Unknown Checked 2026-10-20. Mailchimp publishes no BAA for any plan, and its Data Processing Addendum prohibits providing health information as Sensitive Data. Until Mailchimp confirms otherwise in writing, treat it as a tool that must not receive PHI.
Short answer
Mailchimp makes no public statement that it signs a BAA. Its Terms make the customer responsible for whether the service suits HIPAA obligations and disclaim Mailchimp's liability for that risk. Its DPA lists Sensitive Data, including health information, as data the customer must not provide. No plan is listed as "BAA available on plan X for services Y."
Other vendors with a published BAA are on the Is it HIPAA compliant? All vendors hub.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| No plan named: no BAA published | Not published by the vendor | Not published by the vendor | Not published by the vendor |
Mailchimp is owned by Intuit Inc. This is context only and does not change the verdict. For the terms "BAA" and "PHI," see the HIPAA glossary: BAA and PHI.
What the BAA covers and what it excludes
Covered services: none published.
Exclusions:
- Processing of Sensitive Data, including health information, is prohibited under the DPA.
Email addresses and campaign content tied to a patient relationship may be PHI, for example a list of patients who booked a colposcopy or a reminder naming a treatment.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Published controls would not substitute for a BAA. Without one, a vendor's security features do not make it a permitted place for PHI.
How to use Mailchimp with PHI
Compliance depends on a signed BAA, your configuration and your policies. With no BAA published, the safe use is non-PHI marketing only. Checklist for the privacy or practice owner:
- Keep PHI and health information out of lists, merge fields, tags, segments and campaign content. A tag such as "diabetes program" or a merge field with an appointment type is health information tied to a person.
- Keep only non-PHI marketing data in Mailchimp, such as newsletter subscribers who are not segmented by treatment or patient status.
- Get written confirmation from Mailchimp before any PHI use. None is published.
- Have the privacy officer record the decision and the data allowed in the vendor inventory.
- Review what syncs in from integrations, website forms and intake or scheduling tools. A form that feeds a list can carry health details into Mailchimp without anyone deciding to send them.
- Train front-desk and marketing staff on what may not be uploaded, including CSV exports from the practice management system.
More on vendor reviews and shared responsibility is in the HIPAA guides.
Alternatives with a BAA
These email and marketing tools publish a BAA path. Verdicts and starting plans come from each vendor's own card. Order is alphabetical and has no ranking meaning.
- ActiveCampaign: conditional; BAA starts on Enterprise.
- Constant Contact: conditional; BAA on request, all plans.
- GoHighLevel: conditional; any plan with the HIPAA Compliance add-on.
- HubSpot: conditional; BAA starts on Marketing Hub Enterprise.
- Paubox: yes; BAA starts on Email Suite Standard.
Compare them in HIPAA-compliant email marketing tools and HIPAA-compliant marketing software.
Sources
- Mailchimp Standard Terms of Use, Section 21 (Compliance with Laws and Regulations) — Terms, checked 2026-10-20. "You're responsible for determining whether the Service is suitable for you to use in light of your obligations under any regulations like HIPAA, GLBA, Data Protection Laws"
- Mailchimp Standard Terms of Use, Section 21 — Terms, checked 2026-10-20. "If you're subject to regulations (like HIPAA) and you use the Service, then we won't be liable if the Service doesn't meet those requirements."
- Mailchimp Data Processing Addendum, Section 2.3 (Prohibited Data) — Terms, checked 2026-10-20. "Customer will not provide (or cause to be provided) any Sensitive Data to Mailchimp for processing under the Agreement,"
- Mailchimp Data Processing Addendum, Section 1 (Sensitive Data definition) — Terms, checked 2026-10-20. "(c) employment, financial, credit, genetic, biometric or health information;"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
Changes: No changes recorded since first verification on 2026-10-20.
Does Mailchimp sign a BAA?
No BAA is published for any plan, so the verdict is unknown. Written confirmation from Mailchimp would be required, and none is published.
Can I put patient or health information in Mailchimp?
Not on the published terms. The DPA prohibits providing Sensitive Data, including health information, to Mailchimp. This applies to appointment reminders that name a treatment as well as to patient lists segmented by condition. For everyday email, see Is Gmail HIPAA compliant?
What do Mailchimp's Terms say about HIPAA?
Section 21 puts responsibility for HIPAA suitability on the customer and disclaims Mailchimp's liability. See the quoted passages in Sources.
Which email marketing tools offer a BAA instead?
ActiveCampaign, Constant Contact, GoHighLevel, HubSpot and Paubox publish a BAA path, each on the plan listed under Alternatives with a BAA. Each BAA must be signed before any PHI is sent.
HIPAA Compliant Wiki is published by Chanty, Inc. Chanty is listed as one vendor among others and plays no part in this verdict or in the order of alternatives. This page reports published vendor terms and is not legal advice.