Is HubSpot HIPAA compliant?
HubSpot signs a Business Associate Agreement (BAA) only on Enterprise subscriptions with Sensitive Data turned on (Marketing, Sales, Service, Data, Content Hub, Smart CRM or Revenue Hub Enterprise), but its terms leave 2 AI features fully or partly outside the BAA. Other plans aren't covered, so keep patient data out of them.
Does HubSpot sign a BAA?
Only on some plans or setups
HubSpot includes a BAA in its Sensitive Data Terms, which Enterprise customers accept when they turn on Sensitive Data. It covers specific CRM features only. HubSpot says its AI products, including Breeze, aren't part of the sensitive data features, and sensitive data shouldn't go into them.
Not fully covered by the BAA: Breeze AI (Breeze Assistant, Breeze agents such as Customer Agent, prompts); Chatbots.
Not confirmed for the AI features: HubSpot doesn’t say whether its BAA covers AI features that may process sensitive data (conversation and call summaries, conversation intelligence, auto-filled properties). Get that in writing before using it with patient data.
- Business associate
- HubSpot
- Tool
- HubSpot (incl. Breeze AI)
- Plans with a BAA
- Enterprise subscriptions with Sensitive Data turned on (Marketing, Sales, Service, Data, Content Hub, Smart CRM or Revenue Hub Enterprise)
- Checked
By plan
| Plan | BAA available | AI features covered | How to get it | Notes |
|---|---|---|---|---|
| Enterprise subscriptions with Sensitive Data turned on (Marketing, Sales, Service, Data, Content Hub, Smart CRM or Revenue Hub Enterprise) | Signs a BAA | 2 left out, 1 not confirmed | Accept or sign online | Turning on Sensitive Data includes declaring covered-entity or business-associate status and accepting the Sensitive Data Terms, whose Annex I is the BAA. Only the Covered Services HubSpot designates are in scope: CRM properties, forms, workflows, reporting and similar features. Chatbots don't support sensitive data.[1],[2],[3] |
| Free, Starter and Professional | Unconfirmed | None listed | Not stated | HubSpot documents Sensitive Data, which is how the BAA is accepted, only for Enterprise subscriptions. It doesn't say outright whether lower tiers can get a BAA another way.[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what HubSpot says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Breeze AI (Breeze Assistant, Breeze agents such as Customer Agent, prompts)Enterprise subscriptions with Sensitive Data turned on (Marketing, Sales, Service, Data, Content Hub, Smart CRM or Revenue Hub Enterprise) | Excluded | HubSpot says its AI products aren't part of its sensitive data features and sensitive data shouldn't be entered into them as prompts. Breeze Assistant works on Sensitive Data accounts but blocks Sensitive Data property values.[1],[4] |
| ChatbotsEnterprise subscriptions with Sensitive Data turned on (Marketing, Sales, Service, Data, Content Hub, Smart CRM or Revenue Hub Enterprise) | Excluded | HubSpot says Sensitive Data isn't supported in chatbots.[2],[4] |
| AI features that may process sensitive data (conversation and call summaries, conversation intelligence, auto-filled properties)Enterprise subscriptions with Sensitive Data turned on (Marketing, Sales, Service, Data, Content Hub, Smart CRM or Revenue Hub Enterprise) | Not stated | HubSpot warns that some AI features may process sensitive data but doesn't list them as Covered Services.[1] |
What the BAA doesn’t cover
- Free, Starter and Professional: no BAA confirmed. Keep patient data out.
- Breeze AI (Breeze Assistant, Breeze agents such as Customer Agent, prompts): outside the BAA (Enterprise subscriptions with Sensitive Data turned on (Marketing, Sales, Service, Data, Content Hub, Smart CRM or Revenue Hub Enterprise)).
- Chatbots: outside the BAA (Enterprise subscriptions with Sensitive Data turned on (Marketing, Sales, Service, Data, Content Hub, Smart CRM or Revenue Hub Enterprise)).
- AI features that may process sensitive data (conversation and call summaries, conversation intelligence, auto-filled properties): coverage not confirmed (Enterprise subscriptions with Sensitive Data turned on (Marketing, Sales, Service, Data, Content Hub, Smart CRM or Revenue Hub Enterprise)).
Integrations and third-party apps you connect usually need their own BAA. Check each one before it touches patient data.
HubSpot and Breeze AI
The answer depends on the product and the account you sign in with.
- HubSpotHubSpot CRM features on Enterprise with Sensitive DataSome plans only
- HubSpot Breeze AIBreeze AI assistant and agentsNo BAA
Customer support AI that offer a BAA
- AdaBAA on: Enterprise contracts (Ada is sales-led)Some plans only
- Freshdesk / Freddy AIBAA on: Freshdesk, Freshchat (standalone), Freshcaller, Freshdesk OmnichannelSome plans only
- Intercom FinBAA on: Fin workspaces (Fin AI Agent standalone), Intercom ExpertSome plans only
- Jotform (incl. Jotform AI Agents)BAA on: Enterprise, GoldSome plans only
- Kustomer AIBAA on: Enterprise or Ultimate with HIPAA add-on packageSome plans only
- LivePerson Conversational CloudBAA on: Conversational Cloud (enterprise contracts)Some plans only
All BAA-ready alternatives to HubSpot (incl. Breeze AI)
FAQ
Is HubSpot HIPAA compliant?
HubSpot signs a Business Associate Agreement (BAA) only on Enterprise subscriptions with Sensitive Data turned on (Marketing, Sales, Service, Data, Content Hub, Smart CRM or Revenue Hub Enterprise), but its terms leave 2 AI features fully or partly outside the BAA. Other plans aren't covered, so keep patient data out of them. A signed BAA is required but isn't enough on its own: HIPAA compliance also depends on how you set up and use HubSpot.
Does HubSpot sign a BAA for HubSpot?
Only on some plans or setups. HubSpot includes a BAA in its Sensitive Data Terms, which Enterprise customers accept when they turn on Sensitive Data. It covers specific CRM features only. HubSpot says its AI products, including Breeze, aren't part of the sensitive data features, and sensitive data shouldn't go into them.
Are HubSpot's AI features covered by the BAA?
Breeze AI (Breeze Assistant, Breeze agents such as Customer Agent, prompts): excluded from the baa. Chatbots: excluded from the baa. AI features that may process sensitive data (conversation and call summaries, conversation intelligence, auto-filled properties): coverage not stated.
Is HubSpot's AI covered by the BAA?
HubSpot: a BAA only on Enterprise subscriptions with Sensitive Data turned on. HubSpot Breeze AI: no BAA.
When did we last check HubSpot?
We last verified HubSpot against HubSpot's own pages on Oct 15, 2026. Each listing is re-checked on a schedule, and a daily monitor flags changes to the vendor pages it cites.
Sources
- Sensitive Data | HubSpot
- Store Sensitive Data in HubSpot
- HubSpot Sensitive Data Terms
- Understand how Sensitive Data is used in HubSpot tools
Cite this
AI Vendor BAA Check. (n.d.). Is HubSpot HIPAA compliant? BAA status by plan. Retrieved October 15, 2026, from https://aivendorbaacheck.com/tools/hubspot
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.