HubSpot for Healthcare: Which Plan You Need and What Info They Can and Can’t Store

Medical practices evaluating healthcare CRMs are usually trying to solve one or several of the following problems:

• Patient inquiries arrive in several ways (phone calls, web forms, directories, and referring offices), but no single source of truth records them all.
• Referral relationships depend on individual staff knowledge rather than a tracked process.
• Marketing spend goes out without a clear line back to booked appointments, which makes the true cost of patient acquisition impossible to calculate.
• Multi-location groups run separate tools at separate sites, leaving leadership without an overview of performance.

HubSpot addresses all of these, and plenty of healthcare organizations, including medical practices, dental groups, and community health centers, already run their inbound marketing on it.

But healthcare adds another complication to consider alongside features and pricing. HIPAA governs any information that identifies someone as your patient, and marketing systems collect more of that information than most teams realize. Before you configure anything, you have to settle what the system is allowed to know about the people in it. Your answer determines which HubSpot subscription tier you need, which fields your forms can collect, which workflows you can build, and how much of your patient funnel you can measure.

This guide covers what HubSpot can hold for a medical practice, dental group, or community health center, which plan each option requires, and what belongs somewhere else.

Key Takeaways

• Storing protected health information on HubSpot requires an Enterprise subscription with the Sensitive Data feature enabled and a signed Business Associate Agreement.
• Starter and Professional portals can run robust healthcare marketing automation, including automated workflows and segmented email, as long as data identifying someone as a patient stays out of them.
• The Sensitive Data setting cannot be turned off once you enable it, so the decision is permanent.
• Appointment reminders, test results, and billing notices belong in your practice management system or patient portal on every plan, including Enterprise.

What Info HubSpot Can (and Can’t) Store for a Medical Practice

HubSpot can store any contact information that doesn’t identify someone as a patient, including newsletter subscribers, seminar registrants, and referring physicians. Storing information that shows a named person is seeking or receiving care requires an Enterprise subscription with HubSpot’s Sensitive Data feature enabled and a signed Business Associate Agreement.

Protected health information (PHI) is any information that identifies a person and relates to their health, their care, or payment for that care. Most people picture medical records, but marketing data qualifies more often than you might expect. The rule doesn’t distinguish between data generated during patient care and patient data collected by a marketing form. If a record tells you someone is, was, or wants to become your patient for a particular reason, treat it as PHI.

PHI	Usually Not PHI	Gray Area
An appointment request naming a symptom or procedure	A newsletter signup with a name and email	A registration for a seminar on a health topic
A list of patients seen at a specific location	A referring physician’s contact details	A download of a guide about a specific condition
A property recording which procedure someone booked	A contact form message with no health details	Visits to condition pages tied to a known contact

The most common place PHI enters a marketing portal is through a free-text field. Most form templates include a “Reason for visit” or “Tell us about your symptoms” field, and those invite a visitor to type a diagnosis into a system that has no sufficiently safe place to store it.

How You Use HIPAA Info Determines Which HubSpot Plan You Need

HubSpot supports HIPAA compliance only on Enterprise subscriptions. Starter and Professional portals cannot lawfully store PHI, no matter what security features they include.

Sensitive Data is available at the Enterprise level across HubSpot Marketing Hub, Sales Hub, Service Hub, Content Hub, Data Hub, and Smart CRM, so the requirement applies to whichever part of the platform ends up holding the record.

To configure your Enterprise tier for HIPAA compliance, you need to:

• Enable the Sensitive Data feature
• Select the Health/Medical Data and HIPAA covered entity categories
• Accept the Business Associate Agreement (BAA) during setup

What to Decide Before You Turn On Sensitive Data

Enabling the feature is permanent. HubSpot’s documentation states that once Sensitive Data is on, you can’t turn it off or remove the selected categories, and a property’s sensitivity setting is locked when the property is created.

The agreement is narrower than it sounds. HubSpot’s Sensitive Data Terms carry the BAA in Annex I, and it covers only the services HubSpot has authorized in writing for processing PHI. Confirm the specific tools your use case depends on before you build on them.

Sensitive properties come with limits inside the product. You can’t use them in personalization tokens or chatbots, so a follow-up email built with automated workflows can reference an appointment without naming the procedure.

Every connected tool needs its own BAA. That includes your scheduling software, call tracking, and any electronic health record (EHR) integration that moves data in either direction.

Audit logging covers less than people assume. HubSpot’s account activity documentation shows that logs are available on Starter, Professional, and Enterprise, but logging of sensitive property values, workflows, and property changes starts at Professional. Super Admin access is required to view or export them, and the in-app view holds only the last 30 days.

Two Ways Medical Practices Run HubSpot

Practices end up in one of two operating models. We’ll call them Model A and Model B. Choosing deliberately is better than drifting into one. Here’s how they compare:

	Model A: HubSpot Stops at the Inquiry	Model B: HubSpot Holds PHI
Subscription	Any tier, including Starter and Professional	Enterprise with Sensitive Data enabled and a signed BAA
What HubSpot holds	Subscribers, educational content readers, event registrants, referring providers	Everything from Model A, plus individual patients from first inquiry to booked appointment
What you can measure	Inquiries by channel and location	Individual attribution from first touch to appointment
What you give up	Patient-level segmentation and attribution inside HubSpot	Higher cost, longer setup, BAAs for every connected tool

Model A covers most of what a health practice marketing team does day to day, including content marketing, seminar promotion, updates for referring providers, and lead nurturing. HubSpot manages the audience you’re building, and when someone is ready to book, the request moves to a HIPAA-compliant intake tool or your phone line.

