BAA or HIPAA authorization: what covers an ad platform that receives PHI?

The Health Insurance Portability and Accountability Act (HIPAA) rules distinguish the recipient’s functions from the form used to document a disclosure. Protected health information (PHI) is the starting point. A platform can receive different fields for delivery, reporting and its own research, and those uses warrant separate descriptions. The same company name can appear at several steps in the map. 45 CFR 160.103.

The Department of Health and Human Services (HHS) explained in its 2013 final rule preamble that business associate status follows the definition. An executed contract documents the arrangement, while the work itself supplies facts for the classification. A business associate’s own uses of PHI are limited by the rule and its arrangement. 78 FR 5566, 5598; 45 CFR 164.502(a)(3).

Two financial questions deserve their own entries in the map. One concerns remuneration from a third party for a marketing communication and the other concerns remuneration for the disclosure itself. The definitions and exceptions differ. The marketing definition excludes specified treatment, care coordination and own health-related service communications, subject to its remuneration terms. 45 CFR 164.501, marketing; 45 CFR 164.502(a)(5)(ii); 45 CFR 164.508(a)(3)–(4).

The authorization rule asks for the information involved, the parties, purpose, expiry, signature and date. Its required statements address revocation, conditioning and possible redisclosure. Revocation is subject to the rule’s reliance and insurance exceptions. The rule generally limits conditioning treatment, payment, enrollment or benefit eligibility on signing, subject to specified exceptions. 45 CFR 164.508(b)(4)–(5), (c).

Consider a health system hiring an outside service to report conversions. The work order might show that the system sets the goals and receives detailed reports. A second set of terms might say the recipient uses events to improve models used across clients. Counsel can assess the role for each activity and how the disclosure is documented.

Where the readings collide. A platform can optimize a campaign for an entity while using events to improve services for other clients. Whether those are distinct functions depends on the actual terms, reports and data paths. The parties may also characterize the same payment or in-kind benefit differently under the remuneration provisions.

• Who sets campaign parameters and approves changes?
• Which reports or row-level data return to the covered entity?
• Where do platform terms describe reuse for models or other advertisers?
• Which payments or in-kind benefits are tied to the communication or disclosure?
• What information, parties, uses and dates does the authorization describe?
• Where is a revocation recorded, and how fast does it reach each recipient?
• Which recipient terms limit the fields that can be sent?
• Are the events on public pages, authenticated pages, or both?

The same integration can have a payload for conversion delivery and a different payload for support logs. A capture of one successful request tells counsel little about a retry or a debug export. Keeping those examples separate helps show which recipient saw which fields and for what purpose.

A dated form is useful alongside the actual interface and a revocation test. The form sets out the statement made to the individual. A record of the event and the recipient’s response shows how the system handles that statement in practice. These records can distinguish data sent before a revocation from attempts that occur after it.

Payment records can separate a service fee from a benefit tied to access to the data. For example, a contract might price campaign reporting independently from a credit contingent on sending more events. Counsel can compare the contract to the invoice and use the rule’s definitions for each payment. An authorization record and a service record can refer to the same platform without covering the same activity. In an illustrative campaign, a system sends a conversion event for its own reporting and later lets the recipient combine events across customers. The reported fields and the recipient’s independent use belong on separate rows of the fact sheet.

A team can also distinguish between a clause that describes allowed functions and the identity of the party actually performing them. A subcontractor might handle storage or report generation under different terms. The map can show the signed agreements beside the request chain so counsel can compare the stated service with the observed roles.

That distinction gives counsel a record of both the agreement and the actual service.

1. For each recipient in our flow, is it acting on our behalf or for itself, function by function?
2. If a recipient does both, which of its functions need a BAA?
3. Does our authorization form meet 45 CFR 164.508(c), and does it need the marketing or sale statements?
4. Does any benefit we receive count as remuneration under the rule?
5. How must a revocation reach each recipient, and how fast?
6. Do the recipient's own terms forbid the data we plan to send, and what follows if they do?
7. Which state laws apply to the same flow in addition to HIPAA?

Bring the fact sheet from the counsel briefing kit so that counsel answers your flow, not a generic one.

Download these questions

A system can trade audience precision for simpler data boundaries or trade vendor choice for more control of a service. A choice-based program adds a separate workflow for forms, expiry and revocation. The business question is how much the added delivery or measurement is worth, given those operating costs and uncertainties.

Changing the downstream vendor can also change the question even if the campaign looks the same to the patient. A buyer could switch to a different reporting provider or discover that the current one changed its model-training terms. The approval record can identify the specific functions and version of the data flow it addresses.

Which option fits is a business decision taken with counsel. It depends on how much the program is worth to you, how much uncertainty you accept and who signs for it.

On 20 June 2024 the Northern District of Texas vacated the portion of the HHS tracking guidance concerning a particular combination of an internet protocol address and a visit to an unauthenticated public page. The decision addressed the guidance’s treatment of that combination. It did not classify the actual fields in a separate campaign. American Hospital Association v. Becerra, No. 4:23-cv-1110-P, pp. 31–32, checked 10 November 2026.

Related references

• ad tech compliance guide
• ad tech legal checkpoints index
• counsel briefing kit
• HIPAA and advertising reference
• healthcare tracking pixel reference
• baa
• phi
• hipaa
• hipaa marketing rule
• marketing platform BAA reference

1. 45 CFR 160.103, business associate definition. Checked 10 November 2026.
2. 45 CFR 164.502(e)(1)–(2). Checked 10 November 2026.
3. 45 CFR 164.504(e)(2). Checked 10 November 2026.
4. 45 CFR 164.508(a)(3). Checked 10 November 2026.
5. 45 CFR 164.508(a)(4), (c). Checked 10 November 2026.
6. HHS, 2013 HIPAA Omnibus Final Rule, 78 FR 5598. Checked 10 November 2026.
7. 45 CFR 164.501, definition of marketing. Checked 10 November 2026.
8. 45 CFR 164.502(a)(3), (a)(5)(ii), uses and disclosures. Checked 10 November 2026.
9. 45 CFR 164.514(a)–(c), de-identification. Checked 10 November 2026.
10. N.D. Tex., American Hospital Association v. Becerra, No. 4:23-cv-1110-P, pp. 31–32. Checked 10 November 2026.