On this page
A HIPAA compliance checklist for marketing starts with the basics a covered entity must already have, a privacy official and a Security Rule risk analysis, then adds the marketing checks: every vendor that handles PHI signs a business associate agreement (BAA), and websites, forms and ads keep PHI away from tools that do not sign one. Work through it once, then again whenever you add a tool. Curve Compliance, a marketing and website tracking service for healthcare that signs a BAA on every plan, built this list from eCFR and HHS on November 2, 2026.
Book a call. Want the website and ad part of this checklist done with you? Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. Curve then replaces browser ad pixels with server-side conversions and strips PHI before data reaches an ad platform. Setup is done for you, typically live in about a week. Book a call with Curve.
Who owns HIPAA compliance
Two named people own the program. “A covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity,” plus a contact person or office for complaints (45 CFR 164.530). The Security Rule adds: “Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart” (45 CFR 164.308).
Marketing does not own HIPAA, but it brings new tools, vendors and data flows to those two people. The simplest habit: no new pixel, form, CRM or agency goes live until the privacy official has seen what it collects and where it sends it. See the HIPAA privacy officer and marketing.
Administrative checks
These sit with the privacy and security officials. Marketing's job is to make sure its tools are part of each one.
- Risk analysis. “Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information” (45 CFR 164.308). HHS calls it “the first step” (HHS). Include marketing tools that touch ePHI; see HIPAA risk assessment for marketing tools.
- Risk management. “Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level” (45 CFR 164.308). See HIPAA safeguards.
- Training. Privacy training for “all members of its workforce” (45 CFR 164.530) and “a security awareness and training program for all members of its workforce (including management)” (45 CFR 164.308). Marketing staff count, and so does anyone else whose work for you is under your “direct control” (45 CFR 160.103).
- Sanctions. A covered entity “must have and apply appropriate sanctions against members of its workforce who fail to comply” (45 CFR 164.530).
- Complaints. “A covered entity must provide a process for individuals to make complaints” (45 CFR 164.530). See the HIPAA complaint process.
- Notice of privacy practices. Kept current and posted (45 CFR 164.520). See the notice of privacy practices and your website.
- Periodic evaluation. “Perform a periodic technical and nontechnical evaluation” of security policies and procedures (45 CFR 164.308).
Vendor and BAA checks
A covered entity may let a vendor handle PHI “if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information” (45 CFR 164.502). HHS is blunt about skipping that step for cloud services: using one to process or store ePHI “without entering into a BAA with the CSP” puts the covered entity “in violation of the HIPAA Rules” (HHS). For tracking tools it says regulated entities “must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI” (HHS).
List every marketing vendor and answer three questions for each: does it receive PHI, does it sign a BAA, and on which plan? The usual list is CRM, email and SMS, forms, scheduling, call tracking, chat, analytics, session replay, the agency, and the ad platforms. The BAA Directory gives each vendor's position in its own words, and how to ask a vendor for a BAA has the email to send. Ad platforms are the hard case: the directory lists Meta, Google Ads and TikTok as not signing one, so what reaches them has to be free of PHI.
Website and tracking checks
HHS says “The HIPAA Rules apply when the information that regulated entities collect through tracking technologies or disclose to tracking technology vendors includes protected health information (PHI)” (HHS). A federal court vacated part of that guidance on June 20, 2024, for IP addresses on unauthenticated public pages about specific conditions or providers; the HHS page notes the order (HHS). Which of your pages that touches depends on your setup, so talk to your counsel.
- Inventory every tag. Run a free website scan and list each pixel, tag and script by page.
- Check the sensitive pages first. Booking, intake, contact, patient login and any page about a specific condition or treatment.
- Read what each tag sends. Form answers, emails and phone numbers in URLs or events, and page titles that name a condition. See what counts as PHI on a website.
- Clean URLs and event names. No conditions or contact details in query strings, UTMs or event labels. See are UTM parameters PHI.
- Replace or remove what cannot be fixed. A tag that sends PHI to a vendor with no BAA and no permission has to change.
The HIPAA compliant website checklist covers each step in depth. If you would rather have Curve look at this section with you, book a call.
Forms, chat and phone
- Forms. The form tool signs a BAA, answers go only to systems that do, and the thank-you page and its URL carry no answers. See HIPAA compliant forms and what makes an intake form HIPAA compliant.
- Chat. The chat vendor signs a BAA if visitors can type health details, and its script sends nothing about the conversation to ad tools. See HIPAA compliant chatbots.
- Phone and call tracking. Recordings and transcripts stay with a vendor that signs a BAA, and only a neutral call event goes to ad platforms. See HIPAA compliant call tracking.
Ads and audiences
The Privacy Rule says “a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing,” with narrow exceptions (45 CFR 164.508). HHS puts it simply: “With limited exceptions, the Rule requires an individual's written authorization before a use or disclosure of his or her protected health information can be made for marketing” (HHS).
