Do I Need a BAA With My Marketing Agency?

A clinic owner called us once genuinely rattled. Her old agency had set up a slick new booking funnel, plugged it into a shared spreadsheet, and the whole team could see patient names, phone numbers, and the reason each person booked. It worked great. Then she read a headline about a hospital paying millions over a tracking pixel and realized she had never signed a single compliance document with that agency. She asked the obvious question a beat too late: were we even allowed to do it that way?

Most practice owners find the Business Associate Agreement the same way, after the fact. So let us do it in the right order.

What a BAA actually is

A Business Associate Agreement, almost always shortened to BAA, is a contract that HIPAA requires between a covered entity, which is your practice, and any outside vendor that handles protected health information on your behalf. The U.S. Department of Health and Human Services lays this out plainly in its guidance on business associates. The agreement is not a formality. It defines what the vendor is allowed to do with the data, the safeguards they have to keep in place, how quickly they must tell you if there is a breach, that their own subcontractors have to follow the same rules, and that they return or destroy the data when you part ways.

Here is the part people miss. Sharing patient data with a vendor who has not signed a BAA is itself a violation, even if nothing ever leaks. The missing paperwork is the problem. The breach, if one happens, is a second, bigger problem on top of it.

What counts as protected health information in marketing

Owners assume protected health information means charts and lab results. In a marketing context it is usually much more ordinary than that. The moment data ties a specific person to your practice, which is a healthcare provider, it generally counts. In day to day marketing that includes:

• A name and phone number on a booking or contact form.
• An email address tied to an appointment request.
• The service someone asked about, like a vasectomy consult or a therapy intake.
• Call recordings and call tracking logs from patients phoning in.
• Leads sitting in a CRM, a shared inbox, or yes, a spreadsheet.
• Website analytics or ad data that can be traced back to an identifiable visitor.

If your agency can see any of that, they are creating, receiving, or storing protected health information on your behalf, and under HIPAA they are your business associate. That is the trigger. It is not about whether they call themselves a healthcare company. It is about what data passes through their hands.

So when do you actually need one?

The clean rule: if the agency touches patient data, you need a BAA before the work starts. If they genuinely never touch it, you may not.

That second case is rarer than agencies like to claim. An agency that only ever sees anonymous, aggregate numbers, total visits, total leads, cost per booking, with no way to identify a single patient, is not handling protected health information. But the second they log into your booking system, pull your lead list, listen to call recordings, or manage a pixel that captures who filled out a form, they are. Most agencies that run a practice's full intake and follow up are squarely in business associate territory whether they have noticed or not.

The tracking pixel trap, and why the law here is messy

The sharpest version of this problem is the advertising pixel. When you drop a standard Meta pixel or a Google tag onto a page where patients type their information, a booking page, a symptom checker, a contact form, that tool can ship identifiable data straight to the ad platform. And the ad platforms do not sign BAAs for pixel data. There is no version of that setup that is covered.

That exact mismatch set off a wave of litigation. Novant Health settled for $6.6 million over tracking pixels on its patient portal, a case that touched up to 1.36 million patients. It is one of dozens. We went deeper on the lawsuits and the fixes in our breakdown of the HIPAA tracking pixel lawsuits and in whether the Facebook pixel is HIPAA compliant for a medical practice.

Now the honest nuance, because the ground shifted. In December 2022, the Office for Civil Rights issued guidance saying that even data from unauthenticated public pages could be protected health information. Hospitals pushed back, and on June 20, 2024, a federal judge in Texas vacated the broadest part of that guidance, ruling the agency had overstepped, as the HIPAA Journal reported. The agency later dropped its appeal.

Do not read that as permission to relax. The ruling narrowed one aggressive interpretation of a public homepage. It did nothing to protect the pages where patients actually enter their details and their appointment reasons, which is where nearly all the lawsuits lived and still live. The safe posture has not changed: keep patient data away from ad pixels, and have a BAA with anyone who handles the rest.

