Conditional Verified 2026-10-20. Constant Contact makes a BAA available on request on all plans, by emailing [email protected]. The main exclusion is that PHI or sensitive health information must not be stored or transmitted through the service.
Short answer
Constant Contact signs a BAA on request, but only its own standard form, and only for email marketing to subscribers. Customers must not import or incorporate PHI beyond the fact that subscribers have a relationship with their business. The vendor states that it could be considered a business associate to certain customers that handle PHI.
For a clinic, this means a newsletter or an open-house announcement to your subscriber list can fall under a signed BAA. A list of patients with diagnoses, appointment reasons or treatment details cannot. For other tools, see All vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| All plans | Available on request | Email [email protected] before using the services with subscribers, then return the signed agreement to the same address | Not published by the vendor |
The vendor lists no excluded plans. Minimum seats: Not published by the vendor.
What the BAA covers and what it excludes
The terms below follow the vendor's published BAA article. For the defined terms, see HIPAA glossary: BAA and PHI.
Covered
- Email marketing to subscribers, using their contact information only.
Excluded
- Storing or transmitting PHI, or sensitive personal or health information of any kind.
- Any change to the standard BAA form. The vendor says it will only sign its own form.
Security controls the vendor publishes
Constant Contact's BAA article does not list technical controls. The vendor makes a general statement that it maintains administrative, physical and technical safeguards for subscriber data. That is a general statement of practice, not a certification or an attestation.
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
How to use Constant Contact with PHI
A signed BAA covers only part of the risk. These responsibilities stay with your organization:
- Request and sign the BAA before use. Email [email protected] before the first campaign goes to subscribers, and return the signed agreement to the same address.
- Keep lists to contact information only. A name and an email address is the scope the vendor describes.
- Do not import health data. Leave out diagnosis fields, medication names, appointment reasons, visit notes and procedure codes, including in custom fields and tags.
- Review what an email or list reveals. A message or a list segment can disclose health information even without a clinical field, for example a list called "Oncology follow-ups" or a reminder that names a specialty.
- Set internal policy and train staff. Front-desk and marketing staff need to know what may be exported from the practice management system into a campaign list.
- Keep the signed BAA in your vendor inventory. Record the signing date, the plan in use and the approved purpose, which is email marketing to subscribers.
Compliance depends on the signed BAA, your configuration and your policies.
Alternatives with a BAA
Constant Contact's BAA excludes PHI. If a workflow needs health information in the tool, these vendors publish different BAA terms, each with its own scope and exclusions:
- ActiveCampaign: conditional, BAA from Enterprise. Check page
- GoHighLevel: conditional, any plan with the HIPAA Compliance add-on. Check page
- HubSpot: conditional, Marketing Hub Enterprise. Is HubSpot HIPAA compliant?
- Paubox: yes, Email Suite Standard. Check page
- Piwik PRO: conditional, Enterprise. Check page
Browse the full lists in HIPAA-compliant email marketing tools and HIPAA-compliant marketing software.
Sources
- Business Associate Agreements (BAA) – Constant Contact Knowledge Base — Help article, checked 2026-10-20. "please contact us at [email protected] to request a business associate agreement"
- Business Associate Agreements (BAA) – Constant Contact Knowledge Base — Help article, checked 2026-10-20. "Constant Contact will only sign our business associate agreement."
- Business Associate Agreements (BAA) – Constant Contact Knowledge Base — Help article, checked 2026-10-20. "We cannot make any changes to our standard form of business associate agreement under any circumstances."
- Business Associate Agreements (BAA) – Constant Contact Knowledge Base — Help article, checked 2026-10-20. "Constant Contact could be considered a business associate to certain customers that handle PHI."
- Multi-Account Solutions – Constant Contact — Vendor page, checked 2026-10-20. "As required under the Health Insurance Portability and Accountability Act (HIPAA), we employ administrative, physical, and technical safeguards to protect all of our customers' subscriber data."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
How do I get a BAA from Constant Contact?
Email [email protected] before you use the services with subscribers. Return the signed agreement to the same address.
Will Constant Contact negotiate or modify its BAA?
No. The vendor states it will only sign its own standard form and makes no changes to it. If your organization requires its own template or custom terms, Constant Contact's process does not accommodate that.
Can I import patient data or health information into Constant Contact?
No. Customers must not import or incorporate PHI, or sensitive personal or health information of any kind. The BAA covers email marketing to subscribers using contact information only, and the vendor allows nothing beyond the fact that a subscriber has a relationship with your business.
Is the BAA available on every Constant Contact plan, and does it cost extra?
The vendor makes the BAA available on request on all plans and lists no excluded plans. Extra cost and minimum seats: Not published by the vendor.