HubSpot Forms is a form-building feature within HubSpot's marketing, sales, and customer service platform.

With HubSpot Forms, organizations can capture leads, collect patient inquiries, and connect form submissions directly to HubSpot's CRM for follow-up and workflow automation. This helps businesses centralize data collection and act on it efficiently.

Is HubSpot Forms HIPAA compliant? Yes, based on our research, HubSpot Forms can be HIPAA compliant.

 

Will HubSpot sign a business associate agreement (BAA)?

Yes, HubSpot will sign a business associate agreement, but only for customers on an Enterprise plan who activate Sensitive Data settings and accept HubSpot's Sensitive Data Terms. Free, Starter, and Professional tiers are not HIPAA-eligible under any configuration. Activating the BAA requires navigating to Privacy and Consent settings, configuring Sensitive Data Settings, and accepting the associated terms.

 

What does the HubSpot BAA cover?

The HubSpot BAA covers the use and disclosure of protected health information (PHI) for a specific, named list of covered services. Forms and Forms Submission Authenticated API are explicitly included in this list, alongside:

  • CRM Object Properties
  • CRM Objects API
  • CRM Attachments, only when added to records manually
  • List Creation
  • Workflows
  • Search
  • Integrations
  • CRM Activities, including call logs

 

What does the HubSpot BAA exclude?

The list of covered services is limited and subject to change. Reporting Analytics, including the Custom Report Builder, Customer Journey Reports, Data Sets, and Snowflake Data Sharing are not covered by the BAA. It is also not possible to export CRM properties as personalization tokens, such as automatically inserting a patient's name into a marketing email. While CRM Activities allows call logs to be stored, it is not permitted to store call recordings or call transcripts that include PHI.

 

Conclusion

HubSpot signs a BAA for Enterprise level customers and Forms is included as a covered service, making HubSpot Forms HIPAA compliant.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a business associate agreement?

A business associate agreement (BAA) is a legally binding contract establishing a relationship between a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and its business associates. The purpose of this agreement is to ensure the proper protection of personal health information (PHI) as required by HIPAA regulations.

 

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting the privacy and security of certain health information, known as protected health information (PHI).

HIPAA is designed to protect the privacy and security of individuals' health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.