Developing
A contributor article, not legal advice. It says many questions remain unsettled.
In 60 seconds
- HIPAA regulates covered entities and their business associates, not health data as such; a direct-to-consumer supplement brand is not covered but is not "in the clear".
- A BAA covers only the vendor that signs it and only the products in scope; it does not make a tool compliant.
- A 2024 federal ruling vacated the part of federal tracking guidance on IP addresses on public pages; class actions under state wiretap and medical confidentiality laws have run since 2022.
- Federal guidance says a vendor's promise to strip PHI after receipt does not cure a disclosure made via server-side tagging.
Impact Layer
- What changed
- A practical summary of why a signed BAA is only one part of tracking compliance.
- Why it matters
- Health-related brands that use ad pixels or retargeting can face liability even when a vendor holds a BAA.
- Who is affected
- Marketers at healthcare providers, insurers, and consumer health brands.
- Martech stack area
- Analytics, Data
- Stack impact
- Audit tags on pages about conditions, providers and appointments. Involve legal and compliance early.
- Business impact
- Moderate A contributor article by Kevin Haag on MarTech, not legal advice; the legal points are summarised as the author states them and we did not verify them against the rulings.
- Related technologies
- What to watch
- Further court rulings on tracking technologies and state consumer health data laws.
A MarTech article by Kevin Haag, published October 9, 2026, argues that signing a business associate agreement (BAA) is not the end of HIPAA compliance for marketing tools. The points below are the author’s.
Who is covered
- HIPAA regulates entities, not data: health plans, clearinghouses and providers that bill electronically, plus their business associates.
- A direct-to-consumer supplement brand is not covered, but the FTC treats unauthorised sharing of health data with advertisers as a breach under its Health Breach Notification Rule, and several states have consumer health data laws.
What a BAA does and does not do
- It covers only the vendor that signs it, and only the products and features in scope.
- It does not make a tool compliant or transfer the covered entity’s risk-analysis duties.
- Retargeting and lookalike modelling usually require the ad platform to receive protected data, and few vendors will do so under a BAA.
Litigation and guidance
A 2024 federal ruling vacated the part of federal tracking guidance on IP addresses on public pages about conditions or providers; the rest stands. Class actions under state wiretap and medical confidentiality laws have run since 2022, and class periods can reach back to when tracking began. Federal guidance says a vendor’s promise to strip protected data after receipt does not cure a disclosure through server-side tagging.
Our read
Treat tracking on health pages as a legal question first and a tooling question second. This is a summary of one author’s view, not legal advice.
Sources
- MarTech: Why HIPAA compliance in martech goes beyond BAAs (opens in a new tab)
Source of all legal points; the author is a contributor and it is not legal advice.