HIPAA-compliant marketing platforms: what "compliant" really means, and which vendors sign a BAA

The rule. HIPAA reaches vendors through the business associate definition. A business associate is a person who "creates, receives, maintains, or transmits protected health information" for a covered entity's regulated function. The term also covers listed services that involve PHI, such as consulting or data aggregation. A subcontractor that does the same for a business associate is also one (45 CFR 160.103).

The permission. A covered entity may disclose PHI to a business associate if it obtains "satisfactory assurance" that the vendor will safeguard it. Those assurances must be documented in a written contract that meets 164.504(e) (45 CFR 164.502(e)). The Security Rule repeats the duty for electronic PHI (45 CFR 164.308(b); 164.314(a)).

The contract. Under 45 CFR 164.504(e)(2), the agreement must set the permitted uses and disclosures and may not authorize anything the covered entity itself could not do. It must also bind the vendor to:

1. use or disclose PHI only as the contract or law allows;
2. use appropriate safeguards and comply with the Security Rule for electronic PHI;
3. report unauthorized uses and disclosures, including breaches of unsecured PHI;
4. pass the same restrictions to its subcontractors;
5. support access, amendment and accounting of disclosures;
6. open its books and records to the HHS Secretary;
7. return or destroy PHI at termination, if feasible.

What this means for a marketing tool. A platform becomes a business associate when it handles PHI for a covered entity, for example by storing a patient list, sending appointment emails or receiving events from a patient portal. A platform that receives no PHI needs no BAA for HIPAA purposes. The open question is usually whether the data that reaches the platform is PHI at all; our pixel problem reference covers that test for tags and the court ruling that narrowed it.

HHS has addressed vendor claims in three documents. Each is guidance, not regulation, and each carries a review date.

No certification. Asked whether entities must "certify" Security Rule compliance, HHS answered no. An entity may hire an outside firm for an evaluation. HHS "does not endorse or otherwise recognize" such certifications, and they "do not absolve covered entities of their legal obligations" (HHS FAQ, last reviewed 26 July 2013). A SOC 2 report or a HITRUST certificate is evidence about controls. It is not a HIPAA status; see ad tech compliance: PCI, HIPAA and SOC 2 for what each report covers.

Cloud providers and encryption. A cloud service that stores PHI for a covered entity is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key". The narrow "conduit" exception covers transmission-only services with no more than temporary storage (HHS cloud computing guidance, last reviewed 23 December 2022). The same guidance says using a cloud provider to maintain ePHI without a BAA violates 164.308(b)(1) and 164.502(e).

Tracking vendors. OCR's bulletin on online tracking technologies sets out three positions (HHS OCR tracking bulletin, last reviewed 26 June 2024):

1. Without a BAA and a Privacy Rule permission, PHI may go to a tracking vendor only with the individual's HIPAA authorization. Cookie banners "do not constitute a valid HIPAA authorization".
2. A vendor's promise to strip PHI after receipt is "insufficient".
3. If a tracking vendor will not sign, an entity may sign with another vendor, "for example a Customer Data Platform vendor", that de-identifies the data and passes only de-identified information onward.

Status. On 20 June 2024 the Northern District of Texas vacated the bulletin only where it treated an IP address plus a visit to an unauthenticated public page about health conditions or providers as PHI. HHS notes the order at the top of the page and says it "is evaluating its next steps" (HHS OCR tracking bulletin). The vacatur, as HHS describes it, does not mention the three vendor positions above.

HHS proposed on 6 January 2025 to rewrite parts of the Security Rule. One proposal would require a covered entity to obtain written verification from each business associate, at least once every 12 months, that it has deployed the technical safeguards in 164.312. The verification would include a written analysis by a person with cybersecurity expertise and a certification by a person authorized to act for the vendor (90 FR 898, proposed 164.308(b)(2)(ii)).

Status on 9 November 2026. Comments closed on 7 March 2025. No final rule has appeared in the Federal Register. The 2026 Unified Agenda lists the item as a long-term action with final action in July 2027 (RIN 0945-AA22, accessed 9 November 2026). Until a final rule takes effect, the current text of 164.308(b) and 164.314(a) applies.

The tables record what each vendor publishes. "Yes" means the vendor's own page says it will sign a BAA for the named products; it does not mean we verified the vendor's safeguards. "No public offer found" describes the vendor's public pages, not private negotiations. We read every page on the date shown in the Sources list.

