Of eight marketing, automation, advertising and analytics vendors checked, five sign a Business Associate Agreement (BAA) under conditions: a specific plan, an add-on, or a request to the vendor. Two do not sign one, and one is unknown. A BAA covers the vendor's product on the plan named in the agreement. It does not cover a campaign, an ad audience, a tracking pixel or an agency's workflow.
HIPAA-compliant marketing: vendors with a BAA compared (summary)
8 vendors are compared here. One signs a BAA on all plans on request (Constant Contact). Four sign on specific plans or with an add-on (GoHighLevel, HubSpot, Piwik PRO, ActiveCampaign). One is unknown (Mailchimp), meaning no published BAA terms were found to support a verdict. Two do not sign (Google Ads, Google Analytics).
Each verdict reads "BAA available on plan X for services Y", never "HIPAA compliant" as a property of a product. The page reports the vendors' published terms and does not audit them. It is a reference, not legal advice. Other categories are listed under HIPAA-compliant software by category.
This directory is published by Chanty, Inc. Placement in any table never depends on payment or on Chanty's interest, and Chanty is not a vendor in this category.
Quick answer: which marketing platforms sign a BAA, and from which plan
S for every vendor are collected in all vendor HIPAA checks.
- GoHighLevel: conditional. BAA on any plan with the HIPAA Compliance add-on.
- HubSpot: conditional. BAA on Marketing Hub Enterprise.
- Piwik PRO: conditional. BAA on Enterprise.
- ActiveCampaign: conditional. BAA on Enterprise.
- Constant Contact: conditional. BAA on all plans, on request.
- Mailchimp: unknown. No published BAA terms found.
- Google Ads: no.
- Google Analytics: no.
Comparison table
| Vendor | Verdict | BAA from plan | How to obtain | Pricing from | Encryption at rest | Audit log | SSO | SOC 2 | Last verified |
|---|---|---|---|---|---|---|---|---|---|
| GoHighLevel | Conditional | Any plan with HIPAA Compliance add-on | Self-serve: purchase add-on, sign BAA in Settings > Compliance (Agency view); HIPAA activates automatically, each sub-account enabled manually | $97/month Starter plan + $297/month HIPAA add-on ($2,970/year) | Yes | Yes | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| HubSpot | Conditional | Marketing Hub Enterprise | A Super Admin turns on Sensitive Data Protection in Settings > Security > Sensitive Data, selects Health/Medical Data and the 'We are a HIPAA-covered entity or business associate' checkbox, then accepts the Sensitive Data Terms and the Business Associate Agreement in the same flow (a PDF copy is available for Enterprise customers). | $150/seat/month (Sales Hub Enterprise or Service Hub Enterprise; plus one-time $3,500 Enterprise onboarding) | Yes | Yes | Yes | Yes | 2026-10-19 |
| Piwik PRO | Conditional | Enterprise | Via sales on Enterprise; downloadable BAA to countersign during the Business free trial | EUR 366/month billed annually (Enterprise) | Yes | Not published by the vendor | Yes | Yes | 2026-10-28 |
| ActiveCampaign | Conditional | Enterprise | Via sales on an eligible (Enterprise) plan; signed before PHI is stored or sent | Not published by the vendor | Yes | Not published by the vendor | Yes | Yes | 2026-10-28 |
| Constant Contact | Conditional | All plans (on request) | Email [email protected] to request the standard BAA before using the services with subscribers; return the signed agreement to the same address | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-20 |
| Mailchimp | Unknown | — | — | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-20 |
| Google Ads | No | — | — | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| Google Analytics | No | — | — | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
"—" means there is no plan to report. Every verdict needs the vendor's own BAA or trust page with a date. Where no source supports a verdict, it stays "unknown".
Vendors that do not sign a BAA
Google Ads: no. Google Analytics: no. Advertising and analytics products mostly refuse a BAA, and these two are examples. If a clinic uses them, patient-identifiable data should not enter them, and a BAA from another vendor in the stack does not change that.
Mailchimp: unknown. no published BAA terms were found, so the page cannot give a yes or no. For an evaluator, "unknown" means do not use the product with PHI until a signed BAA is on file for the exact plan. It does not mean "no" or "yes".
