Do marketing agencies need a BAA? Business associate rules for practice marketing vendors

Practices ask this question at two points: when a new agency sends over a proposal, and when someone realizes the current agency has had access to the patient email list for a year. The short answer is that it depends on what the agency actually touches. HIPAA does not ask whether a vendor calls itself a marketing agency. It asks whether the vendor creates, receives, maintains or transmits protected health information on your behalf.

This guide walks through the federal definition of a business associate, which common marketing tasks cross that line, what the written agreement has to contain, how subcontractors fit in, and the things a signed agreement does not fix. For the wider picture of when patient information can be used for marketing at all, start with our guide to HIPAA marketing rules. For the CRM and marketing automation tools themselves, see our guide to what patient data can go into a practice CRM.

First, does HIPAA apply to your practice?

Business associate rules only matter if your practice is a covered entity. Under 45 CFR 160.103, a health care provider is a covered entity when it transmits health information in electronic form in connection with a covered transaction, such as billing a health plan electronically. Many practices that bill insurance meet that test. Some cash-only practices may not, although other privacy laws can still apply to them. Our HIPAA marketing rules guide covers this first question in more detail.

What makes a vendor a business associate

The definition in 45 CFR 160.103 has two main parts. A business associate is a person who, on behalf of a covered entity and other than as a member of its workforce, creates, receives, maintains or transmits protected health information for a function or activity the HIPAA rules regulate. It is also a person who provides certain services to a covered entity, including consulting, management and administrative services, where the service involves the disclosure of protected health information to that person.

The HHS Business Associates FAQ page adds three points that matter for agencies. “Person” includes organizations such as corporations, not only individuals. A subcontractor that handles protected health information for a business associate is itself a business associate. And the lists in the definition are examples, not a closed set.

Marketing is not named in the definition. That does not settle anything either way. The test is the activity and the information, not the job title on the invoice. Billing, by contrast, is named in the definition, and our guide to marketing a medical billing company covers what that means for a billing company’s own sales copy.

Marketing tasks that usually touch patient information

The following are common agency tasks where the agency, or a tool the agency runs for you, is likely to create, receive, maintain or transmit protected health information. Whether a specific setup crosses the line depends on the facts, so treat this as a list of places to look, not a ruling.

• Patient email and text lists. If the agency uploads, stores or sends to a list of your patients, it is handling information that links people to your practice. See our guide to healthcare email marketing for the authorization questions.
• Website forms and intake. An agency that hosts, receives or forwards appointment requests, symptom questions or intake answers is receiving patient information. Our guide to HIPAA and website contact forms covers form design.
• Call tracking and recordings. Recorded calls and call logs from patients often include names, numbers and reasons for the visit. See call tracking for medical practices.
• Review management. An agency that drafts replies to patient reviews using your records, or sees your patient roster to request reviews, is handling patient information. Our guide to replying to negative reviews explains the reply side.
• Tracking tags on patient-facing pages. Tags on booking, portal or condition pages can send information about patients to the vendors behind them. See tracking pixels on practice websites.
• Hosting and site maintenance. If the agency hosts or maintains a site or database that stores patient information, it maintains that information for you. See practice website hosting and HIPAA.
• Reporting that joins ad data to patient records. Matching appointments or revenue back to individual ad clicks means the agency sees which people became patients.

Marketing tasks that usually do not

Plenty of agency work never involves patient information. Writing service pages from your providers’ notes, keyword research, local listing updates with practice details, designing a brochure, and running search ads that send people to a page with no patient data are all examples. The HHS FAQ page says a business associate agreement is not required with a person whose functions or services do not involve the use or disclosure of protected health information, provided any access would be only incidental and reasonable safeguards are in place.

The catch is that the same agency often does both kinds of work. A retainer that starts with content and adds a review request campaign six months later may cross the line in the middle. Check the scope each time it changes, not only at signing.

The HHS FAQ page also describes a narrow conduit exception for entities that only transmit protected health information, such as the postal service and its electronic equivalents. It says entities that access protected health information on a regular or frequent basis to perform a service are not conduits. A marketing agency that works with your data is not a conduit. Our guide to practice email and fax explains the conduit idea for messaging tools.

What the agreement has to contain

Under 45 CFR 164.502(e), a covered entity may let a business associate handle protected health information on its behalf only after it obtains satisfactory assurance that the business associate will appropriately safeguard the information. Those assurances must be documented in a written contract or other written arrangement that meets 45 CFR 164.504(e). HHS calls this a business associate agreement, or BAA.

The required contract terms in 45 CFR 164.504(e)(2) include these.

1. Permitted uses.The contract establishes what the business associate may and must do with the information, and it may not authorize anything that would violate the Privacy Rule if your practice did it, with limited exceptions for the business associate’s own management and administration and for data aggregation.
2. No other use.The business associate will not use or further disclose the information except as the contract permits or the law requires.
3. Safeguards.It will use appropriate safeguards and comply with the Security Rule where it applies to electronic protected health information.
4. Reporting.It will report uses or disclosures not allowed by the contract, including breaches of unsecured protected health information.
5. Subcontractors.It will make sure subcontractors that handle the information agree to the same restrictions and conditions.
6. Patient rights.It will make information available for patient access, amendment and an accounting of disclosures as the rules require.
7. Records.It will make its internal practices, books and records on the information available to HHS.
8. Return or destruction.At the end of the contract, it will return or destroy the information if feasible, or extend the contract’s protections to whatever it must keep.
9. Termination.The contract lets your practice terminate it if the business associate violates a material term.