Three patterns stand out. Coverage is set per product, so one vendor can be "Yes" for a CDP and absent for its analytics tool, as Adobe is. Coverage is often set per plan or instance, as with HubSpot, Braze, Mixpanel, Segment and Stape. And several vendors that sell to healthcare publish no BAA offer at all. For clean rooms specifically, see the AWS Clean Rooms profile and our comparison of clean rooms vs CDPs.

None of the ad platforms below publishes a BAA offer for its advertising products that we could find. Only Google states in public that it does not offer one, and that statement concerns Google Analytics. The others restrict health data through their terms and policies, which is a different instrument from a BAA.

What changes the answer. A platform without a BAA can still appear in a lawful setup if nothing it receives is PHI. That is the logic of OCR's de-identifying CDP route and of contextual buying. The pixel problem in healthcare marketing lists the enforcement and class actions that followed when identifiable health events reached ad platforms anyway.

A signed BAA answers one question: may this vendor hold PHI for the covered entity. Four other questions remain.

Is the use itself permitted? A BAA "may not authorize the business associate to use or further disclose the information in a manner that would violate" the Privacy Rule if the covered entity did it (45 CFR 164.504(e)(2)(i)). A campaign that counts as marketing still needs patient authorizations, unless an exception applies. The HIPAA marketing rule sets out the definition, exceptions and form.

Where does the data go next? Many marketing tools exist to forward data to other tools. Each downstream recipient of PHI needs its own permission, and a subcontractor needs a BAA with the vendor (45 CFR 164.502(e)(1)(ii)).

Does state law apply? Washington's My Health My Data Act lets a processor handle consumer health data "only pursuant to a binding contract" that sets processing instructions (RCW 19.373.060). A brand outside HIPAA, such as a drug maker or many telehealth companies, relies on that kind of processor contract rather than a BAA where the Act applies to it. The state health privacy laws tracker lists the states.

Does the FTC rule apply instead? The FTC's Health Breach Notification Rule "does not apply to HIPAA-covered entities" or to business associates acting as such (16 CFR 318.1). It covers vendors of personal health records and related entities, which includes many consumer health apps. Our planned pages on pharma programmatic advertising and telehealth advertising rules cover those cases.

The checklist below is practice, not law. It describes what procurement and privacy teams commonly ask, and it maps each question to the rule it tests. It does not say which answer is acceptable in a given organization.

The same test applies to service firms. An agency, consultancy or data company that creates, receives, maintains or transmits PHI for a covered entity meets the business associate definition, including when it acts as a subcontractor of another vendor (45 CFR 160.103). An agency that only buys contextual media and receives no patient data does not.

A worked example shows how the label can mislead. A hospital hires an agency that "is HIPAA compliant". The agency signs a BAA, then uploads the hospital's patient list to an ad platform that offers no BAA and bars health data in its terms. The agency's BAA does not make that upload a permitted disclosure. The upload's lawfulness turns on whether the list is PHI and which permission covers it.

1. 45 CFR 160.103, Definitions (business associate; subcontractor). eCFR, text current to 5 November 2026, read 9 November 2026. https://www.ecfr.gov/current/title-45/section-160.103
2. 45 CFR 164.502(e), Disclosures to business associates. eCFR, read 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.502
3. 45 CFR 164.504(e), Business associate contracts. eCFR, read 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.504
4. 45 CFR 164.308(b), Business associate contracts and other arrangements (Security Rule). eCFR, read 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.308
5. 45 CFR 164.314(a), Organizational requirements. eCFR, read 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.314
6. 45 CFR 164.514, De-identification of protected health information. eCFR, read 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.514
7. HHS, FAQ "Are we required to 'certify' our organization's compliance with the standards of the Security Rule?" (content last reviewed 26 July 2013). https://www.hhs.gov/hipaa/for-professionals/faq/are-we-required-to-certify-our-organizations-compliance-with-the-standards/index.html
8. HHS Office for Civil Rights, "Guidance on HIPAA and Cloud Computing" (content last reviewed 23 December 2022). https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html
9. HHS Office for Civil Rights, "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates" (content last reviewed 26 June 2024, with a note on the 20 June 2024 vacatur). https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
10. HHS, "HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information", proposed rule, 90 FR 898 (6 January 2025). Federal Register. https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information