{"page":"/blog/hipaa-compliant-marketing-platforms","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Question a buyer asks","Why it matters","Rule or guidance it tests"],"rows":[["Which exact products, plans and instances does the BAA cover?","Vendors limit coverage to listed services, tiers or \"HIPAA accounts\"","Vendor lists above; 164.502(e)"],["Will the vendor sign our BAA, or only its own template?","The contract must contain every 164.504(e)(2) element","45 CFR 164.504(e)(2)"],["Which subcontractors receive the data, and do they sign?","Restrictions must flow down to subcontractors","164.502(e)(1)(ii); 164.314(a)(2)(iii)"],["May the vendor use the data for its own products, models or benchmarks?","The BAA may permit only what the covered entity itself could do, plus limited management and data aggregation uses","164.504(e)(2)(i)"],["Which destinations does the tool forward data to by default?","Each onward recipient of PHI needs its own permission","OCR tracking bulletin"],["Does the vendor de-identify before or after it receives the data?","Removal after receipt is \"insufficient\" in OCR's view","OCR tracking bulletin; 45 CFR 164.514"],["What audit evidence covers the exact service bought?","Certifications do not establish HIPAA compliance; they show controls","HHS certification FAQ; see the planned SOC 2 for ad tech page"],["How fast does the vendor report incidents and breaches?","The covered entity's own notice clock depends on it","164.504(e)(2)(ii)(C); 164.410"],["What happens to data, copies and derived data at termination?","Return or destruction is a required term, if feasible","164.504(e)(2)(ii)(J)"],["Does the contract also meet state processor rules?","Consumer health data laws use their own contract terms","RCW 19.373.060"]],"sourceUrls":[[],["https://www.ecfr.gov/current/title-45/section-164.504"],["https://www.ecfr.gov/current/title-45/section-164.502","https://www.ecfr.gov/current/title-45/section-164.314"],[],[],["https://www.ecfr.gov/current/title-45/section-164.514"],[],[],[],["https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.060"]]}