Marketing Automation — Vendor Intelligence Profile
CRM and marketing automation platform — not recommended for healthcare PHI workflows without legal review.
Enterprise Buyer Journey
A structured seven-step journey from governance foundation to implementation planning.
Understand AI Governance
Build a governance foundation before evaluating any vendor.
Create Vendor Requirements
Define what your organization needs from an AI vendor by category.
Build Evaluation Criteria
Establish compliance, security, and workflow scoring rubrics.
Compare Vendors
Evaluate vendors side-by-side across risk, compliance, and fit.
Review Compliance
Assess BAA availability, HIPAA posture, and PHI exposure risk.
Approval Recommendation
Determine the vendor approval tier and governance conditions.
Implementation Planning
Execute the approval workflow and plan deployment with oversight.
Not Available
No
Not publicly disclosed
Not publicly disclosed
Not publicly disclosed
Cloud (SaaS)
Vendor Overview
Industry
Marketing / CRM
Deployment Model
Cloud (SaaS)
Primary Users
Marketing teams, sales operations, patient acquisition teams
Healthcare Suitability
Not Recommended for PHI — no BAA available, high PHI exposure risk
Headquarters
Cambridge, MA
Primary Use Cases
Security & Compliance
BAA Availability
Not Available
HIPAA Suitability
No
SOC 2 Status
Not publicly disclosed.
ISO Certification
Not publicly disclosed.
Authentication / SSO
Not publicly disclosed.
Access Controls
Not publicly disclosed.
Audit Logging
Not publicly disclosed.
Data Retention
HubSpot does not offer a HIPAA BAA. Patient data, appointment information, and any protected health information must not be entered into HubSpot under any circumstances.
Customer Data Usage
Not publicly disclosed.
Model Training Practices
Not publicly disclosed.
Security Documentation
Not publicly disclosed.
Privacy Documentation
Not publicly disclosed.
Incident Response
Not publicly disclosed.
BAA Details
No BAA is available from HubSpot. Healthcare organizations requiring CRM or marketing automation for PHI-adjacent workflows must evaluate HIPAA-compliant alternatives such as Salesforce Health Cloud.
Compliance Notes
HubSpot must not be used for patient data, appointment data, clinical information, or any PHI. If currently in use, audit all data fields and forms for PHI exposure and remediate immediately.
AI Governance
AI Classification
General AI Capability
Human Review
Required — AI outputs must be reviewed by a qualified professional before clinical or operational action.
AI Output Risk
Not publicly disclosed.
Oversight Considerations
PHI must never be entered into HubSpot. HubSpot tracking pixels on healthcare websites must be audited for HIPAA compliance. Not approved for patient-facing or clinical workflows.
Approval Workflow
Standard VNDRIQ vendor approval workflow recommended.
Monitoring Cadence
Quarterly
Suggested Owner
IT / Compliance / Clinical Governance (varies by use case)
Escalation Triggers
BAA changes, privacy policy updates, new AI features, security incidents, acquisitions.
Enterprise Readiness
Ideal Customer
Marketing teams, sales operations, patient acquisition teams
Vendor Maturity
Emerging — Newer entrant or limited healthcare documentation available.
Enterprise Readiness
Early Stage — May require additional documentation before enterprise adoption.
Implementation Complexity
Not publicly disclosed.
Integration Requirements
Not publicly disclosed.
EHR Integrations
Not publicly disclosed.
SSO / API
Not publicly disclosed.
Support Model
Not publicly disclosed.
Business Continuity
Not publicly disclosed.
Evaluation Criteria
Security Controls
2/5
Compliance
1/5
Data Privacy
1/5
Vendor Transparency
3/5
Healthcare Readiness
1/5
Governance Readiness
1/5
Implementation Guidance
Restrictions
PHI must never be entered into HubSpot. HubSpot tracking pixels on healthcare websites must be audited for HIPAA compliance. Not approved for patient-facing or clinical workflows.
Implementation Notes
If HubSpot is in use, immediately audit all forms and CRM fields for PHI exposure. Remove from any patient-facing workflows. Document restriction in vendor risk register.
Monitoring & Review
Review Cadence
Quarterly
Items to Monitor
BAA status, privacy policy, AI feature changes, security certifications, EHR integrations.
Documentation Gaps
Not publicly disclosed.
Vendor Change Triggers
Approval Recommendation
Not Recommended
Vendor does not meet minimum requirements for healthcare PHI handling. Not recommended for any workflows involving protected health information.
Required Due Diligence
Internal Owner
IT / Compliance / Clinical Governance
Documents to Collect
BAA, security questionnaire, privacy policy, data processing agreement.
Executive Buyer Checklist
0/11Use this checklist to track your evaluation progress for HubSpot.
Vendor Intelligence Hub
Comparisons
Approval Status
AI Risk
Resources
Reports
Related Vendors
Approved Alternatives
Vendors with approved or conditional approval status for healthcare use.
Profile Completeness
Missing Fields
Vendor Snapshot
Category
Marketing Automation
Headquarters
Cambridge, MA
Deployment Model
Cloud (SaaS)
Healthcare Suitability
Not Recommended for PHI — no BAA available, high PHI exposure risk
Risk Level
High Risk
Review Confidence
Under Review
Last Reviewed
2026-06-15
Risk Score
85/100
AI Trust Score
40/100
Governance Resources
Alternative Vendors
Related Checklists
Comparison Guides
VNDRIQ vendor profiles are for operational risk screening and governance support. This is not legal, compliance, or cybersecurity advice. Final vendor approval should include legal, compliance, security, and contract review. Data is based on publicly available information and internal review at time of last verification.