BAA guide
Is HubSpot HIPAA compliant?
Plan by plan, from HubSpot, Inc.'s own pages.
Only on a plan where the vendor signs a BAA. HubSpot is not HIPAA compliant on its own. Enterprise (Smart CRM, Marketing Hub, Sales Hub, Service Hub, Content Hub, Data Hub, Revenue Hub): HubSpot says a Super Admin must turn on Sensitive Data, select the Health/Medical Data and HIPAA covered entity or business associate checkboxes, and accept the BAA.
Checked against HubSpot's own pages, linked in the table.
Which HubSpot plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| Enterprise (Smart CRM, Marketing Hub, Sales Hub, Service Hub, Content Hub, Data Hub, Revenue Hub) | BAA only if the condition is met | HubSpot says a Super Admin must turn on Sensitive Data, select the Health/Medical Data and HIPAA covered entity or business associate checkboxes, and accept the BAA. | Read the Sensitive Data Terms and if applicable, the Business Associate Agreement.knowledge.hubspot.com |
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Does HubSpot sign a BAA?
Yes. HubSpot's Sensitive Data Terms include HubSpot's Business Associate Agreement as Annex I, which applies to the extent you store protected health information subject to HIPAA.
Which HubSpot plans can store PHI?
HubSpot's Store Sensitive Data article lists Enterprise subscriptions of Smart CRM, Marketing Hub, Sales Hub, Service Hub, Content Hub, Data Hub, and Revenue Hub.
How do we turn on the HubSpot BAA?
HubSpot says a Super Admin goes to Settings, then Security, then the Sensitive Data tab, and turns on Sensitive Data Protection. To store HIPAA covered data, you select both the Health/Medical Data checkbox and the HIPAA covered entity or business associate checkbox, then accept the terms and the BAA.
Does the HubSpot BAA cover every HubSpot tool?
No. HubSpot says Sensitive Data properties are unavailable in some tools, including personalization tokens, sandboxes, chatbots, and playbooks. Its terms say permitted sensitive data can be used only within covered services. Rivvi is an AI workspace for healthcare teams. Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA.
Related
- Is Salesforce HIPAA compliant?
- Is Zoom HIPAA compliant?
- Is Google Drive HIPAA compliant?
- Is Gmail HIPAA compliant?
- Is Microsoft Teams HIPAA compliant?
- Is Microsoft 365 HIPAA compliant?
- BAA directory: every tool Rivvi checked
- What makes a chatbot HIPAA compliant
- HIPAA compliant AI: which tools sign a BAA
- Check another AI tool against its BAA terms
Source: HubSpot, Inc.'s own pages, linked in the table. Checked . Last updated . How Rivvi sources data. Spot an error? hello@rivvi.ai.
Free to start. Most teams are using it the same day.
Get started for free