On this page
GoHighLevel offers HIPAA through an optional, account-wide add-on that includes a BAA, while HubSpot stores HIPAA-covered data only on Enterprise subscriptions with its Sensitive Data settings turned on (HighLevel; HubSpot). Both still leave the ad side to you, because a Meta or Google pixel on your funnel pages reports to the ad platform, not to your CRM. Curve Compliance, which credits GoHighLevel bookings and HubSpot outcomes to the ads that drove them, checked both vendors' pages on November 9, 2026.
Book a call. Running ads into GoHighLevel or HubSpot? Curve Compliance keeps the ad click attached when patients book in GoHighLevel, with setup by Curve's team, sends conversions to Meta and Google server-side with a fixed list of fields, and shows HubSpot outcomes as CRM revenue and close rate. Curve's team does the setup, typically live in about a week. Book a call with Curve.
GoHighLevel vs HubSpot at a glance
| GoHighLevel (HighLevel) | HubSpot | |
|---|---|---|
| BAA route | “BAA included: A signed Business Associate Agreement is provided as part of the package” (HighLevel) | Accept it when you turn on Sensitive Data: “Read the Sensitive Data Terms and if applicable, the Business Associate Agreement” (HubSpot) |
| Plans | HighLevel says agencies on any plan can subscribe to HIPAA compliance (HighLevel) | Enterprise editions of Marketing Hub, Sales Hub, Service Hub, Data Hub, Content Hub, Smart CRM and Revenue Hub (HubSpot) |
| Default state | “HighLevel accounts are NOT HIPAA compliant by default” (HighLevel) | Sensitive Data is off until a Super Admin turns it on: “Super Admin permissions are required to turn on or edit Sensitive Data settings” (HubSpot) |
| Scope once on | Applies “to all location accounts within your account and cannot be deactivated” (HighLevel) | Per account and per property; “once you’ve turned on Sensitive Data, it’s not possible to remove the selected categories” (HubSpot) |
| What it turns on | “encryption of ePHI, Business-Associate Agreements (BAAs), audit logging, and MFA enforcement” (HighLevel) | Sensitive Data properties with “an additional layer of encryption, application layer encryption” (HubSpot) |
| With Curve Compliance | Bookings credited to the ad click through a handoff set up by Curve's team (GoHighLevel integration) | Outcomes show in Campaign Reporting as CRM revenue and close rate |
Directory entries: GoHighLevel and HubSpot. For more CRMs, see HIPAA-compliant CRM: which CRMs sign a BAA.
HighLevel's HIPAA add-on
HighLevel describes it as “an optional, account-wide HIPAA add-on that enables encryption of ePHI, Business-Associate Agreements (BAAs), audit logging, and MFA enforcement,” and says “HIPAA compliance is enabled automatically once the BAA is signed” (HighLevel). Once enabled, it applies to every location in the agency account and can't be turned off.
For agencies, the roles matter. HighLevel says that in the relationship between HighLevel, an agency and its client, “the Practice is considered ‘the HIPAA-covered entity’ and HighLevel and the Agency are considered ‘HIPAA Business Associates’,” and that “your Agency must also be in full compliance with HIPAA Title II so that you can provide your client Practice with a HIPAA Business Associate Agreement as well” (HighLevel). In other words, the agency signs with the practice too. See Is GoHighLevel HIPAA compliant?
HubSpot's Sensitive Data and BAA
HubSpot's setting is specific: “To store HIPAA-covered data, you must select both the Health/Medical Data checkbox and the We are a HIPAA-covered entity or business associate checkbox.” HubSpot adds: “By identifying as a HIPAA Covered Entity or Business Associate, HubSpot can track the application of the Business Associate Agreement (BAA) and fulfill regulatory obligations” (HubSpot).
- Mark the properties. For a property that will hold health data, HubSpot says to select “Yes, this data contains Protected Health Information (PHI)” when you create it, and a property's Sensitive Data setting can't be changed afterwards (HubSpot).
- Expect some tools to drop out. “Sensitive Data properties are unavailable in certain tools, including personalization tokens, sandboxes, chatbots and playbooks” (HubSpot).
- Encryption layers. “By default, data in HubSpot is encrypted in transit and at rest,” and marking a property as sensitive adds application layer encryption (HubSpot).
See HubSpot HIPAA setup: forms, CRM and email by plan.
