A 19-item BAA checklist for martech and customer data vendors: covered products, sub-processors, key custody, breach notice, AI training and exit. CSV included.
Updated
industries
Customer Data Platform (CDP) for Healthcare: Keep PHI Inside Your Boundary
By Art Kukharenko · Published · Updated
No independent legal review is recorded. General information; confirm current obligations with qualified counsel.
A customer data platform (CDP) can bring patient or member records, consent and contact history together. Healthcare teams must assess how they protect health information and which vendors receive it. PrivyCDP runs in your datacenter or cloud account. Review the data flow and safeguards before using real records.
Start here: the rules that draw the care boundary, a hybrid pattern that fits most organisations, what to evaluate, and links to the detailed guides.
Who this is for
- Providers need patient communications, reminders and web and portal measurement without exposing PHI to ad platforms. The EHR stays the system of record (patient 360 vs EHR).
- Payers run member engagement and enrolment campaigns under the HIPAA marketing rules (explained here).
- Digital health companies are often outside HIPAA but not outside regulation: the FTC has pursued GoodRx and BetterHelp over health data shared for advertising 45, and many are business associates to providers.
The care boundary: which rules apply
Scroll horizontally to compare all columns ↔
| Rule | Applies to | Why it matters for customer data |
|---|---|---|
| HIPAA Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164) | Covered entities and business associates | PHI may go to a vendor only under a business associate agreement (BAA) 1; business associates must report breaches within 60 days of discovery at most 2 |
| HITECH Act | Covered entities and business associates | Strengthened enforcement and breach notification; implemented in the 2013 Omnibus Rule 3 |
| 42 CFR Part 2 | Federally assisted substance use disorder programs | Final rule aligned Part 2 with HIPAA; effective 16 April 2024, compliance date 16 February 2026 7 |
| Washington My Health My Data Act | Consumer health data of Washington consumers | Consent to collect and separate consent to share; geofence ban; HIPAA PHI exempt 8 |
| FTC Health Breach Notification Rule | Health apps and similar services outside HIPAA | An unauthorised disclosure counts as a breach 6 |
| Proposed HIPAA Security Rule update | Covered entities and business associates | Proposed in January 2025, not final as of October 2026 9 |
HHS runs no program that certifies software as "HIPAA compliant" 10. What matters is each vendor's published BAA scope, your configuration and your controls. Track the proposal on the HIPAA Security Rule update tracker; the wider map is in US state privacy laws 2026–2028.
A hybrid deployment pattern that fits most organisations
Split by data class, not by department.
- Inside the boundary: identity resolution, consent and preferences, patient-linked engagement history, decisioning and the audit ledger.
- Out under a BAA: only the fields an email, SMS or contact-centre vendor needs, to vendors whose BAA covers that product.
- Out as de-identified or limited data: to cloud analytics, using the HIPAA de-identification standards.
- Not out at all: identified data to advertising platforms from portal, scheduling or condition-specific routes. See healthcare marketing pixels after the HHS guidance.
SaaS can be the right answer when you send no PHI or a vendor's BAA covers the exact product and you accept its limits. Running your own platform takes operations effort; see TCO and deployment options.
What to evaluate
- BAA scope at product and feature level, not a badge; the BAA checklist for martech vendors lists 19 questions.
- Where it runs, who holds the keys, who can reach it.
- PHI filtering and suppression before any third-party destination.
- Consent and preference enforcement across every channel.
- An immutable audit trail of access, merges and outbound messages.
- FHIR connectivity to your EHR and a minimal-field sync.
- Governed AI: private inference, prompt logging, human review (HIPAA-compliant ChatGPT and private LLM options).
- Exit: export of identity graph and consent history.
- Cost model: licence versus per-profile or per-event pricing (licensing).
Guides for healthcare teams
- HIPAA-compliant customer data platforms: how vendors compare
- Mailchimp, HubSpot, Klaviyo and GA4: vendor-by-vendor answers
- HIPAA-ready: what PrivyCDP does and does not claim
- Deployment qualification: how deployments are scoped
Checked 2026-10-17 unless noted.
Related terms
Browse the glossaryExplore this collection
healthcare
HIPAA pixel tracking after the HHS bulletin and AHA v. Becerra: what was vacated, what still applies, 2024-2026 lawsuits, FTC actions and a server-side design.
Updated
Is there a HIPAA compliant ChatGPT? What OpenAI, Microsoft, Google, AWS and Anthropic publish about BAAs, what a BAA misses, and when a private LLM is safer.
Updated
Patient 360 vs EHR: the EHR stays the system of record, while engagement, preference and consent data need a governed home. Data classes, FHIR and a checklist.
Updated
Frequently asked questions
What is a customer data platform for healthcare?
It is software that unifies identity, consent, preferences and engagement events across channels, with controls for PHI. It does not replace the EHR. It feeds outreach and measurement with the minimum data needed, and it must be deployed under a BAA or inside your own boundary.
Can a customer data platform store PHI?
Yes, if the vendor signs a BAA that covers the product and you configure it correctly, or if you host it yourself. Engagement data tied to a known patient is usually PHI. No certification exists, so check each vendor's published scope 1.
Do digital health apps need to follow HIPAA?
Only if they are covered entities or business associates. Others still face the FTC's Health Breach Notification Rule, which treats unauthorised disclosure as a breach, and state laws such as Washington's 68. Many are business associates to providers and must sign BAAs and meet Security Rule safeguards.
Is 42 CFR Part 2 the same as HIPAA?
No. Part 2 protects records of federally assisted substance use disorder programs and has its own consent rules. The 2024 final rule aligned it more closely with the HIPAA Privacy Rule, with a compliance date of 16 February 2026 7. Check whether any of your records come from a Part 2 program.
Does keeping PHI on-premise make us HIPAA compliant?
No. It removes a vendor from the PHI path, but you still need Security Rule safeguards, a risk analysis, access controls and breach processes. Any third party that hosts your hardware or runs the system for you is still a business associate 3.
Sources
- 45 CFR 164.502(e) and 164.504(e), business associates and contracts Open source
- 45 CFR 164.410, notification by a business associate Open source
- HHS, Omnibus Rule, 78 Fed. Reg. 5566, 25 Jan 2013 Open source
- FTC, GoodRx action (1 Feb 2023) Open source
- FTC, BetterHelp final order (14 Jul 2023) Open source
- FTC, finalizes changes to the Health Breach Notification Rule (26 Apr 2024) Open source
- HHS, Confidentiality of SUD Patient Records, 89 Fed. Reg. 12472, 16 Feb 2024 Open source
- Revised Code of Washington, chapter 19.373 Open source
- HIPAA Journal, Security Rule status (secondary) Open source
- Google Cloud, HIPAA compliance (updated 2026-10-16) Open source
Put this evaluation into practice.
Assess your deployment requirementsThis page is general information, not legal advice.
Further reading
- Is There a HIPAA-Compliant ChatGPT?
- Deployment
- Deployment readiness checklist
- HIPAA-Compliant CDP: What It Takes
- HIPAA architecture
Published: · Updated:
Editorial dates describe content changes. Confirm current sources before making legal, security or purchasing decisions.