Last updated: August 10, 2026 · By Jason Garrett, Founder, Coast Studio. Not legal advice. Full legal landscape: The State of HIPAA Tracking.
For any tool that receives PHI, yes — and the tools you most want to use will not sign one. A BAA is the contract that lets a vendor handle PHI on your behalf. No BAA means no PHI, full stop. The stack you build has to respect that split.
Who signs, and who never will
- Will not sign for their ad/analytics products: Google (GA4 and Google Ads), Meta (pixel and CAPI), TikTok, Hotjar. These can never receive PHI. See GA4 and the Meta pixel.
- Will sign on the right plan: CallRail (Healthcare plan), HubSpot (Enterprise with sensitive-data features), Mixpanel and Amplitude (qualifying plans), and your cloud host for a self-managed server-side container.
The architecture the split forces
Because your best ad platforms will never sign, compliance can't come from a signature — it has to come from architecture. You keep PHI inside BAA-covered systems (your warehouse, a server-side gateway, BAA-signing analytics) and send ad platforms only scrubbed, non-identifying signal. The BAA question and the scrubbing question are two halves of the same design: sign where you can, scrub everywhere you can't.
A simple test for any new tool
- Will this tool ever receive an identifier paired with a health signal?
- If yes, will the vendor sign a BAA? If they won't, it cannot receive that data — redesign the flow.
- If they will, get it countersigned and configured before go-live, not after.
FAQ
Does a signed BAA make a tool "HIPAA compliant"?
It is necessary, not sufficient. Configuration and how you use the tool still decide compliance. A BAA with a misconfigured tool is a false sense of safety.
Google offers HIPAA coverage — doesn't that cover Ads?
Google's BAA covers Cloud and Workspace, never Google Ads or GA4. Do not conflate them.
Can consent replace a BAA?
No. They solve different problems. Consent permits certain sharing; a BAA binds a vendor to protect PHI. A no-BAA vendor still cannot receive PHI, consent or not.
Sorting out your exposure?
Coast Studio runs compliance-first paid media for regulated health brands — we map your legal exposure and build tracking that holds up. Not legal advice.
Book a Consultation