Is HubSpot HIPAA Compliant? HubSpot for Healthcare

Quick Guide for HubSpot HIPAA Compliance

Healthcare organizations considering using the CRM platform for marketing should carefully review the software’s security measures and terms of service. To its credit, HubSpot invested in a comprehensive set of security measures to safeguard customer data, as explained in the HubSpot Trust Center. Note that these security measures do not automatically ensure HubSpot’s compliance with HIPAA, as you may need to secure specific steps such as having the CRM provider sign a BAA.

• Access monitoring: HubSpot strictly controls access to its systems, following the principle of least privilege. Access requests, modifications, and deletions are managed through a defined process, with pre-authorization based on employees’ functional roles or in-workflow approval.
• Backups enabled: Systems are regularly backed up, with seven days’ worth of backups retained for easy restoration. Monitoring them for successful execution and generating alerts for any exceptions is also critical. Data is backed up daily to local regions, and periodic copies are stored in separate AWS regions for disaster recovery.
• Data erasure: HubSpot provides active customers with tools to delete or export their data in various formats. Data is retained for active customers and is purged based on specific criteria following the termination of customer agreements.
• Encryption: HubSpot uses encryption to protect data at rest and in transit. Data is stored using AES-256 encryption, and sensitive interactions with HubSpot’s products are encrypted with TLS 1.2 or 1.3 and 2048-bit keys or better.
• Network security: HubSpot enforces multiple layers of filtering and inspection of all connections throughout its platform. Network-level access control lists prevent unauthorized network access, and firewalls are configured to deny network connections not explicitly authorized by default.
• Incident response: HubSpot has a Security Operations Center (SOC) that provides 24/7 coverage to respond rapidly to security and privacy events. An incident response program is in place, with predefined incident types for efficient tracking, task assignment, escalation, and communication.
• Risk management: HubSpot maintains an Enterprise Risk Management (ERM) program that includes risk assessments, a risk register, and risk mitigation and remediation activities. Security awareness training is provided to employees, including phishing awareness training and simulations.