How a 50-Person Health-Tech Company Built a HIPAA-Safe Notion Knowledge Hub
A 50-person health-tech company connected HubSpot and Zoom to a HIPAA-scoped Notion workspace in six weeks, with 12 months of customer history backfilled.
TL;DR: In about six weeks, a Connex consultant connected HubSpot and Zoom to a brand-new, HIPAA-scoped Notion workspace, backfilled 12 months of active companies and contacts, and moved past Zoom recordings into permission-controlled Notion records. A ~50-person team that had customer context scattered across four systems now has one place to look it up.
The client is a ~50-person health benefits technology company in the US. Because it handles protected health information for employers and their employees, HIPAA shapes every tool decision it makes.
The company was about to grow fast. Leadership planned to roughly double headcount toward 100 within a few months: 25 engineers, 5 to 10 sales reps, and new support staff. At the same time, it was leaving Microsoft Teams, SharePoint, OneDrive, and Confluence for Slack, Zoom, and Notion.
Some systems were staying put: HubSpot as the CRM, Zendesk for support, Jira for engineering, and Dialpad for sales and service calls. The company had already bought a 100-seat Notion Enterprise workspace and signed Business Associate Agreements (BAAs) with every vendor. The Notion workspace itself was nearly empty.
The problem
On the first sales call, the head of product and engineering described a 12-year-old company with a "debris field" of outdated data spread across tools. Customer context lived in at least four places:
Sales history in HubSpot, when it got logged at all. The sales team often didn't record activity, and many phone calls happened outside the system.
Support history in Zendesk, which sales couldn't easily see.
Conversations in Zoom and Dialpad recordings that nobody could search.
Old documents in SharePoint and Confluence that were on their way out.
The practical cost showed up in service. Support agents couldn't see what sales had promised a customer, so they had no early read on which accounts were at risk of churning.
The goal, in the client's own project brief, was to "create a single source of truth for customer context without replacing existing systems of record." They also wanted it automatic. Recordings and call data should flow into Notion without anyone having to remember to turn something on.
What they'd already tried
The usual shortcut was off the table. Zapier and Make, the automation tools most teams reach for first, don't sign BAAs, and neither does consumer ChatGPT, so none of them could touch this data. Slack huddles don't save audio or video, so they didn't solve the recording problem either.
The company had the licenses and the BAAs in place. What it didn't have was time. With a hiring wave weeks away, the head of product and engineering said plainly that they couldn't afford to stumble through iterations. They didn't want a template or a fixed-bid project. They wanted an expert who could design the right process and build it alongside their team.
What we built
A Connex consultant worked in short, recorded ZoomFlow sessions from late January to mid-March, often async because the client lead was working across time zones. Every integration ran through Keragon, a HIPAA-eligible automation platform the client had already licensed under a BAA, so protected data never passed through a non-covered tool.
1. A schema before any automation
Because the Notion workspace was brand new, the first session defined the data model: linked databases for companies, contacts, and customer interactions (meetings, calls, and support tickets). Every later sync writes into that structure, so Notion AI has clean, related records to search instead of loose pages.
2. HubSpot to Notion, without duplicates
Company and contact records sync from HubSpot into Notion automatically. Duplicates were the first real problem. The fix was to use email address as the unique key, search before creating anything, create a company from the email domain when no match exists, and run a background cleanup that merges duplicate companies. Each Notion record links back to HubSpot, which stays the system of record.
3. A 12-month backfill
New activity alone would have left the hub empty for months. The consultant backfilled every company and contact with activity in the past 12 months, so the team had useful history on day one.
4. Zoom recordings that live in Notion, not behind a link
This was the hardest part. Zoom transcripts and participants were straightforward to sync and match to contacts. The video files were not.
Storing a Zoom link meant access was controlled in Zoom, not Notion. The client wanted the actual files in Notion. Two technical limits got in the way: Notion's API expires any uploaded file that isn't attached to a page within one hour, and files over 20 MB have to be sent as a multi-part upload. Working with the client's DevOps lead, the consultant set up a path that stores each recording in a private Amazon S3 bucket under a unique key based on the meeting and file ID. An AWS Lambda function then issues short-lived pre-signed URLs and sends the video to Notion server-to-server, in parts. The client's own engineer built the Lambda function, so the infrastructure stayed in their AWS account.
One more limit shaped the backfill: the historical video import was scoped to the recordings the client's Zoom account could still return through the API.
5. Permissions built for PHI
Meeting records are visible only to the people who attended and to an administrator group. A simple flag lets a record be made public or kept private. A break-glass admin account gives DevOps full access when needed, and an audit trail tracks who accessed what.
Zendesk tickets and Dialpad calls were designed into the same interaction schema from the first session, so they plug in as the next sources without rework.
The results
These are real outcomes from the engagement, not estimates.
About six weeks from kickoff (late January) to all past Zoom recordings processed into Notion (mid-March).
12 months of active companies and contacts backfilled from HubSpot.
Automatic capture. New HubSpot records and new Zoom meetings land in Notion without anyone remembering to do it.
No duplicate sprawl. Email-based matching plus a background cleanup keeps one record per company and contact.
PHI stays controlled. Every data path runs through BAA-covered tools, recordings sit in the client's own storage, and access is limited to attendees and admins.
We haven't attached a dollar figure to this one. The client didn't share volume or time-per-task numbers, and we don't invent them. The value here is visibility: a service agent can open a company in Notion and see the contacts, the meetings, and the transcripts in one place, and Notion AI can search across all of it.
Client voice
In the kickoff brief, the head of product and engineering set the goal: to "turn our HIPAA scoped Notion instance into an AI-enabled knowledge hub." Midway through the build, the client approved additional hours to extend the scope to recording permissions and the historical backfill, and kept booking sessions through the final milestone. We didn't collect a formal testimonial, so this is drawn from the client's own brief and booking history.
FAQ
Can you use Zapier or Make with HIPAA data?
No. If the data includes PHI, every tool in the path needs a BAA. Zapier says it can't sign one, and Make doesn't publish one. In this project, all automation ran through Keragon, a HIPAA-eligible platform the client already had under a BAA.
Do we have to replace HubSpot or Zendesk to use Notion as a knowledge hub?
No. HubSpot and Zendesk stay the systems of record. Notion holds a linked, searchable copy of the context, with links back to the source.
How fast was the first measurable win?
The HubSpot company and contact sync was running within the first few weeks. Video was the slowest piece because of Notion's one-hour attachment window for uploads and the multi-part handling large files need.
What access did the consultant need?
Admin access to the Notion workspace, API credentials for HubSpot and Zoom, and upload details for an S3 bucket. The client's DevOps lead kept control of the AWS account and built the Lambda function.
💡
Vendor details (Notion API upload limits and Zapier, Make, and Keragon BAA availability) verified November 2026. Vendor terms change, so check current docs before you build.
Get help building a HIPAA-safe Notion knowledge hub
If your customer context is split across a CRM, a help desk, and a pile of call recordings, and compliance rules out the easy tools, we can help you design and build the hub. Book a free ZoomFlow call and we'll map your data model and BAA-covered integrations with you live.
An HVAC company lost in-app card processing. Zapier now sends ServiceTitan customers and invoices to Stripe as drafts, ready to charge, with no re-typing.
A small custom chocolate maker replaced a crashed order system and an MRP app with Airtable and Softr: per-product artwork approval plus live inventory.
How a branded-merchandise company used Make and Pipedrive to automate self-serve store onboarding: next-step emails, 24-hour reminders and a 48-hour drip.