Funnels, forms and pixels: where PHI leaks
A CRM BAA covers the CRM. The leak usually happens one step earlier, on the funnel page, the booking widget or the thank-you page, where an ad pixel reads what the visitor does. HHS gives the example directly: “tracking technologies might collect an individual's email address, or reason for seeking health care typed or selected by an individual, when the individual visits a regulated entity's webpage and makes an appointment with a health care provider” (HHS).
- Funnel and landing pages. A pixel on a page that names a treatment sends that page address with every event.
- Forms and surveys. Answers that land in the page address or a hidden field can be read by any tag on the page. See Jotform alternatives for healthcare for form builders that sign a BAA.
- Booking widgets and confirmations. The confirmation page is where most conversion pixels fire, and it is the page HHS's example describes.
- Calls. If your funnel drives phone calls, the call tracking vendor needs its own BAA; see CallRail alternatives for healthcare.
Whether a given funnel collects PHI depends on what it offers and asks, so talk to your counsel about your own pages.
Getting booked appointments back to Meta and Google
Without a handoff, the click ID and UTMs stay behind when the visitor moves from your site to the booking step, so the booking can't be credited to the ad. For GoHighLevel, Curve Compliance carries that attribution across with a bridge token through a custom handoff that Curve's team sets up, credits the booking when GoHighLevel's webhook arrives, and sends the conversion server-side to Meta, Google, TikTok, Microsoft and LinkedIn. The token carries no form content and is not a patient identifier, and bookings made days after the click still match. See the GoHighLevel integration.
For HubSpot, the CRM outcome is what matters: Curve receives outcomes from CRMs through incoming webhooks and offline conversion uploads, credits each to the original ad click, and shows HubSpot outcomes in Campaign Reporting as CRM revenue and close rate. If patients book in a scheduler first, see Calendly vs Acuity for healthcare.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names such as Lead, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what it accepted.
Campaign Reporting puts Meta and Google Ads spend next to Curve-tracked conversions for each campaign, so an agency or clinic can see which ads produce booked appointments, not just leads. Curve is SOC 2 Type II, signs a BAA on every plan, and its team does the setup, typically live in about a week. Book a call to see your GoHighLevel or HubSpot funnel tracked from ad click to booking.
Sources, checked November 9, 2026: HighLevel, HIPAA Compliance With HighLevel; HubSpot, Store Sensitive Data in HubSpot; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
Frequently Asked Questions
GoHighLevel vs HubSpot: which is better for healthcare?
Both can hold HIPAA-covered data under a BAA, GoHighLevel through its account-wide add-on and HubSpot on Enterprise subscriptions with Sensitive Data turned on, so the choice comes down to how your team works (HighLevel; HubSpot). Neither BAA covers the ad pixels on your funnel pages, so send conversions to Meta and Google server-side.
Is GoHighLevel HIPAA compliant?
Not by default: HighLevel says its accounts “are NOT HIPAA compliant by default,” and offers an optional HIPAA add-on that includes a signed BAA (HighLevel).
Is HubSpot HIPAA compliant?
HubSpot can store HIPAA-covered data on Enterprise subscriptions once a Super Admin turns on Sensitive Data, selects the Health/Medical Data and HIPAA-covered entity checkboxes, and accepts the BAA (HubSpot).
Which HubSpot plans can store health data?
The Enterprise editions of Marketing Hub, Sales Hub, Service Hub, Data Hub, Content Hub, Smart CRM and Revenue Hub, per HubSpot's Sensitive Data article (HubSpot).
Can I use GoHighLevel funnels for patient leads?
With the HIPAA add-on and its BAA in place, HighLevel can hold ePHI for you (HighLevel). Ad pixels on those funnel pages still report to the ad platform, so send booked appointments to Meta and Google server-side instead.
Do I need both a CRM BAA and a tracking BAA?
If both vendors receive PHI, yes: HHS says regulated entities must “enter into a business associate agreement (BAA) with these tracking technology vendors” when they receive PHI (HHS). Curve Compliance signs a BAA on every plan for the tracking side.
Does a marketing agency need its own BAA with the clinic?
HighLevel says the agency is a business associate and must be able to “provide your client Practice with a HIPAA Business Associate Agreement as well” (HighLevel).
Talk to Curve Compliance
Book a call. Want GoHighLevel bookings and HubSpot outcomes credited to the ads that drove them? Curve Compliance carries the click through to the booking, sends conversions to Meta and Google server-side with a fixed list of fields, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.