Business Associate Agreement for Telehealth: Which Vendors Need One

A telehealth brand needs a business associate agreement (BAA) with any vendor that creates, receives, maintains or transmits protected health information (PHI) on its behalf, if the brand or its clinical practice is a HIPAA covered entity. CRMs, SMS tools and call centers holding patient data usually qualify. Ad platforms should receive no PHI at all.

For a weight-loss GLP-1 brand, that covers the intake quiz, the CRM that stores treatment plans, the refill-reminder SMS tool and recorded sales calls. It does not cover a media buyer who only sees campaign results.

Policy checked on November 2, 2026.

What HHS says makes a vendor a business associate

HHS describes a business associate as a person that performs functions or activities on behalf of a covered entity that involve creating, receiving, maintaining or transmitting PHI, or that provides certain services involving the disclosure of PHI. The HIPAA Rules apply to health plans, clearinghouses and health care providers that transmit health information electronically in a covered transaction. A covered entity can also be a business associate of another covered entity. Whether a given brand or its affiliated practice is a covered entity depends on its own facts.

HHS lists data analysis, billing and practice management as example activities. Its example business associates include cloud providers, IT vendors with access to ePHI and patient-messaging app developers. Status turns on the facts, not the paperwork: in its tracking bulletin HHS says a tracking technology vendor that meets the definition is a business associate whether or not an agreement exists, and signing a BAA does not make a vendor one if it does not meet the definition.

BAA map for a GLP-1 growth stack

The table maps common growth tools to the HHS definition. “Typically” means the answer turns on whether PHI actually reaches the vendor.

HHS’s conduit exception is narrow. It covers entities that only transmit PHI, with temporary storage, and HHS says entities that access PHI regularly to perform a service are not conduits.

When a marketing agency needs a BAA, and when it does not

A marketing agency needs a BAA when it creates, receives, maintains or transmits PHI for the brand, for example through CRM access, call recordings or form data tied to care. Media buying and creative work that never touch PHI do not create the relationship. HHS says no BAA is required with a person whose services do not involve PHI, provided any access is only incidental and reasonable safeguards are in place.

An agency that is a business associate must sign a BAA with its own subcontractors before disclosing PHI to them. The covered entity does not have to sign directly with those subcontractors.

The HHS online tracking bulletin after AHA v. Becerra

A federal court vacated one part of the HHS tracking bulletin in June 2024, and the rest of the page stays posted.

The vacated portion covered circumstances where a tool connects an individual’s IP address with a visit to an unauthenticated public webpage about specific health conditions or providers. The court held the bulletin’s new rule “was promulgated in clear excess of HHS’s authority under HIPAA,” as the AHA reported.

The posted bulletin still says:

• Tracking technologies on authenticated pages generally have access to PHI.
• Unauthenticated booking or symptom-checker pages may collect an email address or a reason for seeking care.
• A tracking vendor that handles PHI for a regulated entity is a business associate.
• A cookie banner is not a valid HIPAA authorization, a privacy policy notice alone does not permit PHI disclosures, and a vendor agreeing to strip PHI before saving it is not enough on its own.

For Meta-specific setup, see health data restrictions and tracking.

What marketing teams keep out of ad platforms

Marketing teams keep health information out of ad platforms because the platforms’ own terms ask for it, and the FTC has acted when health and telehealth companies did the opposite. Meta’s Business Tools Terms tell advertisers not to share data they know or reasonably should know includes health information.

Three FTC actions show the pattern:

• BetterHelp: a final order in July 2023 requiring $7.8 million and banning health data sharing for advertising.
• Cerebral: an April 2024 proposed order with more than $7 million in payments, after tracking tools sent sensitive data on nearly 3.2 million consumers to third parties.
• Monument: an April 11, 2024 action banning it from disclosing health information for advertising.

These are FTC cases, not HIPAA enforcement, and each involved data sent to advertising platforms.

A BAA is not a marketing authorization

A BAA lets a vendor handle PHI for the brand’s own functions. It does not permit marketing use of that PHI. HHS says that, with limited exceptions, the Privacy Rule requires an individual’s written authorization before PHI is used or disclosed for marketing. HHS also says a BAA cannot authorize a use or disclosure that would violate the Privacy Rule if the covered entity did it, with narrow exceptions for the vendor’s own administration and data aggregation.

If HIPAA does not apply to your brand

If HIPAA does not apply to a brand, HHS points to other law. The bulletin says that where the HIPAA Rules do not apply, other law may, such as the FTC Act and the FTC’s Health Breach Notification Rule. The FTC actions above are the practical reference.

Questions to ask any growth vendor

Ask any growth vendor these questions before PHI or intake-linked data reaches it:

1. Will you sign a BAA, and which services does it cover?
2. Who are your subcontractors, and do they sign BAAs with you?
3. What data does your tool receive, and where does it go next?
4. What is excluded from coverage, such as analytics add-ons or AI features?

FAQ

Does a telehealth provider need a BAA? Only with vendors that act as business associates, and only if the provider is a covered entity.

Does a marketing agency need a BAA? Yes if it creates, receives, maintains or transmits PHI for the brand. No if it works only from data that contains none.

Can a BAA make it safe to send health data to an ad platform? Meta’s Business Tools Terms ask advertisers not to send data that includes health information, so the working rule is to keep PHI out. HHS also says disclosures need a Privacy Rule permission, not only a BAA.

Did the 2024 ruling end the HHS tracking guidance? No. The court vacated one part. The rest of the bulletin remains on the HHS site.

Book a call to talk about scaling your brand.