- Customer lists. Uploading patient emails or phone numbers to an ad platform is a disclosure. See Customer Match for clinics.
- Retargeting. No audiences built from visits to condition, treatment or booking pages when those visits carry PHI.
- Conversion events. Neutral event names and a fixed list of fields per platform. See HIPAA marketing authorization and ad tracking.
Records to keep and for how long
A covered entity must keep its policies and procedures, any communication the Privacy Rule requires in writing, and a record of any action, activity or designation it must document (45 CFR 164.530). It “must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later” (45 CFR 164.530). The Security Rule sets the same six years for its documentation and adds: “Review documentation periodically, and update as needed” (45 CFR 164.316). For marketing, that means keeping your tool inventory, BAAs, authorizations and each version of your notice. See HIPAA document retention requirements.
The printable checklist
Each row links to its rule. Print the page or copy the table into your own tracker.
| # | Check | Rule | Done when |
|---|---|---|---|
| 1 | Privacy official and complaint contact named | 164.530(a) | Names are documented |
| 2 | Security official named | 164.308(a)(2) | Name is documented |
| 3 | Risk analysis covers marketing tools | 164.308(a)(1) | Each tool that touches ePHI is assessed |
| 4 | Risk management plan | 164.308(a)(1) | Fixes are assigned and dated |
| 5 | Workforce training, marketing staff included | 164.530(b); 164.308(a)(5) | Training records exist |
| 6 | Sanctions policy | 164.530(e) | Policy is written and applied |
| 7 | Complaint process | 164.530(d) | Complaints are logged |
| 8 | Notice of privacy practices current | 164.520 | Current version posted |
| 9 | Every marketing vendor has a BAA status | 164.502(e) | Inventory lists PHI yes or no and BAA yes or no |
| 10 | Every tracking tag listed by page | HHS tracking guidance | Scan saved |
| 11 | No PHI to a tracking vendor without a BAA and permission | HHS tracking guidance | Sensitive pages checked |
| 12 | Authorization before PHI is used for marketing | 164.508(a)(3) | Signed authorizations on file |
| 13 | Forms, chat and call tools covered | 164.502(e) | BAAs signed; routing checked |
| 14 | Breach response ready | 164.404 | Plan meets the 60-day outer limit |
| 15 | Documentation kept six years | 164.530(j); 164.316(b) | Files are retained and reviewed |
| 16 | Periodic evaluation | 164.308(a)(8) | Rerun when a tool is added |
The 60-day figure in row 14 is the outer limit for notifying individuals: notice is due “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach” (45 CFR 164.404).
How Curve Compliance helps
Curve Compliance works on the website and ad tracking rows of this checklist, rows 10 and 11. The administrative rows stay with your privacy and security officials. Curve's team reviews what your website sends to Meta, Google and TikTok with you, then replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn.
Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted, which is a record you can keep. Curve is SOC 2 Type II and signs a BAA on every plan (BAA Directory entry). Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: 45 CFR 160.103; 45 CFR 164.308; 45 CFR 164.316; 45 CFR 164.404; 45 CFR 164.502; 45 CFR 164.508; 45 CFR 164.520; 45 CFR 164.530; HHS, Summary of the HIPAA Privacy Rule; HHS, Guidance on HIPAA and Cloud Computing; HHS, Marketing; HHS, Guidance on Risk Analysis; HHS, Use of Online Tracking Technologies; Curve BAA Directory entries for Meta, Google Ads and TikTok.
Frequently Asked Questions
What is a HIPAA compliance checklist?
It is a list of what HIPAA requires, each item tied to its rule, from naming a privacy official and doing a risk analysis to BAAs, training and six-year records (45 CFR 164.530; 45 CFR 164.308). A marketing version adds checks on websites, forms, tracking tools and ad audiences (HHS).
What does a HIPAA compliance audit check?
Whether the policies, safeguards, contracts and records the rules require exist and are followed. HHS's Office for Civil Rights “may conduct complaint investigations and compliance reviews” (HHS), and the table above maps each item to its rule so you can show the evidence.
Do marketing vendors need a BAA?
Yes, when they create, receive, maintain or transmit PHI for you (45 CFR 164.502). HHS says regulated entities “must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI” (HHS).
How long must HIPAA documentation be kept?
Six years from the date it was created or last in effect, whichever is later (45 CFR 164.530; 45 CFR 164.316). See HIPAA document retention.
Is a cookie banner enough for HIPAA?
No. HHS says “Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization” (HHS). See is a cookie banner enough for HIPAA.
How often should we review the checklist?
The Security Rule calls for a “periodic technical and nontechnical evaluation” (45 CFR 164.308) and for reviewing documentation “periodically, and update as needed, in response to environmental or operational changes” (45 CFR 164.316). A new marketing tool that touches PHI is a good trigger for another pass.
Talk to Curve Compliance
Book a call. Want the website and ad rows of your checklist handled? Curve Compliance strips PHI before data reaches an ad platform, sends conversions server-side and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.