HIPAA Checklist for Marketing Vendors: BAAs, Access and Data

A marketing vendor needs a business associate agreement (BAA) with your practice when it creates, receives, maintains or transmits protected health information (PHI) for you. That's the test HHS uses. A web designer who never sees client data usually doesn't need one. A scheduler, an email host or a tracking vendor that receives booking details usually does.

This checklist is based on the HHS business associate guidance pages, checked on 29 October 2026. It helps you sort your vendors, read their BAAs and ask the right questions. It's part of our Therapy Practice Marketing Guide.

This is not legal advice. HIPAA questions depend on your setup, so confirm decisions with your compliance counsel.

Step 1: Know the test

HHS's business associate guidance describes a business associate as, generally, a person that performs certain functions for a covered entity. Those functions "involve creating, receiving, maintaining, or transmitting PHI." The same page says any subcontractor that does this for a business associate is also a business associate.

The page lists examples that matter for marketing and practice tech:

• A cloud service provider that processes or stores electronic PHI.
• An IT contractor or managed services provider that supports systems holding electronic PHI.
• A third-party chatbot on a patient portal that handles PHI, for example for scheduling.
• A health care app developer that handles patients' PHI for patient messaging or similar services.

HHS also lists people who are not business associates. A janitor or electrician whose access to PHI would be "only incidental, if at all" doesn't need a BAA. Neither does a pure "conduit," like the US Postal Service. HHS says the conduit exception covers transmission-only services and that entities that access PHI "on a regular or frequent basis" are not conduits.

Step 2: Sort your marketing vendors

Use this table as a starting point. The right answer depends on how you use each tool, so check with each vendor and your compliance counsel.

Some vendor examples, from their own docs (checked 29 October 2026):

• Google Analytics. Google's help page says Google "does not offer Business Associate Agreements in connection with this service." The page adds that authenticated pages "are likely to be HIPAA-covered" and that customers shouldn't set Google Analytics tags on them.
• Google Workspace. Google's HIPAA page for Workspace says administrators "must review and accept a BAA before using PHI in Google services." It says third-party add-ons aren't covered.
• Squarespace. Squarespace's Acuity HIPAA page says Acuity Scheduling is the only Squarespace feature currently designed for HIPAA obligations. It says the form block can't be part of a HIPAA-compliant solution.
• Wix. Wix's HIPAA help article says to turn on PHI protection and sign the BAA before handling PHI. Both are available on certain plans.

Step 3: Read the BAA

HHS publishes sample BAA provisions. The page lists what a written contract between a covered entity and a business associate must do. Check each vendor's BAA for these points:

1. Permitted uses. It sets out what the vendor may and may not do with PHI.
2. No other use. The vendor won't use or disclose PHI beyond the contract or the law.
3. Safeguards. The vendor uses appropriate safeguards, including the HIPAA Security Rule for electronic PHI.
4. Reporting. The vendor reports uses or disclosures not allowed by the contract, including breaches of unsecured PHI.
5. Client rights. The vendor makes PHI available so you can meet clients' rights to access, amend and get an accounting of disclosures.
6. Your obligations. If the vendor carries out a Privacy Rule duty for you, it follows the rule.
7. HHS access. The vendor makes its records available to HHS for compliance checks.
8. Return or destroy. At the end of the contract, if feasible, the vendor returns or destroys PHI.
9. Subcontractors. Anyone the vendor hires who handles PHI agrees to the same restrictions.
10. Termination. You can end the contract if the vendor breaks a material term.

HHS's sample page notes the parties may add detail, such as a stricter time frame for reporting a possible breach. That's worth asking about.

Step 4: Watch the traps

Encryption doesn't remove the need for a BAA

HHS's cloud computing guidance is direct on this. A cloud provider that stores only encrypted PHI and lacks the key is still a business associate. "Lacking an encryption key does not exempt a CSP from business associate status," it says.

A privacy policy is not permission

HHS's tracking technology guidance says the Privacy Rule does not permit disclosures of PHI to a tracking vendor "based solely on" a notice in your privacy policy. It also says it's not enough for a tracking vendor to promise to strip PHI after receiving it.

Note the court status. On 20 June 2024, a federal court in Texas vacated part of that guidance, the part about tracking on public pages that don't require a login. HHS's page says it is evaluating next steps. The parts about booking tools and patient portal logins still apply.

Signing a BAA doesn't make a vendor safe

HHS says a vendor that meets the business associate definition is one "regardless of whether the required BAA is in place." The flip side is also true: a BAA doesn't make a tool right for PHI if the tool isn't built for it. Read the vendor's HIPAA docs, not just the contract.

FTC rules can apply too

If an app or service isn't covered by HIPAA, the FTC may still act. The FTC's Health Breach Notification Rule guide says a breach includes unauthorized disclosure, not just hacking.

Step 5: Questions to ask every vendor

Copy these into an email and keep the answers on file:

• Will your service, staff or subcontractors ever see, store or send our clients' information?
• Will you sign a BAA? Which of your features does it cover, and which does it exclude?
• Which plan or setting do we need for HIPAA features?
• Who on your team can access our account, and how is access logged?
• How fast will you tell us about a security incident or breach?
• Where is the data stored, and what happens to it if we cancel?
• Which subcontractors handle our data, and do they sign BAAs with you?
• Can we remove a former staff member's access on the same day?

Step 6: Keep it current

Make a simple vendor register: vendor name, what it does, whether it sees PHI, BAA status, date signed and who has admin access. Review it when you add a tool, change a plan or someone leaves the practice.

For your website specifically, our guide on HIPAA-compliant forms and scheduling covers intake tools. Our tracking pixels guide covers analytics and ads. For a broader overview, see Is your therapy website HIPAA-compliant?.

Next step

Once your vendor list is clean, the next step is a site that keeps PHI off tools that can't protect it. Use our therapy website launch checklist, or see how eSEOspace builds privacy-first websites for therapy practices. You can also book a discovery call.

Frequently asked questions