HIPAA Compliance for Marketing Agencies: When You Become a Business Associate

Last updated: October 20, 2026

A marketing agency becomes subject to HIPAA the moment it creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity. That makes it a business associate under 45 CFR § 160.103. At that point the agency must sign a Business Associate Agreement (BAA) under 45 CFR § 164.504(e). It must also apply the Security Rule safeguards, train staff, and put BAAs in place with its own subcontractors. An agency that never touches PHI is generally outside HIPAA. But the line is easy to cross: CRMs, ad platforms, web forms, and analytics tags can all carry PHI.

TL;DR: Quick answer

• An agency that handles a healthcare client's PHI is a business associate under 45 CFR § 160.103. It has been directly liable to HHS OCR since the 2013 Omnibus Rule.
• A written BAA meeting 45 CFR § 164.504(e) is mandatory before any PHI changes hands; operating without one is itself a violation.
• Civil penalties effective January 28, 2026 range from $145 per violation at Tier 1 to $2,190,294 for uncorrected willful neglect. The annual cap is $2,190,294 per provision (45 CFR § 102.3).
• A June 20, 2024 federal ruling (AHA v. Becerra, N.D. Tex.) vacated OCR's rule on IP addresses plus visits to public health information pages. Pixels on logged-in pages or pages that actually collect health details still create HIPAA exposure.
• Google does not offer a BAA for Google Analytics. Meta's Business Tools Terms bar businesses from sending Meta health information. So PHI cannot lawfully flow to those platforms.

When does a marketing agency become a business associate under 45 CFR § 160.103?

HIPAA does not regulate marketing as an activity. It regulates PHI held by covered entities (providers who transmit health information electronically, health plans, and clearinghouses) and their business associates. The definition at 45 CFR § 160.103 captures any vendor that creates, receives, maintains, or transmits PHI on a covered entity's behalf. PHI is individually identifiable health information; a name or email address tied to a condition, treatment, appointment, or payment for care qualifies.

These everyday agency tasks can create business associate status without anyone noticing:

• Managing a patient email list or newsletter segmented by condition, treatment, or appointment history.
• Uploading patient or lead lists to an ad platform or CRM for retargeting or lookalike audiences.
• Building or managing intake forms, appointment requests, or symptom quizzes. Contact form submissions on therapist and clinic sites are PHI when they tie an identity to a request for care.
• Accessing the client's EHR, practice management system, patient portal, or call-tracking recordings.
• Handling reviews, testimonials, or case studies that identify patients and their care.

Pure brand work with no patient data usually does not create business associate status. An awareness campaign that never touches identifiers linked to health information is one example. Map the data flows before deciding. Include project management tools, shared drives, and email threads, because PHI can land there too.

What must the Business Associate Agreement contain?

The BAA requirements live in 45 CFR § 164.504(e) and § 164.308(b). The contract must require the agency to:

• Use and disclose PHI only as the contract permits.
• Implement the administrative, physical, and technical safeguards of 45 CFR §§ 164.308, 164.310, and 164.312. We break these down in our guide to HIPAA's administrative, physical, and technical safeguards.
• Report security incidents and breaches to the covered entity.
• Obtain BAAs from subcontractors that handle PHI (45 CFR § 164.502(e)(1)(ii)), including the agency's hosting provider, email platform, and CRM.
• Return or destroy PHI at contract end where feasible.

Since the 2013 Omnibus Rule, business associates are directly liable to HHS OCR, not just contractually liable to the client. OCR enforces the BAA requirement. In 2016, North Memorial Health Care agreed to pay $1,550,000 to settle potential violations that included having no BAA with a major contractor. The civil penalties for HIPAA violations apply to agencies in their own right. Our guide to the HIPAA business associate agreement has the full contract checklist. For what a compliant host costs the client, see HIPAA hosting cost.

Are tracking pixels still a HIPAA problem after AHA v. Becerra?