The tradeoff is measurement. HubSpot can tell you that 41 inquiries came from your Clearwater location last month and where they originated. Your practice management system can tell you how many new patients Clearwater booked. Matching those two numbers by date range and location gives you channel-level performance, and no configuration inside a Professional portal will connect them at the individual level.

Watch Andi Graham, Big Sea’s CEO, explain the cost benefits of integrating your systems on HubSpot in our webinar.

What Belongs in HubSpot and What Belongs in Your EHR

Marketing information belongs in HubSpot. Clinical information belongs in your EHR and the clinical systems around it. HIPAA’s minimum necessary standard expects you to use only the information a task requires, and healthcare marketing automation runs on very little: a service line, a stage, and a location.

Diagnoses, clinical notes, medications, and insurance details need to stay in the EHR, including on Enterprise. The less patient data your marketing portal holds, the less you expose if an account is compromised or a list is exported to the wrong place.

Appointment reminders, test results, and billing notices sit on the other side of that line. They contain PHI and should come from your practice management system or patient portal. Keeping them separate has a second benefit worth the trouble: a patient who unsubscribes from your newsletter keeps receiving their reminders. This is crucial to keep the patient experience positive.

What a HIPAA-Ready Enterprise HubSpot Setup Costs vs. Professional

According to their pricing page, HubSpot Marketing Hub Professional and Enterprise differ by roughly $2,800 per month before any integration work.

	Marketing Hub Professional	Marketing Hub Enterprise
List price	$800/month	$3,600/month
Onboarding	$3,000 one-time	$7,000 one-time
Included seats	3 core seats	5 core seats
Marketing contacts	2,000	10,000
PHI permitted	No	Yes, in properties marked sensitive

For many practices, Professional plus a HIPAA-compliant intake tool costs less and carries less risk than moving to Enterprise. Enterprise can be worth it when patient-level attribution changes real decisions about where your marketing money goes. That’s a question about how your practice makes budget decisions rather than a question about software.

Community health centers have a third path. HubSpot’s nonprofit program offers 40% off list prices, which can bring Enterprise within reach for some healthcare organizations. There are three qualifiers, though: the discount covers new Professional or Enterprise products only, you must be a new HubSpot customer, and it requires an annual contract. (Eligibility is currently limited to North America, Australia, and New Zealand.)

HubSpot vs. Salesforce Health Cloud vs. Your EHR’s Marketing Module

	Best Suited To	Main Constraint
HubSpot	Practices that want marketing, referral relationships, and reporting in one system and can keep clinical data elsewhere	PHI storage requires Enterprise
Salesforce Health Cloud	Health systems with dedicated administrators and complex care coordination needs	Setup effort and cost assume in-house technical staff
Your EHR’s Marketing Module	Practices that need recall messaging and nothing more	No referral pipeline, no landing pages, no channel attribution

Salesforce Health Cloud solves a different problem from HubSpot. It’s built to work on top of your clinical records by connecting care teams around clinical workflows and tying patient engagement directly to the clinical record. Health Cloud suits organizations coordinating care across facilities, with the administrators and budget to run it. Salesforce publishes no list price for Health Cloud, which points to a quote-based sale rather than a plan you choose from a pricing page.

Salesforce could be the right call for a health system managing care journeys, but overbuilt for a twelve-provider orthopedic group that wants to track referring physicians and fill a seminar. Most multi-location specialty practices are buying marketing infrastructure, and HubSpot is scoped and priced for that work.

What to Build in Your First 90 Days

Here’s how to get started.

Month 1: Work through the compliance question with your privacy officer and set up a policy in writing. Open every form on your site and remove fields that collect more than your subscription permits. Build four contact properties that work on any tier: audience type, preferred location, topic interests, and lead source. Run one database hygiene pass.

Month 2: Build your audience segments and send one properly segmented email. Create a referring provider pipeline and populate it with every physician who referred to you last year, including the ones who have gone quiet. Nurturing that pipeline is essential. The CDC’s National Ambulatory Medical Care Survey found that 52% of new patient visits to office-based physicians arrive as a referral from another physician. Yet a study of over 100,000 referrals published in the Journal of General Internal Medicine found that only 34.8% ended in a documented completed appointment, and 38.9% were never scheduled at all.

Month 3: Set up a dashboard your practice administrator will actually use. Rebuild one landing page per location. Calculate your cost per inquiry and your cost of patient acquisition with someone who has access to the financials.

Build Out Your Platform with a Team That Understands HubSpot

With healthcare, the compliance decision shapes everything downstream. Practices that settle it early spend their budget on growth; practices that settle it late spend a quarter rebuilding what they already paid for.

At Big Sea, we build marketing systems for medical practices, dental groups, and community health centers. If you want a second set of eyes on your HubSpot setup, reach out to us. As a HubSpot Platinum partner, we can review your current configuration against the HIPAA line you’ve drawn, tell you what’s working and what’s exposing you, and draw up a prioritized plan to push your practice further.

FAQs About HubSpot for Healthcare