{"page":"/blog/baa-vs-hipaa-authorization-ad-platforms","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Reading","What it holds","What it relies on","What it means for a design"],"rows":[["A cautious reading","A platform that receives PHI while it delivers, optimises or measures the entity's campaign performs a function for the entity. It is a business associate for that function whether or not it signs. Without a BAA, PHI does not go to it. An authorization does not replace the BAA for that function.","The functional definition in 160.103; 164.502(e); the HHS statement on status by definition","PHI goes only to vendors under a BAA; other platforms receive data that is not PHI"],["A permissive reading","A patient may authorize a disclosure to a named recipient for the recipient's own use. A recipient that acts for itself is not a business associate for that use, so no BAA is needed for it. The authorization has to meet every element of 164.508.","164.508(a) and (c); the definition's words \"on behalf of\"","A documented authorization program names each platform and each use, with revocation handled end to end"]],"sourceUrls":[[],[]]}