HIPAA-Compliant Lead Capture and Data Routing for Medical Device Manufacturers
Standard lead capture forms risk HIPAA violations: they can expose Protected Health Information (PHI) to non-compliant environments without anyone noticing. For a medical device manufacturer, we built a secure routing system using Formstack and Salesforce to isolate PHI.
Custom JavaScript preserves HubSpot tracking cookies across domains. That keeps compliance strict without sacrificing marketing attribution.
Executive Summary
Context
A manufacturer and direct-to-consumer provider of portable oxygen concentrators needed to move its web presence from WordPress to HubSpot. Lead volume was high, and many of those leads required prescriptions and medical history.
What We Built
We deployed a hardened data-routing architecture that used Formstack for sensitive lead capture, Salesforce for secure data storage, and custom JavaScript to preserve HubSpot marketing attribution across domain boundaries.
Tech Stack
- HubSpot CMS: Frontend hosting and non-sensitive lead capture
- Formstack: HIPAA-compliant form processing
- Salesforce: Secure system of record for PHI
- BigCommerce: eCommerce engine for non-prescription equipment sales
- Custom JavaScript: Cross-domain cookie and email-to-form mapping
Not a fit if your lead capture never touches protected health information, since the entire isolation architecture here exists to keep PHI out of a non-compliant system; without that risk, routing forms through a separate compliant processor adds complexity for no benefit. It also assumes paid marketing drives those forms: without campaign attribution to protect, preserving the tracking cookie handshake across the compliance boundary delivers little value.
The Challenge
HIPAA constraints created a direct gap in attribution. Standard HubSpot forms couldn't be used, because capturing patient health data, even temporarily, violates compliance if that data touches a non-HIPAA-certified environment, and moving leads to an external compliant form usually loses the tracking cookie instead. The marketing team could see that a conversion happened but couldn't trace it back to a specific ad campaign or source. The client first proposed a "capture and clean" workflow: funnel sensitive data into HubSpot, then delete it through automation. We flagged that as a major compliance risk and rejected it.
Our Approach
We shifted the strategy to a strict isolation model. Rather than sanitizing data inside HubSpot, we moved the compliance boundary to the front end: all medical quizzes and RX-support forms were hosted in Formstack and embedded via JavaScript on HubSpot CMS pages. To solve the attribution loss, we built a custom script that captured the user's email address and set the HubSpot tracking cookie during the first interaction, then passed that identifier as a hidden field into the secure Formstack environment. That created a handshake between marketing and sales data, and sensitive health information never touched the HubSpot database.
This engagement is part of our systems integration work for healthcare & wellness organisations.
Impact
Structural Compliance Integrity
The final architecture isolated all PHI within Salesforce and Formstack. Zero sensitive data entered the HubSpot portal, and the frontend on the HubSpot CMS kept working.
Tracking Restored for 7 Core Conversion Goals
Custom JS mapped cookies across platform boundaries. That restored tracking for 7 core conversion goals, including the critical patient-intake quiz and short-term rental forms.
560+ Leads in One Month at $55.65 CPA
The revamped data flow supported a Facebook lead generation campaign. It delivered 560+ new leads in a single month at a verified CPA of $55.65.
Form Data in Salesforce on Submission
Form data reached Salesforce the moment a form was submitted, which gave the sales team's sub-10-minute response target a timestamp to be measured against.
To prevent anonymous conversions, custom JavaScript captures the HubSpot utk and email address at the start of the session. These values are passed through the Formstack embed as hidden fields, allowing Salesforce to reconcile the marketing source with the patient record.
A "capture and clean" workflow would have let patient health data touch HubSpot, and we rejected it as a compliance risk. Now the medical forms are hosted in Formstack, so the compliance boundary sits at the front end. A script sets the HubSpot tracking cookie on first interaction and passes it as a hidden field. Attribution survives, and the health data goes only to Salesforce.
FAQ
We use a custom JavaScript pre-capture method: before the user interacts with the HIPAA form, the script identifies the HubSpot tracking cookie and stores it as a temporary variable. When the user submits the Formstack form, that cookie ID is sent as a hidden field into Salesforce, allowing the RevOps team to link the CRM record back to the original ad click or organic search session.
In 2019 HubSpot would not sign a business associate agreement, so PHI passing through it, even for a few seconds, would have put the client outside HIPAA. Location matters more than duration, because regulatory bodies look at where the data was processed as much as where it ends up. Our architecture keeps sensitive data from ever touching the HubSpot servers, so the marketing portal stays clean and audit-ready.
