Is Mailchimp, HubSpot, Klaviyo or GA4 HIPAA Compliant? A Vendor-by-Vendor Answer

No marketing tool is "HIPAA compliant" on its own: no HHS-approved certification exists for vendors 2, so the useful question is whether the vendor will sign a business associate agreement (BAA), for which products and tier, and with what limits. On the vendors' own pages: HubSpot (Enterprise), Salesforce, Braze, Adobe and Segment (Business) offer BAAs; Google Analytics and SendGrid say they do not; Klaviyo's policy bars PHI; Mailchimp's pages show no BAA offer.

Who this is for: privacy and marketing-operations teams comparing email, analytics, advertising and customer data platform (CDP) tools. Every vendor row, except our own product, comes from a page opened on 17 October 2026. Part of the regulation hub; see also the healthcare hub.

How to read this page

A BAA is required when a vendor creates, receives, maintains or transmits PHI for a covered entity (45 CFR 164.502(e), 164.504(e)) 1. Microsoft's own compliance page makes the wider point: there is no certification standard that HHS approves for business associates, and a BAA does not by itself achieve compliance 2. So we record five facts per vendor: whether a BAA is offered, which tier or edition, which products, the stated limits, and the date of the page.

Master table: BAA offers by vendor

| HubSpot | Yes: BAA is Annex I to the Sensitive Data Terms | Enterprise subscription | Smart CRM, Marketing, Sales, Content, Data Hub (catalog); the help article also lists Service Hub | Sensitive properties unavailable in personalization tokens, sandboxes, chatbots, playbooks; PHI not available in all areas | Terms 14 Apr 2026; help 8 Sep 2026 | | Klaviyo | None found; policy prohibits PHI | n/a | n/a | Acceptable Use Policy bars medical records and health information incl. PHI; telehealth listed as restricted | 9 Apr 2026 | | Google Analytics 4 | No: "does not offer Business Associate Agreements" | n/a | n/a | Do not use in any way that implicates PHI; not on authenticated pages | Undated | | Meta Pixel / Business Tools | None stated | n/a | n/a | Terms forbid sharing health information with Meta | Effective 3 Nov 2025 | | Salesforce Marketing Cloud | Yes, if the signed BAA lists the service | Not stated | Marketing Cloud Engagement, Personalization (AWS only), Data 360, Customer Data Platform, Health Cloud; Account Engagement not mentioned | Customer must encrypt PHI; Einstein features in Marketing Cloud Next excluded | 30 Sep 2026 | | Braze | Yes | HIPAA-eligible instance bought on an Order Form, on the HIPAA cluster; no tier named | Braze Services in a "HIPAA Account" | No messages containing diagnoses or test results; no medical records or images | 21 Aug 2026 |

| Twilio SendGrid | No | n/a | n/a | "not a HIPAA Eligible Service"; Twilio cannot sign BAAs for it | Modified 23 Jul 2026 | | Twilio Segment | Yes | Business tier (Free and Team: no) | Products on Twilio's HIPAA Eligible list | Only context, traits and properties fields can be field-encrypted; 15-minute session timeout | Modified 26 Jun 2026 |

| Constant Contact | Yes, on request; standard form only | Not stated | Not stated | Subscriber contact information only; no sensitive health data; not built for EMR | 26 Jun 2026 | | Adobe (Healthcare Shield) | Yes: BAA required in addition to the licence | Real-Time CDP Prime or Ultimate | Real-Time CDP (B2C; B2P consumer audiences), Journey Optimizer, Customer Journey Analytics, Attribution AI | Excludes substance use disorder, mental health and genetic data, among others | Terms version 2024v2 |

| Freshpaint | Yes | Not stated | Not stated | Filtering depends on your configuration | Undated | | Ours Privacy | Yes: "a BAA with all of the organizations we work with" | Not stated | Not stated | Vendor marketing page; no exclusions listed | 16 Oct 2026 |

Vendor notes

Email and marketing automation

Is Mailchimp HIPAA compliant? Mailchimp's Standard Terms say you are responsible for deciding whether the Service suits your HIPAA obligations and that Mailchimp is not liable if it does not meet them; neither the terms nor its prohibited-content help page mention a BAA 34. Third-party compliance blogs say Intuit does not sign one, which we could not confirm on a Mailchimp page. Treat it as a non-PHI tool.

Is HubSpot HIPAA compliant? HubSpot offers a BAA for Enterprise accounts that turn on Sensitive Data, with PHI marked per property 56. The BAA applies only to Covered Services authorized in an order form, takes precedence over the main agreement for PHI, and requires breach reports within ten business days of discovery 6. HubSpot's catalog and help article differ on whether Service Hub is covered, so check your order form 57.

Is Klaviyo HIPAA compliant? Klaviyo's Acceptable Use Policy prohibits storing or sending medical records or health information, including PHI 8. We found no BAA offer, so do not place patient data in the platform.

Does Salesforce Marketing Cloud sign a BAA? Yes, for listed services: the BAA page names Marketing Cloud Engagement (formerly ExactTarget), Personalization on AWS, Data 360 and Health Cloud as covered when your signed BAA includes them, with PHI encrypted by the customer 9. It does not mention Account Engagement (formerly Pardot), so ask in writing. The page also limits coverage to Salesforce, Hyperforce or public-cloud infrastructure, not customer premises 9. Pricing context: Data 360 pricing.

Braze. Braze signs a BAA for PHI stored in a "HIPAA Account" on its HIPAA cluster, but the customer agrees not to send messages containing diagnoses or test results and not to store medical records or images 10. Braze also warns that third-party providers may not be HIPAA compliant 10. Breach notice is "without unreasonable delay" rather than a fixed number of days 10.