HHS publishes sample business associate agreement provisions that show this language. A sample is a starting point, not a finished contract. It does not describe your actual data flows, so the permitted uses section still has to be written for the work the agency does.

Subcontractors and the tools an agency uses

Agencies rarely do everything in house. They use email platforms, form tools, call tracking systems, hosting, reporting dashboards and freelancers. Under 45 CFR 164.502(e)(1)(ii), a business associate may let a subcontractor handle protected health information only after it obtains the same kind of satisfactory assurances, and the HHS FAQ page says the business associate must have a BAA with the subcontractor before disclosing the information.

The same rule says your practice is not required to get those assurances from the subcontractor directly. That is the agency’s job. It is still reasonable to ask for a list of the tools and subcontractors that will touch your patients’ information, and to ask how the agency confirms each one is covered.

What a signed BAA does not fix

A business associate agreement is necessary when the definition is met, but it is not a permission slip for marketing. Four limits are worth knowing.

• It does not authorize marketing uses. Under 45 CFR 164.502(a)(3), a business associate may use or disclose protected health information only as its contract permits or the law requires, and not in a way that would violate the Privacy Rule if your practice did it. If a campaign needs a patient’s written authorization under 45 CFR 164.508(a)(3), it still needs it when an agency runs it.
• It does not let the agency reuse your data. Because the contract cannot authorize uses your practice could not make, it cannot let the agency use your patient list to build audiences or case studies for other clients.
• It does not change who is a business associate. The OCR tracking bulletin says a vendor is a business associate if it meets the definition, whether or not a BAA is in place, and that signing an agreement with BAA terms does not make a vendor a business associate if it does not meet the definition.
• It does not end your own duties. Under 45 CFR 164.504(e)(1)(ii), a covered entity that knew of a pattern of activity or practice by the business associate that was a material breach of the contract is out of compliance unless it took reasonable steps to cure it and, if that failed, ended the contract if feasible.

Business associates also carry their own exposure. The HHS fact sheet on direct liability says that, since the HITECH Act and the 2013 final rule, OCR can take enforcement action directly against business associates for listed failures, including impermissible uses and disclosures, failing to comply with the Security Rule, failing to notify the covered entity of a breach, failing to limit information to the minimum necessary, and failing to enter into BAAs with subcontractors.

Tracking technology vendors

Tracking tags are where many marketing setups first meet these rules. The OCR bulletin says that when a regulated entity discloses protected health information to a tracking technology vendor without patient authorization, the vendor needs a signed BAA and there must be an applicable Privacy Rule permission for the disclosure. If a vendor will not sign one, the bulletin describes using a different vendor that will sign a BAA, de-identify the information, and pass only de-identified information onward.

A federal court vacated part of that guidance on June 20, 2024, and HHS added a note to the bulletin. Our guide to tracking pixels on practice websites explains what changed and what still applies.

Questions to ask an agency before patient information moves

• Which of the services in our scope will create, receive, store or send patient information, and which will not?
• Will you sign a business associate agreement that covers those services, and what does its permitted uses section say?
• Which tools and subcontractors will touch that information, and do you have a BAA with each of them?
• Who on your team can see our patient data, and how is access removed when people leave?
• How and how quickly will you tell us about an incident or a possible breach?
• What happens to our data, including exports and backups, when the contract ends?
• Can the work be designed so patient information never reaches you at all?

The last question is often the most useful. Many marketing goals can be met with aggregate numbers, a form that sends straight to your practice systems, and pages that carry no tracking tags. The less patient information an agency handles, the less there is to contract for and to protect.

Illustration: a scope that changes

Illustration. A small practice hires an agency to rewrite its service pages and manage search ads that point to pages without forms. No patient information reaches the agency, so the practice and the agency agree in writing that no protected health information will be shared. Later the practice wants a review request campaign sent to recent patients. Before any patient list moves, the practice checks whether the authorization rules apply to the messages, the agency signs a BAA that names the review campaign as a permitted use, and the agency confirms which sending tool is covered by its own BAA. The scope document is updated to match.

Common mistakes

• Assuming an agency is not a business associate because marketing is not named in the definition.
• Signing a vendor’s standard BAA without checking that its permitted uses match the real work.
• Treating a signed BAA as permission to run campaigns that need patient authorization.
• Forgetting the agency’s own tools and freelancers.
• Leaving patient data with a former agency after the contract ends.
• Adding a patient-facing task to an existing retainer without revisiting the agreement.

How we help

We plan practice marketing so that patient information stays out of it wherever it can. Our medical website design work keeps intake forms free of advertising tags, our healthcare SEO work does not need patient data, and our AI front desk is built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We do not promise rankings, leads or results.

Frequently asked questions

Sources

• 45 CFR 160.103: Definitions (business associate, covered entity)
• 45 CFR 164.502: Uses and disclosures of protected health information, general rules
• 45 CFR 164.504: Uses and disclosures, organizational requirements
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• HHS: Business Associates Frequently Asked Questions (content last reviewed October 21, 2026)
• HHS: Direct Liability of Business Associates (content last reviewed July 16, 2021)
• HHS: Sample Business Associate Agreement Provisions (content last reviewed June 16, 2017)
• HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (content last reviewed June 26, 2024)

More in Healthcare marketing rules