Salesforce Health Cloud
CRM
Healthcare CRM on the Salesforce platform. Web-to-Lead turns a website form into leads; the BAA covers named services only.
CRM
HubSpot and your treatment center website
CRM, forms and a tracking code. HIPAA use needs an Enterprise subscription with Sensitive Data turned on and the BAA accepted.
- Read against the vendor's own pages
- BAA on specific plans
- Checked October 15, 2026
What it is
A CRM and marketing platform with forms, email and a website tracking code. On Enterprise plans, Sensitive Data settings support HIPAA use.
How it connects to a website
- Embed
HubSpot forms embed on your site, and HubSpot's tracking code goes on every page you want measured.
- Form posting
On pages with the tracking code, HubSpot says it can track submissions from non-HubSpot forms as well as its own.
What KhanWork does with it
- Embed HubSpot forms, or connect the website's own form, so inquiries land as contacts with their source.
- Map any field that could hold PHI to a Sensitive Data property, and only when the account is set up for it.
- Install the tracking code with your consent setup, and keep form contents out of Google Analytics.
Setup, as the vendor documents it
- A Super Admin opens Settings, Security, Sensitive Data and turns on Sensitive Data Protection.
- Select both the Health/Medical Data checkbox and the HIPAA covered entity or business associate checkbox.
- Accept the Sensitive Data Terms and the Business Associate Agreement.
- Create the properties that will hold PHI with the PHI box checked. A property's sensitivity cannot be changed after it is created.
Source: HubSpot Knowledge Base, Store Sensitive Data in HubSpot. Menus and labels change; follow what you see in your account.
What to watch out for
Where patient details can slip out with HubSpot, and what the vendor's own documents say to switch on, switch off or ask for.
Enterprise or nothing
HubSpot's knowledge base lists Sensitive Data on Enterprise subscriptions. We found no BAA route on other tiers in its documentation, so a Starter or Professional account should not hold PHI.
Not every tool handles Sensitive Data
HubSpot says Sensitive Data is not supported in some tools, including chatbots, personalization tokens, playbooks and sandboxes. Design workflows around that before you build them.
Forms can be pulled
HubSpot's content moderation policy says a form flagged for collecting sensitive information in breach of its terms stays unpublished, and you have 15 business days to remove the fields and delete the data before HubSpot deletes the form.
The tracking code shares data by default
HubSpot says it uses certain data from its tracking code to improve its products, including the Breeze Intelligence dataset, and that you can turn this sharing off in account settings. Review that setting.
Frequently asked questions
On an Enterprise subscription with Sensitive Data turned on, the HIPAA option selected and the BAA accepted, HubSpot supports PHI in Sensitive Data properties. Other tiers should not hold it.
HubSpot's documentation places Sensitive Data, which carries the BAA, on Enterprise subscriptions. We found no BAA route for other tiers.
Decide that with your compliance lead. Google warns against tags on pages related to providing health care for its own analytics, and HubSpot's code also shares some data with HubSpot unless you turn that off.
Sources
- HubSpot Knowledge Base, Store Sensitive Data in HubSpot (opens in a new tab) (checked )
- HubSpot Knowledge Base, Sensitive Data in HubSpot tools (opens in a new tab) (checked )
- HubSpot, Sensitive Data Terms (opens in a new tab) (checked )
- HubSpot Knowledge Base, content moderation policies (opens in a new tab) (checked )
- HubSpot Knowledge Base, install the tracking code (opens in a new tab) (checked )
- HubSpot developer docs, API reference (opens in a new tab) (checked )
Not legal advice. This page reports what the vendor publishes. Nothing here implies a partnership with HubSpot. Confirm plans and the BAA in writing with the vendor, and let your compliance lead or counsel decide what counts as PHI in your workflows. For the terms, see BAA, PHI, HIPAA and 42 CFR Part 2 in the glossary.