Iterable. The Trust Center lists HIPAA among its certifications without naming scope 11, and a customer story tells HIPAA-regulated businesses to contact Iterable about requirements and exclusions 12. Obtain the BAA and exclusions in writing before sending patient data.

Twilio SendGrid. Twilio states SendGrid does not natively support HIPAA-compliant transmission, is not a HIPAA Eligible Service, and Twilio cannot sign BAAs for it 13. For PHI-bearing email, pick a provider that does.

ActiveCampaign. A January 2026 post says a BAA is available on eligible plans, mentions an Enterprise plan with a BAA, and advises keeping PHI out of subject lines and SMS 14. Its Conversations product terms bar PHI 15. The pricing page shows a HIPAA support row without readable plan values, so confirm tier in writing.

Constant Contact. It will sign only its standard BAA, "cannot make any changes," and limits stored data to subscriber contact information; mental health, substance abuse and HIV information cannot be stored or sent 16. Useful for contact-only newsletters, not clinical messaging.

Analytics, tags and ad pixels

Is Google Analytics HIPAA compliant? Google says it "does not offer Business Associate Agreements" for Google Analytics, and HIPAA-regulated customers "must not use Google Analytics in any way that implicates Google's access to, or collection of, PHI" 17. It adds that authenticated pages are likely HIPAA-covered and should not carry tags 17. In American Hospital Association v. Becerra (N.D. Tex., 20 June 2024) the court vacated only the part of OCR's bulletin treating an IP address plus a visit to an unauthenticated public page as PHI; HHS withdrew its appeal on 29 August 2024 1819. Google's own page still tells customers to keep tags off authenticated pages. See healthcare marketing pixels after the HHS bulletin.

Meta Pixel. Meta's Business Tools Terms have you warrant that you will not share data that "includes or is based on, directly or otherwise, health information" 20. Pixel litigation continued through 2026, as Meta's 10-Q for the quarter ended 30 June 2026 and reported hospital settlements show 21.

Piwik PRO, Freshpaint, Ours Privacy and Tealium. These position themselves for healthcare. Piwik PRO says a customized BAA is signed before data collection and hosts on US Azure 22, but its pricing page lists a BAA under "Healthcare Enterprise" and "BAA not included" under Enterprise while its FAQ says Enterprise includes one 23. Freshpaint says it offers a BAA and filters data server-side, with protection depending on your configuration 24. Ours Privacy says it signs a BAA with every client 25. Tealium says it signs BAAs with Private Cloud customers 2627, while a separate undated page says its private cloud "is not intended to be a repository of Health Records" 28; confirm which statement is current.

Customer data platforms and pipelines

Twilio Segment. BAAs are available on the Business tier only; the Free and Team plans are marked unavailable, and a HIPAA badge should appear in workspace settings before PHI is sent 29. See Segment pricing and alternatives.

Adobe. Healthcare Shield terms require a covered entity to hold a BAA in addition to the licence, restrict use to listed Health Data-ready applications (Real-Time CDP Prime or Ultimate, Journey Optimizer, Customer Journey Analytics, Attribution AI), and bar sharing Permitted Health Data with non-ready products. Substance use disorder, mental health condition and genetic information are excluded from "Permitted Health Data" 30.

Microsoft Dynamics 365 Customer Insights. Microsoft makes its BAA available by default through the Online Services Data Protection Addendum and lists Dynamics 365 among in-scope services, but the page does not name Customer Insights individually 2.

HIPAA-compliant email marketing platforms and marketing automation: what the pattern shows

Three patterns emerge. Enterprise suites (Salesforce, Adobe, HubSpot Enterprise, Braze) sell a BAA tied to a specific product, instance or tier. Mid-market tools (Constant Contact, ActiveCampaign) offer narrow or tiered BAAs with content limits. Consumer-grade or developer tools (Mailchimp, Klaviyo, SendGrid, Google Analytics) offer none that we could find. Check the pattern against the master table, not the marketing page.

A BAA is necessary but not sufficient

A BAA lets a vendor handle PHI on your behalf. It does not settle the rest, and vendor documents say so:

1. Purpose. A BAA does not authorize marketing. Subsidized or third-party marketing still needs patient authorization; see HIPAA marketing rules.
2. Product scope. Salesforce covers a service only if your BAA includes it 9; Adobe requires a written Sales Order and a listed product 30; HubSpot limits the BAA to Covered Services 6; Braze to a provisioned HIPAA Account 10.
3. Content limits. Braze bars diagnoses and test results in messages 10; Constant Contact allows contact data only 16; Adobe excludes mental health and genetic data 30.
4. Downstream destinations. Braze says third-party providers may not be HIPAA compliant 10; Adobe forbids sharing with non-ready products 30.
5. Your configuration. Salesforce requires customers to encrypt PHI 9; Microsoft states a BAA does not ensure compliance 2; Freshpaint's filtering depends on your rules 24.
6. Breach timing. HubSpot commits to ten business days 6; Braze to "without unreasonable delay" 10. Negotiate what your policy needs.
7. Security duties. Your own risk analysis, access control and logging remain; see the HIPAA Security Rule update tracker.

Decision guide

Checklist before you load PHI into any tool:

1. Map the data: which fields, which destinations, which pages.
2. Request the BAA and read the covered-product list and exclusions.
3. Match your exact module and tier to the BAA.
4. Check content and field limits against your messages.
5. Confirm downstream integrations have their own BAAs or receive no PHI.
6. Test with synthetic data; record the result.
7. Store the BAA, scope and review date in your vendor register (BAA checklist, martech BAA checklist).

Update log

This page is refreshed quarterly; vendor terms change without notice.

Download the BAA checklist and run it on every tool in your stack, then return to the regulation hub for related trackers.