How clinics connect HubSpot to the EMR: what belongs in each system, HubSpot's Sensitive Data settings and BAA, and a design that keeps clinical data in the EMR.
Mahmoud ElHewaheyFounder, PulseAI Solutions4 November 2026 · 3 min read
The short version
HubSpot runs the enquiry, the follow-up and the marketing; the EMR holds the chart. Each should keep its own job.
HubSpot's Sensitive Data settings, on Enterprise subscriptions, mark properties as sensitive and, for HIPAA-covered US organizations, bring HubSpot's BAA into effect.
The BAA applies only to the features HubSpot lists as covered, so the integration design decides how much protected information ever reaches the CRM.
The cleanest design sends the CRM only what the front desk and marketing need, and keeps clinical detail in the EMR.
Clinic Conductor connects HubSpot to Jane App, Oscar Pro, TELUS Health and other EMRs.
Why clinics connect HubSpot to the EMR
Clinics that grow on enquiries use HubSpot to capture leads, follow up and measure which
campaigns fill the calendar. The EMR knows who booked, who showed up and who became a member.
Without a connection, someone copies names from one to the other, the CRM never learns who
converted, and the follow-up reaches people who already booked.
What belongs where
HubSpot and the EMR, side by side
Information
HubSpot
EMR
Enquiry, source and campaign
Yes
Only the source, if useful
Contact details and consent to contact
Yes
Yes
Booking status and attendance
Status only
Yes, in full
Reason for visit and clinical history
Avoid
Yes
Results, notes and care plans
No
Yes
The less clinical detail reaches the CRM, the smaller the privacy surface. Booking status is usually all marketing needs.
HubSpot's Sensitive Data settings and BAA
HubSpot offers Sensitive Data settings on Enterprise subscriptions. Once an account turns
them on, properties can be marked as sensitive or highly sensitive, access to them can be
restricted, and some features stop using their values. A US organization covered by HIPAA can
accept HubSpot's Business Associate Agreement as part of the Sensitive Data Terms.
The BAA covers only the features HubSpot lists as covered services. Marketing features,
personalization and many integrations sit outside that list, so the question for a clinic is
which fields will hold protected information, and which features will touch them.
For Canadian clinics
PHIPA, PIPEDA and Québec's Law 25 apply whatever the CRM's settings. Your privacy officer should know what reaches the CRM, where the account's data is hosted, and how long it is kept.
The design that holds up
The EMR stays the record. Clinical information is written to the EMR and stays there.
The CRM gets the status. Booked, attended, became a member: enough to stop the wrong follow-up and measure the campaign.
One layer moves the data. A single integration layer decides what each system receives, so the rules live in one place.
Every exception reaches a person. A duplicate contact or an unmatched booking stops and waits for your team.
Yes, through an integration layer or a partner that connects to both. HubSpot does not connect to most clinical EMRs on its own, so the connection is built through the EMR's supported interface and HubSpot's API.
Is HubSpot HIPAA compliant?
HubSpot offers Sensitive Data settings and a BAA for HIPAA-covered organizations on Enterprise subscriptions. The BAA applies only to the features HubSpot lists as covered services, so compliance depends on how the account and the integration are set up.
Does Clinic Conductor connect HubSpot to Jane App?
Yes. Clinic Conductor is live in production with Jane App and connects it to the CRM a clinic uses, including HubSpot, so enquiries, bookings and outcomes stay in step.
How to connect a CRM such as HubSpot or Salesforce to your EMR: what should sync, in which direction, what must never leave the chart, and how to keep it compliant.