Loading
HIPAA Compliant Conversion Data for HubSpot
Keep HubSpot as your CRM. For the leads, booked meetings and deal stages you choose to count, Hippo cleans each event before it sends Google Ads and Meta (Facebook) a conversion. You see which campaigns bring the deals that close, in a record you own, whoever runs your ads.
No annual contracts.
Transparent pricing.
We set it up for you.
HubSpot Is Not HIPAA Compliant by Default
HubSpot signs a BAA only for Enterprise subscriptions that turn on Sensitive Data, and it allows protected health information only in the features it lists as covered (as of 10/13/26).
BAA scope
HubSpot's BAA stops at its covered list
HubSpot's ads tools and tracking code are not on its list of covered features(opens in a new tab). As your settings and visitors' cookie consent allow, the tracking code collects page views with their full paths and IP addresses on every HubSpot plan.
Meta Pixel
HubSpot's Meta Pixel goes on every tracked page
HubSpot's Meta conversion events need a pixel installed through HubSpot, which HubSpot puts on every page that carries its tracking code(opens in a new tab). Page views start reaching Meta before any conversion event exists, and Meta's terms bar data that includes or is based on health information.
Enhanced conversions
HubSpot's Google sync uploads contact details
HubSpot's Google Ads conversion events use Google's enhanced conversions, uploading contact details such as email addresses, phone numbers, names and street addresses, hashed. Conversions related to health can't be used for measurement in enhanced conversions(opens in a new tab).
How Hippo sends Google Ads and Meta your HubSpot conversions
Your website
Book your appointment
Book now
Call us
Form
Booking
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google Ads and Meta
Form
Booking
We set it up.
We take the Google tag and the Meta Pixel off your pages, and HubSpot's tracking code off the pages you host outside HubSpot. We install Hippo on a subdomain of your domain and connect HubSpot to Hippo with your HubSpot admin. Your HubSpot forms stay.
HubSpot sends Hippo the lead.
Someone who clicked your ad fills in a HubSpot form or books a meeting, and weeks later the deal closes. HubSpot sends Hippo the form submissions, booked meetings and stage changes you choose to count.
Hippo cleans the event.
It passes on only the events you choose to count, each under a name that implies no condition, treatment or service.
Google Ads and Meta get the conversion.
Hippo sends it from its server and keeps its own record of it by the campaign that produced the lead. Whoever runs your ads sees the conversions arrive in Google Ads and in Meta's Events Manager.
HubSpot's own conversion events for Google Ads and Meta are switched off.
During setup we switch them off and remove the ad pixels installed through HubSpot, so HubSpot and Hippo do not both report the same lead. We also set the conversion actions HubSpot created in Google Ads to secondary or remove them.
What Google Ads and Meta receive
Sent
Sent: the HubSpot events you choose to count
Hippo sends Google Ads and Meta a conversion under a neutral name for each one, such as a form submitted, a meeting booked or a stage reached. On your pages, Hippo waits for consent where it is required.
Excluded
Excluded from conversion events
Names, emails, phone numbers, dates of birth and IP addresses. Hippo's conversion also carries no URL path, no form answers, and no deal name, stage name or notes.
Held
Held until you allow it
A HubSpot event Hippo doesn't recognize stays in Hippo, so a new form or a new pipeline stage can't start sending to Google Ads or Meta on its own.
Kept
Kept in Hippo, under your BAA
Hippo stores what it records, HubSpot events included, in its own storage under the BAA it signs with every customer, with a log of what Hippo sent Google Ads and Meta and what it removed first.
What health advertisers say about leads and forms
They can't tell what's working
Leads land in HubSpot, and many of them never become patients.
Just leads, not purchase. A smaller % of these leads will actually purchase.
Medical marketing agency owner CPL doesn’t matter until you can compare it to LTV or the true revenue that the lead would drive.
PPC practitioner Some leads don’t pick up, so quality vs intent is something we’re watching closely.
