# BAA or HIPAA authorization: what covers an ad platform that receives PHI?

## Where readings differ

| Reading | What it holds | What it relies on | What it means for a design |
|---|---|---|---|
| A cautious reading | A platform that receives PHI while it delivers, optimises or measures the entity's campaign performs a function for the entity. It is a business associate for that function whether or not it signs. Without a BAA, PHI does not go to it. An authorization does not replace the BAA for that function. | The functional definition in 160.103; 164.502(e); the HHS statement on status by definition | PHI goes only to vendors under a BAA; other platforms receive data that is not PHI |
| A permissive reading | A patient may authorize a disclosure to a named recipient for the recipient's own use. A recipient that acts for itself is not a business associate for that use, so no BAA is needed for it. The authorization has to meet every element of 164.508. | 164.508(a) and (c); the definition's words "on behalf of" | A documented authorization program names each platform and each use, with revocation handled end to end |

**Where the readings collide.** A platform can optimize a campaign for an entity while using events to improve services for other clients. Whether those are distinct functions depends on the actual terms, reports and data paths. The parties may also characterize the same payment or in-kind benefit differently under the remuneration provisions.

## Questions to take to your counsel

1. For each recipient in our flow, is it acting on our behalf or for itself, function by function?
2. If a recipient does both, which of its functions need a BAA?
3. Does our authorization form meet 45 CFR 164.508(c), and does it need the marketing or sale statements?
4. Does any benefit we receive count as remuneration under the rule?
5. How must a revocation reach each recipient, and how fast?
6. Do the recipient's own terms forbid the data we plan to send, and what follows if they do?
7. Which state laws apply to the same flow in addition to HIPAA?

[Read the full checkpoint](https://adsovereign.com/blog/baa-vs-hipaa-authorization-ad-platforms) · [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/)