that make PHI handling possible are available on Enterprise tiers across key Hubs (e.g., Marketing, Sales, Service, Data, Content, Smart CRM, and Revenue Hub). Plan for Enterprise in every Hub where PHI will live or flow so security controls and Data Encryption apply consistently. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))

If your team only needs non‑PHI lead generation, lower tiers may suffice—but the moment Healthcare Lead Capture includes PHI, scope your subscription around Enterprise access controls and logging from the start. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))

HIPAA Compliance Requirements

HIPAA compliance is a shared responsibility. You will need a signed Business Associate Agreement (BAA), a HIPAA Risk Assessment, access controls aligned to the Minimum Necessary standard, audit logging, Data Encryption in transit and at rest, incident response, and workforce training. Treat HubSpot’s documentation and reports as inputs to Compliance Validation, not a substitute for your own policies and governance.

Marketing and outreach add extra nuance: avoid using PHI in campaigns without appropriate authorization, and restrict who can see or act on PHI collected by forms. Review vendor attestations and your internal configuration evidence before go‑live.

Sensitive Data Management

Turn on Sensitive Data settings

In Settings > Security, enable Sensitive Data, choose Health/Medical Data, and indicate that you are a HIPAA covered entity or business associate. You will accept the applicable terms during this process. Note that once enabled, Sensitive Data cannot be turned off. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/store-sensitive-data))

Create PHI properties and apply Data Encryption

Create custom properties marked as Sensitive Data (or Highly Sensitive Data) and, when applicable, mark them as storing PHI. HubSpot encrypts data in transit and at rest and adds application‑layer encryption for Sensitive Data; Highly Sensitive values require click‑to‑decrypt by authorized users. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/store-sensitive-data))

Control access and audit activity

Use field‑level permissions to restrict who can view or edit PHI properties and rely on the audit log to trace user actions on those fields. Keep Super Admins limited and review access routinely. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))

Handle files and attachments safely

Attachments uploaded via records or form submissions receive extra protection and remove external file‑sharing options. Do not store PHI in the general files tool, which lacks the additional Sensitive Data protections. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))

Enterprise Plan Features

Relevant Enterprise‑grade safeguards include field‑level controls, audit logging, and encryption designed to support regulated data handling. These pair with permissions and governance settings to minimize exposure and simplify evidence gathering for audits. ([hubspot.com](https://www.hubspot.com/security-and-compliance?utm_source=openai))

When Sensitive Data is on, HubSpot further restricts AI features and training, and imposes data‑movement guardrails (for example, limits on data mirroring and regional constraints for specific integrations). Factor these into your architecture. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))

Business Associate Agreements

A Business Associate Agreement is required before you store or process PHI in HubSpot. HubSpot’s BAA is included with the Sensitive Data Terms and is presented for acceptance during Sensitive Data activation when you indicate HIPAA use. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/store-sensitive-data))

The BAA scope focuses on PHI “received and maintained by HubSpot” through the services; design your workflows so PHI remains within covered features and configurations. Keep a countersigned copy and align your subprocessor reviews accordingly. ([legal.hubspot.com](https://legal.hubspot.com/hubfs/HubSpot%20BAA%204Feb2025%20PDF.pdf?utm_source=openai))

Form Configuration for PHI Collection

Step‑by‑step

1. Confirm Enterprise subscriptions cover every Hub touching PHI and turn on Sensitive Data with Health/Medical Data selected and HIPAA status indicated; accept terms as prompted. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/store-sensitive-data))
2. Create PHI properties and tag them as Sensitive (or Highly Sensitive) so Data Encryption and access rules apply. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/store-sensitive-data))
3. Build a HubSpot or non‑HubSpot form that maps fields directly to those PHI properties. Submissions and associated uploads are encrypted and permissioned. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))
4. Keep internal notification previews off (default) to avoid exposing PHI; recipients must already have permission to view Sensitive Data values. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))
5. Add consent text and reCAPTCHA; limit fields to the Minimum Necessary and avoid free‑text prompts inviting diagnosis details. ([knowledge.hubspot.com](https://knowledge.hubspot.com/forms/create-and-edit-forms))
6. For file uploads, use file‑type fields or record attachments—never the general files tool—to ensure extra protection. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))
7. Avoid personalization tokens that reference Sensitive Data and be careful with automation steps that attempt to copy or expose PHI. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))
8. Before launch, test with a HIPAA Risk Assessment lens and document Compliance Validation (access checks, audit logs, export paths, integrations, and retention).

These steps align with HubSpot’s Sensitive Data and forms documentation for HIPAA‑eligible configurations. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/store-sensitive-data))

Limitations Under HIPAA Compliance

• Unsupported or restricted with Sensitive Data: personalization tokens using Sensitive Data, chatbots, playbooks, sandboxes; some workflow actions; and data mirroring from Sensitive Data accounts. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))
• Conditional redirects in forms cannot be based on Sensitive Data fields. ([knowledge.hubspot.com](https://knowledge.hubspot.com/forms/create-and-edit-forms))
• AI (Breeze) has usage limits with Sensitive Data on and excludes Sensitive Data from model training. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))
• Once you enable Sensitive Data, you cannot turn it off; property sensitivity is also irreversible. Some property types and unique‑value constraints aren’t supported for Sensitive Data. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/store-sensitive-data))
• Attachments get extra protection only when uploaded through covered paths; the general files tool is not for PHI. Certain integrations (e.g., Snowflake Data Share) are region‑limited for HIPAA data. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))

Conclusion

HubSpot can be part of a HIPAA‑compliant Healthcare Lead Capture stack when you use Enterprise subscriptions, enable Sensitive Data settings, accept the BAA, and configure forms, access, and workflows to the Minimum Necessary standard. Combine vendor attestations with your HIPAA Risk Assessment and ongoing Compliance Validation before you collect a single data point.

FAQs.

Is HubSpot suitable for storing PHI?

Yes—if you enable Sensitive Data (with Health/Medical Data and HIPAA indicated), accept HubSpot’s terms/BAA, and operate within supported tools and limits. Otherwise, do not store PHI in HubSpot. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/store-sensitive-data))

What plans support HIPAA compliance?

HubSpot’s PHI‑supporting Sensitive Data features are available on Enterprise tiers across core Hubs (e.g., Marketing, Sales, Service, Data, Content, Smart CRM, and Revenue Hub). ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))

How do I activate HIPAA features in HubSpot?

Go to Settings > Security > Sensitive Data, turn the setting on, select Health/Medical Data, identify your HIPAA status, and accept the presented terms (including the BAA where applicable). Then create PHI properties and lock down access. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/store-sensitive-data))

What limitations apply to HIPAA-compliant HubSpot accounts?

Expect restrictions on personalization tokens referencing Sensitive Data, certain workflow actions, chatbots, sandboxes, and data mirroring; form logic cannot use Sensitive Data fields; AI is limited; and Sensitive Data settings are irreversible once enabled. ([knowledge.hubspot.com](https://knowledge.hubspot.com/account-security/sensitive-data-in-hubspot-tools?region=canada))