Weight-loss clinic marketer Details that travel past HubSpot
Forms ask for a name, number, email and date of birth, and integrations carry them further.
Can clients add info to HubSpot forms, or is it a HIPAA risk?
Business owner using HubSpot For HubSpot specifically, the part I'd watch is where that data can leak back out through search, workflows, forms, reporting, exports and integrations.
HubSpot consultant, healthcare setups I’m a little concerned sending PII for a healthcare product or service to Google.
PPC agency
HubSpot's tracking code in a privacy lawsuit
Axia Women's Health(opens in a new tab)
Pending
A patient alleges that HubSpot's tracking code on the women's health practice's website sent HubSpot the providers visitors clicked on its Find Care page and the terms they entered in its site search. Her complaint(opens in a new tab) also alleges that the practice could match patients' browsing on the site with their CRM records. Axia has asked the court to throw out the case, and the court has not ruled.
The complaint names HubSpot among the five trackers it lists on the practice's website.
See which trackers your site loads(opens in a new tab)What you get
HubSpot leads and deals, by campaign
Hippo ties each lead, booked meeting and deal it receives from HubSpot to the campaign that produced it, in a record you own, including a deal that closes weeks later.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of what Hippo sent Google Ads and Meta and what it removed first.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
Is HubSpot HIPAA compliant?
Not by default. HubSpot signs a BAA only for Enterprise subscriptions that turn on Sensitive Data(opens in a new tab), identify as a HIPAA covered entity or business associate(opens in a new tab) and accept the BAA in the account settings. Protected health information is then allowed only in the features HubSpot lists as covered, such as CRM records, forms, call recordings, integrations and workflows, and Sensitive Data for it is not available in all areas. Under HubSpot's terms, you decide(opens in a new tab) whether your use of HubSpot meets your compliance obligations.
HubSpot signed a BAA with us. Isn't that enough?
Not for your ads. HubSpot's BAA covers the protected health information HubSpot receives and maintains(opens in a new tab) through the features it lists, and data you send from HubSpot to another tool is handled under that tool's own policies(opens in a new tab). Its terms also bar protected health information in any feature outside the list(opens in a new tab). Meta Ads offers no BAA, and Google offers one for Local Services Ads and none for the Google Ads campaigns advertisers run on search, display and YouTube. The BAA you sign with Hippo covers Hippo. Google Ads and Meta are outside it, and Hippo controls only what it sends them, so it cleans each conversion before it leaves.
Can patients enter their details in our HubSpot forms, or is that a HIPAA risk?
Only under HubSpot's BAA. Forms and the forms API(opens in a new tab) are among the features where an Enterprise subscription that has turned on Sensitive Data and accepted HubSpot's BAA may keep protected health information. Your HubSpot forms stay after setup, and the conversion Hippo sends Google Ads and Meta carries none of the answers typed into them.
Does Hippo replace HubSpot? What happens to its tracking code?
No. Keep HubSpot as your CRM. HubSpot's tracking code is not on HubSpot's list of covered features, and as your settings and visitors' cookie consent allow, it collects page views with their full paths(opens in a new tab), IP addresses and other online identifiers, whatever your HubSpot plan. During setup we take it off the pages you host outside HubSpot. Hippo's script counts the conversions on your pages for Google Ads and Meta in place of the ad pixels installed through HubSpot, which come off too.
What stops working in HubSpot when the tracking code comes off?
On a page without the tracking code, HubSpot can't track traffic, page views, visitor activity or site events(opens in a new tab), its live chat won't load, and forms that are not HubSpot forms are not captured. HubSpot forms and the forms API still receive submissions, and an embedded HubSpot form needs your site's domain in HubSpot's tracking settings, or its submissions are marked as spam(opens in a new tab). Your contacts, deals and workflows stay in HubSpot. HubSpot adds its tracking code to the pages it hosts(opens in a new tab), so on a walkthrough we go through any pages you built in HubSpot.
HubSpot already sends our conversions to Google Ads and Meta. Will a lead count twice?
