HIPAA-Compliant Customer Data Platforms: What "Compliant" Actually Requires, and How Vendors Compare (2026)

There is no such thing as a HIPAA-certified customer data platform (CDP): the US Department of Health and Human Services does not certify software. A CDP is "HIPAA-compliant" only when six things are true at once — the vendor will sign a Business Associate Agreement that actually covers the products you use, the platform implements the Security Rule safeguards (45 CFR 164.308–164.312), it lets you honour the Privacy Rule's marketing-authorization and minimum-necessary rules, it keeps protected health information (PHI) out of ad pixels and non-covered destinations, it logs every access for breach analysis, and your own configuration and staff follow the rules. Below we explain each requirement and compare the vendors that offer BAAs — including the plan tiers and deployment models the BAA depends on.

Who this is for: the marketing lead who has been asked "is this tool HIPAA compliant?", the privacy officer who has to answer, and the security team that will be blamed if the answer was wrong. If you need the rules for what you may say to patients, read HIPAA marketing rules explained first; this guide is about the systems.

"HIPAA-compliant" is a shared responsibility, not a badge

HIPAA regulates covered entities (providers, health plans, clearinghouses) and their business associates — organisations that create, receive, maintain or transmit PHI on a covered entity's behalf 1. Software becomes relevant in two ways:

That distinction is why the deployment model belongs in any HIPAA evaluation of a CDP. A multi-tenant SaaS CDP is always a business associate. A customer-operated deployment can shrink the BAA surface to the vendor's support channel — and the covered entity carries the Security Rule obligations for the infrastructure instead. Neither is "more compliant"; they allocate responsibility differently.

The six requirements, with the regulation behind each

A tool can satisfy 1, 2 and 5 and still be used unlawfully if a marketer builds a segment on diagnosis codes and sends a promotion without authorization. Requirement 6 is where most enforcement actions actually land.

Tracking pixels and analytics: where the law stands in 2026

The most expensive healthcare marketing mistakes of the last four years involved pixels, not CDPs. The sequence matters for how you design data collection:

• December 2022: HHS's Office for Civil Rights published a bulletin on tracking technologies, treating individually identifiable information collected on regulated entities' websites and apps, including via third-party pixels, as PHI in many circumstances; it was updated in March 2024 5.
• 20 June 2024: in American Hospital Association v. Becerra, the Northern District of Texas vacated the "proscribed combination" guidance in HHS's revised bulletin of 18 March 2024 — the position that an IP address combined with a visit to an unauthenticated public page is PHI — and expressly left the rest of the bulletin operative. Guidance on authenticated pages (patient portals, logged-in apps) therefore stands, and HHS withdrew its appeal on 29 August 2024 7.
• 2025–2026: private litigation under state wiretap and privacy laws continued regardless of the federal guidance. Meta's mid-2026 securities filing reports mixed motion-to-dismiss results in the consolidated Meta Pixel healthcare litigation, and hospitals continued to settle individual pixel cases in 2026 8.

The practical consequence: collect first-party data server-side, gate it on consent, filter or hash anything that could be PHI before any third-party destination receives it, and treat authenticated experiences as PHI zones without exception. Detail: healthcare marketing pixels after the HHS bulletin.

Security Rule update: status

HHS published a notice of proposed rulemaking to modernise the Security Rule in the Federal Register on 6 January 2025 (announced 27 December 2024). Comments closed on 7 March 2025 with more than 4,700 submissions; more than a hundred provider groups asked for withdrawal, and no final rule had been issued as of October 2026. The regulatory agenda now points to around July 2027; the proposal sets an effective date 60 days after publication and a compliance date 180 days after that, so about 240 days after a final rule appears 9. The proposal (90 FR 898) would remove the "addressable" category, mandate encryption at rest and in transit and multi-factor authentication, require asset inventories and network maps, set patching windows of 15 and 30 days, six-monthly vulnerability scans and an annual penetration test, require restoration within 72 hours and backups no older than 48 hours, and add annual audits and annual verification of business associates; HHS estimated first-year cost at about $9 billion 9. None of that is law yet; the current Security Rule is. We track the status on the HIPAA Security Rule update tracker. The direction of travel is clear enough to build for now: encryption everywhere, MFA, inventory, tested restores.

Vendor comparison matrix

Every row is a summary of what the vendor publishes, read on the date shown. "Verify" means we found only one source or a secondary one; confirm in writing with the vendor before relying on it. No row means "compliant" — it means "offers a BAA under these conditions".

| Salesforce Data 360 | Yes, via the Salesforce BAA | Data 360 is listed as a HIPAA Covered Service with no service-specific restrictions on Salesforce's BAA restrictions page (updated 30 Sep 2026) 17 | Yes, under the BAA | Multi-tenant SaaS | Shield, data classification, consent fields | 2026-10-17 |

The matrix is deliberately uneven: it reflects what vendors publish. A vendor with a blank cell is not necessarily worse; it has not written it down where buyers can find it, which is itself a signal for procurement.

How deployment model changes your HIPAA interface

Hospitals with a mature security team often prefer the right-hand column because forensic independence and a single audit ledger simplify incident response and Office for Civil Rights inquiries. Smaller organisations without infrastructure staff are usually better served by a SaaS vendor with a strong BAA and a narrow PHI scope. The honest test is the one in on-premise and self-hosted customer data platforms: can you name the team that will run restores?

Decision guide by organisation type

BAA checklist (12 points)

Ask these before signature; the downloadable BAA checklist for martech vendors expands them.

1. Which products, tiers and features does the BAA cover? Does it exclude any you plan to use?
2. Which sub-processors receive PHI, and do they have BAAs with the vendor?
3. May the vendor use PHI for its own purposes, including analytics, benchmarking or model training? The answer should be no.
4. How is PHI encrypted in transit and at rest, and who holds the keys?
5. What access logs exist per record, how long are they kept, and can you export them?
6. Within how many hours will the vendor notify you of a security incident? (The Breach Notification Rule's 60 days is an outer limit for the covered entity, not a target.)
7. What happens to PHI at termination: return, destruction, timelines, certification?
8. Does offshore support staff have access to PHI?
9. How does the platform enforce minimum necessary (field-level permissions, masking)?
10. Can PHI be filtered or hashed before every destination, and is that enforced by configuration rather than training?
11. What audit rights do you have, and which third-party reports will the vendor share with scope statements?
12. Has the vendor had a reportable breach involving PHI, and what changed afterwards?

Review vendor terms and your configuration with healthcare privacy counsel.*