HIPAA and Your Marketing Tools: Why Signing a BAA Is Not Enough

When practices evaluate a marketing tool, the first question is usually, "Will they sign a BAA?" A recent MarTech article by a data and analytics executive argues that is the wrong first question. A business associate agreement (BAA) is a contract. It does not by itself make a tool compliant.

Five myths worth retiring

1. "We signed a BAA, so we're covered." A BAA covers the vendor that signed it. It does not cover the ad platform you send audiences to, or a tracking pixel someone added last quarter.
2. "De-identified data is not PHI." True only if it is truly de-identified under HIPAA's methods. Hashing an email is not de-identification; in marketing, hashing exists so records can be matched.
3. "IP addresses and device IDs aren't PHI." Alone, maybe not. Next to health context, such as booking a visit or entering symptoms, they can be. A 2024 court ruling narrowed federal tracking guidance for public pages, but pages where people book care or enter symptoms remain a concern.
4. "Server-side tagging solves it." It changes where data is collected, not what gets sent onward. Sending PHI to a vendor without a BAA is the same disclosure through a different pipe. Its real value is giving you a place to filter data before it leaves.
5. "Our privacy policy covers this." Sharing PHI with a third party for marketing generally requires a HIPAA authorization with specific required elements. A privacy policy or cookie banner is not one.

What a BAA does and doesn't do

A BAA sets what the vendor may do with PHI and binds it to HIPAA's rules. It does not fix a structural problem, expand what HIPAA allows, transfer your own obligations such as your risk analysis, or necessarily cover every product or feature the vendor sells.

Lawsuits are a bigger risk than regulators

The article notes that class actions under state wiretap and medical-confidentiality laws have been a larger financial exposure since 2022, and that claims can reach back to when tracking first started. An old tag nobody remembers is still a liability.

Where to start

1. Inventory every tag, pixel, and script on your website and booking pages, including ones nobody remembers adding.
2. Note what each one sends and from which pages.
3. Check each vendor for a BAA that covers the specific product you use, and whether the use itself is permitted.
4. Be careful with ad audiences. Uploading patient lists to an ad platform is a common gap.
5. Document your reasoning. A written, good-faith review holds up better than an unwritten assumption.

A word on AI vendor contracts

If you use an AI tool that touches patient information, the breach-notification terms in the contract matter. HIPAA's Breach Notification Rule sets a 60-day outer limit for covered entities to notify affected individuals, and a recent startup-industry article reports that enterprise buyers increasingly negotiate much shorter windows with AI vendors, such as 24 to 72 hours. Ask what your vendor commits to, when their clock starts, and who pays for the investigation.

Quantum Clinical Advisors helps practices review their websites and marketing tools for privacy risk. This post is general information, not legal advice. Work with a qualified HIPAA attorney or compliance professional for your specific situation.