Tracking technologies on patient pages. HHS has warned that tracking technologies on patient-facing pages can expose PHI. A pixel on an appointment-booking or patient-portal login page is the typical case. No BAA from a marketing vendor covers it.
What counts as HIPAA-compliant marketing platforms
Marketing touches PHI more often than teams expect:
- A patient contact list uploaded for a recall campaign.
- An appointment-reminder sequence built from scheduling data.
- A pixel on a booking page that records which service a visitor viewed.
- A form on the website that feeds a CRM.
The vendor must sign a BAA for the specific product and plan in use. Read the business associate agreement guide and the HIPAA glossary for PHI and BAA terms. Appointment-based messaging raises its own questions, covered in appointment reminders and HIPAA.
Typical exclusions are advertising products, analytics products, free tiers and tracking pixels on patient pages. Third-party integrations are also outside a vendor's BAA unless each integration has its own.
The topic variants come down to two questions: does PHI enter the tool, and is there a BAA for it?
- Marketing automation and email: these tools hold contact lists and send messages, so a BAA for the plan is the first check. The table above covers them.
- Agencies: an agency that sees patient lists, call recordings or form submissions is a business associate in its own right and needs its own BAA. This page holds no agency data and makes no claim about any agency being "certified."
- SEO and AEO: content and keyword work usually involves no PHI. The risk comes from analytics, heatmaps and form tools on the site.
- Lead generation: purchased or shared lead lists, including Medicare leads, raise permission questions beyond the BAA.
- Review responses: replying to a review can confirm that someone is a patient. A BAA does not make a response safe. Avoid confirming care details in public replies.
- Patient testimonials: these generally need the patient's written authorization.
- Personalization: behavioral targeting built on patient data needs a BAA for every tool in the chain and a permitted purpose.
- Social media: this is a policy question for staff. Workflows should keep PHI out of posts, comments and direct messages on platforms that do not sign a BAA.
How to choose
- Confirm the BAA covers your exact product and plan before any PHI is loaded. A BAA on HubSpot Marketing Hub Enterprise says nothing about other tiers.
- Check for an add-on or a sales contact. GoHighLevel's HIPAA Compliance add-on and HubSpot's onboarding fee change the total cost. Price the whole arrangement, not the entry plan.
- Decide whether PHI needs to enter marketing at all. Patient-identifiable data may not belong in ad or analytics tools. A newsletter can often run on a list of people who opted in without appointment or diagnosis data.
- Review controls: encryption at rest, audit log, SSO, SOC 2 and data residency. Where the vendor publishes nothing, ask in writing.
- Keep a vendor inventory with the BAA date, the plan and the services covered. Review it whenever a plan or pricing tier changes.
- Require BAAs from agencies and subprocessors that handle patient data on your behalf.
Related
- HIPAA-compliant email marketing
- HIPAA-compliant CRM
- patient data security
- Marketing analytics has no category page on this site yet.
- How verdicts are sourced and dated: methodology.
FAQ
Which marketing platforms sign a BAA on every plan?
Constant Contact, on request. GoHighLevel requires the HIPAA Compliance add-on. HubSpot, Piwik PRO and ActiveCampaign tie the BAA to Enterprise.
Do Google Ads and Google Analytics sign a BAA?
No. Both are listed as "no" in the table.
What does a BAA add-on cost on GoHighLevel and HubSpot?
GoHighLevel: $97 for Starter plus a $297 add-on, shown as $2,970/year. HubSpot: $150/seat/month plus a $3,500 onboarding fee.
Is Mailchimp HIPAA compliant?
Unknown. No published BAA terms were found, so this page gives no verdict. Do not use Mailchimp with PHI until a signed BAA for your plan is on file.
Can I put patient email lists into a marketing platform if the vendor signs a BAA?
A BAA means the vendor can handle PHI for the covered product and plan. It does not mean every use is permitted. Check that the purpose is allowed, that you have any required authorization, that the plan is the one the BAA covers, and that connected integrations and agencies have their own BAAs.