Partially, and the nuance matters. OCR issued tracking technology guidance in December 2022 and revised it on March 18, 2024. In AHA v. Becerra (N.D. Tex., June 20, 2024), a federal court vacated one part of OCR's tracking guidance. The vacated part is the rule that an IP address plus a visit to a public health information page is, by itself, protected health information. HHS appealed, then asked the Fifth Circuit to dismiss its own appeal. The appeal was dismissed on September 4, 2024.

The rest of the guidance still applies. Trackers on patient portals, login pages, booking flows and apps can still expose PHI, and HHS says it is still evaluating its next steps. What survived the ruling:

• Authenticated pages remain in scope. Pixels on patient portals, logged-in scheduling areas, or anything behind a login still implicate HIPAA.
• Pages that collect health details remain in scope. A pixel that captures form field contents, condition-specific URL parameters tied to a known user, or booking confirmations can transmit PHI even without a login. HHS's own example: a clinic website that sends appointment details and the patient's IP address to a tracking vendor makes that vendor a business associate.
• HIPAA is not the only exposure. The FTC acts under its own authority. In February 2023, GoodRx agreed to a $1.5 million civil penalty in the FTC's first Health Breach Notification Rule case. The FTC said GoodRx disclosed health data to Facebook, Google and other companies without authorization. State wiretap and consumer privacy class actions also continue, independent of the vacatur.
• Tracking class actions are settling. In 2026, courts gave final approval to website tracking class action settlements, including these two. Kaiser's $47.5 million settlement, approved July 14, covers about 13.1 million people. Allina Health's $12.5 million settlement, over alleged Meta Pixel and Google Analytics tracking, was approved September 24. Neither settlement is an admission of wrongdoing.

Every agency should internalize two operational facts. Google does not offer a BAA for Google Analytics. Meta's Business Tools Terms bar businesses from sending Meta health information through the Meta Pixel and its other business tools. PHI therefore cannot lawfully flow to those platforms. Audit every tag in the tag manager, and strip health details from URLs and payloads. Never upload patient lists to a platform that will not sign a BAA. Not sure which tags fire on each client site, or what they send? Ask about our client-side compliance review. For the full rundown of which trackers are allowed where, see HIPAA tracking technologies. The same logic applies to spreadsheets: Google Sheets can hold PHI only under a paid Google Workspace BAA, never in a free account.

What does a compliant agency stack look like?

In practice, HIPAA compliance for marketing agencies rests on seven building blocks:

• BAA with every covered-entity client before any PHI is exchanged, and BAAs with every downstream vendor that touches PHI.
• A documented data-flow map covering CRM, email, forms, call tracking, analytics, project management, and cloud storage. It feeds the agency's own risk analysis, which HIPAA requires (§ 164.308(a)(1)(ii)(A)).
• BAA-covered infrastructure for anything that stores PHI. Standard hosting without a signed BAA does not qualify. A managed host that signs one covers the servers and services it runs. Our HIPAA-compliant WordPress hosting, for example, includes encryption at rest and in transit and six-year audit logging. That is our business, so weigh that disclosure accordingly.
• Encryption in transit and at rest per 45 CFR § 164.312(e)(1) and § 164.312(a)(2)(iv).
• Least-privilege access with MFA and unique user IDs (§ 164.312(a)(2)(i)). Shared agency logins to a client's portal break the unique ID requirement, because HIPAA audit logs can then no longer show who did what.
• Workforce training at onboarding and periodically (§ 164.308(a)(5)). That includes the developers and designers building client sites.
• An incident-response and breach-notification plan aligned to 45 CFR §§ 164.400-414 before you need it, not after.

What are the penalties if an agency gets it wrong?

Civil penalties are tiered by culpability and assessed per violation. The amounts below took effect January 28, 2026 under 45 CFR § 102.3. Note that OCR's 2019 Notice of Enforcement Discretion still caps annual maximums lower than the regulatory cap for Tiers 1 through 3.

