ActiveCampaign offers a BAA on its Enterprise plan, obtained through sales, for email marketing and automation. Starter, Plus and Pro have no BAA, and the Conversations platform prohibits PHI under ActiveCampaign's own policy.
Is ActiveCampaign HIPAA compliant? BAA by plan, covered services and exclusions
Conditional A BAA is available on the Enterprise plan via sales; the main exclusion is the Conversations platform, where PHI is prohibited by policy. Verified 2026-10-28. See also All vendor HIPAA checks.
The wording that applies is: BAA available on Enterprise for email marketing and automation. It describes ActiveCampaign's published terms, not a certification or a property of the product.
Short answer
ActiveCampaign signs a BAA only for eligible plans. Its pricing page lists HIPAA support as an Enterprise feature, under "Single sign-on (SSO) and HIPAA support". The Conversations platform prohibits PHI under its own policy. No public Enterprise price is listed.
A BAA (see the HIPAA glossary (BAA, PHI)) is a precondition for handling PHI. It does not prove that a particular campaign, list or automation is set up compliantly.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Starter | Not available; HIPAA support is listed only for Enterprise | n/a | Not published by the vendor |
| Plus | Not available; HIPAA support is listed only for Enterprise | n/a | Not published by the vendor |
| Pro | Not available; HIPAA support is listed only for Enterprise | n/a | Not published by the vendor |
| Enterprise | Available | Via sales; signed before PHI is stored or sent | Not published by the vendor |
The Enterprise price is not public, and no add-on fee for the BAA is published.
What the BAA covers and what it excludes
Covered
- Email marketing and automation on eligible plans (Enterprise).
Excluded
- Starter, Plus and Pro plans.
- The Conversations platform. PHI is prohibited by the Conversations Policy.
The published terms do not state that the BAA extends to any other feature, so forms, SMS and integrations should not be treated as covered. Get written confirmation from ActiveCampaign sales before using them with PHI.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
The published encryption statement relates to forms hosted with SSL/TLS. It should not be read as a broader claim about every product component.
How to use ActiveCampaign with PHI
ActiveCampaign's BAA covers the vendor's side only. The covered entity or business associate still owns the rest. For a clinic that wants to send appointment reminders or recall emails from a patient list, the checklist looks like this (more in HIPAA guides):
- Confirm with sales that your account is on an eligible plan (Enterprise).
- Get the BAA signed before any PHI is stored or sent. Do not import a patient list first and sign later.
- Keep PHI out of Conversations, including chat on your website and any inbox-style messaging.
- Limit PHI in campaigns to what is needed. Where a message does not require clinical detail, leave it out of the subject line and body.
- Restrict who can access the account, and remove access promptly when staff leave.
- Review configuration and user access on a schedule, including anything connected to the account.
- Train staff and set written policies on what may be put into email campaigns and automations.
Compliance depends on the signed BAA, your configuration and your policies.
Alternatives with a BAA
Other marketing tools publish BAA terms. Listed in no particular order:
- Constant Contact: conditional; BAA on all plans on request.
- GoHighLevel: conditional; any plan with the HIPAA Compliance add-on.
- HubSpot: conditional; Marketing Hub Enterprise.
- Piwik PRO: conditional; Enterprise.
Compare more options in HIPAA-compliant software by category.
Sources
- Platform Pricing & Features — Pricing page, checked 2026-10-28. "Single sign-on (SSO) and HIPAA support."
- HIPAA-Compliant Marketing Guide: How to Run Privacy-First Campaigns — Vendor page, checked 2026-10-28. "Available on eligible plans to cover the use and disclosure of PHI."
- HIPAA-Compliant Marketing Guide: How to Run Privacy-First Campaigns — Vendor page, checked 2026-10-28. "ActiveCampaign's forms are hosted with SSL/TLS encryption, so data is protected both in transit and at rest"
- Conversations Policy — Terms, checked 2026-10-28. "protected health information as that term is defined in the Health Insurance Portability and Accountability Act"
- Security — Trust center, checked 2026-10-28. "ActiveCampaign is heavily focused on GDPR, SOC 2, and HIPAA compliance."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Does ActiveCampaign sign a BAA?
Yes, on eligible plans. A BAA is available on the Enterprise plan through sales, for email marketing and automation, and it should be signed before PHI is stored or sent. No Enterprise price or BAA add-on fee is published.
Which ActiveCampaign plans include HIPAA support?
Only Enterprise. The pricing page lists HIPAA support as an Enterprise feature, and the Starter, Plus and Pro plans have no BAA.
Can I use ActiveCampaign Conversations (chat) with PHI?
No. The Conversations Policy prohibits PHI on the Conversations platform, and Conversations is excluded from the BAA.
Does ActiveCampaign encrypt data in transit and at rest?
ActiveCampaign publishes both: encryption in transit and encryption at rest are listed as Yes. The encryption statement relates to forms hosted with SSL/TLS. Encryption is not a substitute for a signed BAA.