Who holds the bag when it goes wrong

This is the uncomfortable part. You do. As the covered entity, your practice carries the liability for an improper disclosure, even when it was your vendor's loose setup that caused it. The agency can be on the hook too, especially once a BAA exists and assigns them responsibility. But the patient complaint, the regulator's first letter, and the reputational hit land on your practice's name. A BAA does not make the risk disappear. It does make clear, in writing, who is responsible for what, and it forces the vendor to keep the safeguards that prevent the mess in the first place.

Treat the BAA question as a hiring test

Here is the practical move. When you interview any agency that will handle your patient flow, ask one direct question early: will you sign a BAA, and how do you keep patient data compliant? Their answer tells you almost everything.

• Good answer. Yes, here is our BAA, and here is specifically how we keep protected health information out of ad pixels and lock down your lead data. Confident, specific, already solved.
• Also acceptable. We never touch patient data at all, and here is exactly how our setup avoids it. Fine, if they can truly prove it.
• Walk away. A blank look, a what is that, or a they will handle it on their end brush off. If an agency that runs healthcare marketing does not have a ready answer, they are either new to healthcare or allergic to responsibility.

This belongs on the same checklist as the rest of your due diligence. We put together the full list in the questions to ask before hiring a healthcare marketing agency, and the BAA question earns a spot near the top.

How EtherealMinds handles it

We work only with healthcare practices in the United States, so compliance is not a bolt on for us, it is the baseline we build from. We sign a BAA with every practice we handle patient data for, before anything goes live. Our tracking is built so that identifiable patient information never gets fed to advertising pixels, using server side conversion tracking that tells you a booking happened without shipping the patient's identity to the ad platform. And the data we do touch, your leads, your calls, your follow up, lives in access controlled systems, not a shared spreadsheet anyone can open.

That shows up across everything we run: a website built with compliant forms and clean conversion tracking, a patient acquisition system that protects lead data as it moves from click to booked appointment, and social media management that promotes your practice without ever mishandling a patient's details. If you want the wider view on doing this right, start with our guide to HIPAA compliant healthcare marketing. The goal is simple: grow the practice without turning a marketing decision into a legal one.

Frequently asked questions

Does my marketing agency need a BAA?

Yes, if the agency creates, receives, stores, or transmits protected health information on your behalf, HIPAA requires a signed Business Associate Agreement before any data changes hands. In marketing that usually means the agency can see patient names, phone numbers, email addresses, appointment requests, or health conditions through your booking forms, your CRM, your call tracking, or your ad platforms. If they only ever touch anonymous, aggregate numbers and never see an individual patient, a BAA may not be legally required, but in practice most agencies that run a practice's intake and follow up do touch that data.

What is a Business Associate Agreement?

A Business Associate Agreement, or BAA, is a contract required by HIPAA between a covered entity like your practice and any vendor that handles protected health information for you. It spells out how the vendor may use that data, the safeguards they must keep, how fast they must report a breach, that their own subcontractors must follow the same rules, and that they must return or destroy the data when the relationship ends. Without it, sharing patient data with that vendor is itself a HIPAA violation, separate from any breach.

What happens if I share patient data with a vendor without a BAA?

The practice, as the covered entity, carries the liability. Disclosing protected health information to a vendor without a signed BAA is a violation on its own, whether or not the data is ever leaked. HIPAA penalties in 2026 reach up to $53,088 per violation, and a single misconfigured tracking pixel or contact form can count as many violations at once. Real settlements have landed in the millions, such as the $6.6 million Novant Health paid over tracking pixels on its patient portal.

Is a marketing agency that refuses to sign a BAA a red flag?

Usually, yes. If an agency will handle your patient data and refuses to sign a BAA, either they do not understand healthcare compliance or they do not want the responsibility that comes with it. Both are reasons to walk. The one honest exception is an agency that has deliberately built its systems so it never touches protected health information at all, in which case they should be able to explain exactly how that works. Vague answers are the warning sign.

Do website tracking pixels like the Meta pixel need a BAA?

Standard ad platform pixels such as the Meta pixel and Google tags are not offered under a BAA, and the big ad platforms will not sign one for pixel data. That is exactly why placing an ordinary pixel on a page that captures patient information, like a booking or symptom page, has driven a wave of lawsuits and settlements. The safe path is to keep protected health information away from those pixels entirely using server side setups and conversion tracking that does not ship patient identity to the ad platform.