The annual cap is $2,190,294 per violated provision. A single breach typically involves several provisions, so exposure compounds. Knowing misuse of PHI can also bring criminal referral to the Department of Justice. Our guide to HIPAA violation consequences for employees covers real criminal cases. Beyond penalties, agencies face breach-notification costs, contract loss, and the client-side litigation wave that has followed pixel disclosures since 2022. The scale of what those exposures produce industry-wide is in our healthcare data breach statistics.

Frequently asked questions

Do marketing agencies need to be HIPAA compliant?

Only when they handle PHI for a covered entity. An agency that creates, receives, maintains, or transmits PHI is a business associate under 45 CFR § 160.103. At that point, HIPAA compliance for marketing agencies means a signed BAA and the Security Rule safeguards.

Is the Meta Pixel a HIPAA violation?

Not automatically, but it becomes one when it transmits PHI to Meta. Meta's Business Tools Terms bar businesses from sending Meta health information. Risk is highest on authenticated pages and on forms or booking flows that capture health details.

Is Google Analytics HIPAA compliant?

No. Google does not offer a BAA for Google Analytics, so it cannot lawfully process PHI. Configure analytics so no PHI is ever sent, or use a vendor that signs a BAA. The full analysis is in is Google Analytics HIPAA compliant.

Did the 2024 court ruling make tracking pixels legal on healthcare sites?

No. AHA v. Becerra (June 20, 2024) only vacated OCR's position on IP addresses combined with visits to public health information pages. HHS's appeal was dismissed on September 4, 2024. Pixels on logged-in pages, or anywhere actual health information is collected, still create HIPAA risk, and FTC and state-law exposure continues either way.

Does my agency need its own subcontractor BAAs?

Yes. 45 CFR § 164.502(e)(1)(ii) requires a business associate to obtain BAAs from subcontractors that handle PHI, including hosting, email, and CRM vendors.

Where to go from here

If your agency touches patient data, HIPAA compliance for marketing agencies starts with a signed BAA and a data-flow map. Then move PHI onto BAA-covered HIPAA compliant hosting.

Agencies that host sites for several healthcare clients should look for healthcare web hosting backed by a signed BAA. We sign ours within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run. Managed plans start at $229 a month, billed monthly with no long-term contract.

For the broader infrastructure picture, see our complete guide to HIPAA-compliant hosting, or contact us with questions about a specific client setup.

This article is general information, not legal advice. Penalty amounts adjust annually for inflation. Consult qualified counsel and base your safeguards on a documented risk analysis. Reviewed October 2026.

Sources

• 45 CFR § 160.103, Definitions (eCFR)
• 45 CFR § 164.504, Organizational requirements including BAA terms (eCFR)
• HHS: Business Associates guidance
• HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
• Federal Register: Annual Civil Monetary Penalties Inflation Adjustment (Jan. 28, 2026)
• 45 CFR § 164.312, Technical safeguards including unique user identification (LII)
• American Hospital Association v. Becerra, No. 4:23-cv-01110 (N.D. Tex.), district court docket (CourtListener)
• American Hospital Association v. Becerra, No. 24-10775 (5th Cir.), appeal docket (CourtListener)
• HHS: North Memorial Health Care settlement over a missing business associate agreement
• FTC: Enforcement action to bar GoodRx from sharing sensitive health info for advertising (Feb. 1, 2023)
• Doe v. Kaiser Foundation Health Plan, No. 3:23-cv-02865 (N.D. Cal.), order granting final approval (July 14, 2026)
• Ahlers v. Allina Health System, No. 0:24-cv-03674 (D. Minn.), final approval order (Sept. 24, 2026)
• Ahlers v. Allina Health System, fee memorandum stating the $12,500,000 settlement fund (July 27, 2026)
• Google: HIPAA and Google Analytics
• Meta Business Tools Terms (bar sharing health information; effective Nov. 3, 2025)