HubSpot’s BAA is included by reference in its Sensitive Data Terms for covered entities and business associates, using the Sensitive Data feature on Enterprise subscriptions. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Enterprise subscriptions for Marketing, Sales, Service, Data, Content, Smart CRM and Revenue Hub | Covered |
What the BAA leaves out
- Chatbots, personalization tokens, playbooks and sandboxes
- Calculation, rollup, property sync and HubSpot user properties
- Breeze cannot use custom Sensitive Data property values
- Prohibited Sensitive Data in any feature
- Data hosted by integrated third-party products
How to get the BAA
Accept the Sensitive Data terms and BAA during Sensitive Data setup in account settings.
What the vendor says to do
- Super Admin opens Settings, Security, Sensitive Data and turns on Sensitive Data Protection
- Select Health/Medical Data and the HIPAA covered entity or business associate checkbox
- Read and accept the Sensitive Data terms and BAA
- Create sensitive properties and mark those with PHI as containing PHI
- Set access under Manage access
- Vendor advises avoiding Breeze if you do not want it to process Sensitive Data
Proof from the vendor
- Store Sensitive Data in HubSpotEnterprise subscriptions, setup steps, HIPAA checkboxes, unsupported tools
- Sensitive Data Additional Terms (April 14, 2026)BAA scope, covered services through catalog, prohibited data, breach notice period
- Sensitive Data Management for CRMBAA included by reference in terms
- Understand how Sensitive Data is used in HubSpot toolsUnsupported tools, Breeze limits, Snowflake regions
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.