Not between HubSpot and Hippo. During setup we switch off the conversion events HubSpot sends to Google Ads and Meta and remove the ad pixels installed through HubSpot, so HubSpot and Hippo do not both report the same lead. Deleting a HubSpot event leaves the conversion action it created(opens in a new tab) in Google Ads, and Google Ads removes duplicates only within one conversion action(opens in a new tab), so we also set those old actions to secondary or remove them.
Can we keep HubSpot's enhanced conversions for Google Ads?
Not for health conversions. HubSpot's Google Ads events(opens in a new tab) use Google's enhanced conversions and upload contact details such as email addresses, phone numbers, names and street addresses, hashed. Conversions related to health can't be used for measurement in enhanced conversions, and once enhanced conversions are on in your Google Ads account, Google tags may detect user-provided data on your site(opens in a new tab). Hippo's conversions carry no names, emails or phone numbers, hashed or not.
What do Google Ads and Meta get from a HubSpot lead or deal?
Hippo sends them a conversion under a neutral name for the HubSpot events you choose to count, such as a form submitted, a meeting booked or a stage reached. Before Hippo sends it, it removes names, emails, phone numbers, dates of birth and IP addresses, and the conversion carries no form answers, deal names, stage names or notes. Hippo gives it a name that implies no condition, treatment or service, as Meta's terms require(opens in a new tab) of event names.
Can a deal that closes weeks later count back to the campaign?
In Hippo's record, yes. Hippo ties each HubSpot event it receives to the campaign that produced the lead, in a record you own, including a deal that closes weeks later. Google Ads records a conversion only inside the window set for its conversion action(opens in a new tab), which can run from 1 to 90 days, and Meta refuses an event whose time is more than 7 days before Hippo sends it(opens in a new tab).
Our agency runs HubSpot and the ads. Who sets this up?
We do. Whoever controls your domain adds a DNS record for your Hippo subdomain. We install Hippo, take HubSpot's tracking code off the pages you host outside HubSpot, connect HubSpot to Hippo with whoever administers your HubSpot account, and switch off HubSpot's conversion events for Google Ads and Meta. Your agency keeps running the campaigns and sees the conversions arrive in Google Ads and in Meta's Events Manager.
Meta restricted our events. Does sending them from HubSpot or a server get around that?
No. Meta's terms(opens in a new tab) apply to events from HubSpot like any other, and sending an event from a server changes the route and leaves what it carries as it was. Meta can restrict certain mid and lower funnel standard events(opens in a new tab) for sites in its health and wellness category, and under a restriction, custom events stay blocked(opens in a new tab) until you review and confirm them. Hippo cannot lift a category Meta assigns or restore an event Meta blocks, and it never renames an event to get past a restriction. You can ask Meta to review(opens in a new tab) the category. Hippo still records your HubSpot leads and deals by campaign, whatever Meta blocks.
Should we talk to a lawyer about our HubSpot tracking?
Yes, if you want to know how these laws apply to your business. This page describes HubSpot's terms, laws and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations. Hippolytics is not affiliated with, endorsed by or sponsored by HubSpot.
Hippo by industry
Therapists & Group Practices
See which campaigns bring new clients.
Addiction Treatment & Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Pharmacy
See which campaigns bring transfers and refills.
Mens Health
Compare acquisition across your campaigns.
Womens Health & Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology
Connect campaign spend to appointments.
Eye Care & LASIK
See which campaigns book consultations.
Imaging & Radiology
Measure calls and booking inquiries.
Primary Care & Multi Specialty Groups
See which campaigns bring new patients.
Urgent Care
See which campaigns bring walk-ins and online check-ins.
Labs & at Home Testing
Understand which campaigns drive inquiries.
Medicare & ACA Agencies
See which campaigns bring quote requests and calls.
Hospitals & Health Systems
Connect campaigns to appointment inquiries.
Consumer Apps & Devices
See which campaigns bring trials, subscriptions and orders.