{"page":"/blog/baa-vs-hipaa-authorization-ad-platforms","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Option","What it gives the business","What stays open","How hard it is to reverse"],"rows":[["Context and aggregate data without PHI sent to platforms","Use page context or aggregate outcomes without sending patient-level records to a platform.","The payload and reports still need classification.","Delivery rules can change quickly, while past copies need separate handling."],["PHI limited to vendors under a BAA for the function","Use campaign functions within a defined service relationship.","The agreement, roles and actual downstream uses still matter.","Replacing a vendor can require migration and contract closeout."],["Authorization-based program for named recipients","Build a program around recorded choices and named recipients.","Authorization terms, mixed functions and revocation need review.","New sends can stop, but existing disclosures and reliance remain factual questions."]],"sourceUrls":[[],[],[]]}