HIPAA Compliant CDP: What Healthcare Marketers Need

A HIPAA compliant CDP is one whose vendor signs a business associate agreement (BAA) with you and sends each downstream tool only what that tool may receive. HHS says disclosing PHI to a tracking vendor without patient authorization needs a signed BAA and a Privacy Rule permission, and that only the minimum necessary PHI should be disclosed (HHS). Twilio Segment, Tealium, RudderStack, Hightouch, Piwik PRO and Freshpaint each say they offer a BAA, on the terms and sources in the table below. If the job is ad measurement, Curve Compliance does it directly: conversions go server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn with a fixed list of fields per platform, under a BAA Curve signs on every plan.

Book a call. A CDP is one way to keep patient data out of your ads. If your goal is ad performance, Curve Compliance sends conversions server-side, removes PHI before anything is sent to an ad platform, and signs a BAA on every plan. Curve's team does the setup. Book a call with Curve.

What a CDP is, and why HHS names it

HHS defines it in its tracking technologies bulletin: a customer data platform "is software that can combine data from multiple sources regarding customer interactions with a company's online presence to support a company's analytic and customer experience analysis." It adds that "Some CDP vendors may be willing to work with regulated entities as their business associates and enter into appropriate business associate agreements" (HHS).

The bulletin also describes the job a CDP can do for a clinic whose ad and analytics vendors will not sign a BAA. The clinic can sign a BAA with another vendor, such as a CDP vendor, "that will enter into a BAA with the regulated entity to de-identify online tracking information that includes PHI and then subsequently disclose only de-identified information to tracking technology vendors that are unwilling to enter into a BAA with a regulated entity" (HHS). That is the standard to hold any CDP to: a signed BAA in, and only de-identified data out to the vendors that will not sign.

A banner on the same HHS page notes that on June 20, 2024, the U.S. District Court for the Northern District of Texas vacated part of the guidance, to the extent it says HIPAA obligations are triggered when an online technology connects an IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers (HHS). Whether a given page or event involves PHI depends on your setup, so talk to your counsel.

What HIPAA adds to a CDP

Four points in the HHS bulletin decide whether a CDP setup holds up (HHS):

• A BAA before PHI flows. "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI."
• Minimum necessary. Every disclosure must be permitted, and "unless an exception applies, only the minimum necessary PHI to achieve the intended purpose is disclosed." See the minimum necessary rule for ad tracking.
• Cleaning it up later is not enough. "it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information." Without authorization, the vendor needs a signed BAA and a Privacy Rule permission.
• Marketing needs authorization. "disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures." See HIPAA marketing authorization and ad tracking.

Which CDPs and data platforms say they offer a BAA?

Each row quotes the vendor's own page, fetched October 26, 2026. Plans and terms change, so confirm the BAA for the exact plan and products you would buy.

Vendor	What the vendor says	Plan or condition	Source
Twilio Segment	"Twilio BAAs are available to customers on a Business Tier plan."	Business Tier; Twilio says to check that the Segment products you use are on its HIPAA Eligible list	Twilio Docs
Tealium	"we sign BAAs for our HIPAA customers across the Healthcare and Pharma verticals."	Tealium for Healthcare; "the default deployment is HIPAA Multi-Tenant Cloud" for US healthcare customers	Tealium for Healthcare
RudderStack	"We comply with HIPAA requirements for PHI and can sign a BAA"	Its plans page lists HIPAA among Enterprise plan features	RudderStack security; plans
Hightouch	"Hightouch supports customer compliance with HIPAA"	Its plans page lists "Custom Security Review (BAA, DPA, full SOC2 report)" among features in its Customer Data Platform and AI Decisioning plans	Hightouch docs; plans
Piwik PRO	"Sign a Business Associate Agreement (BAA) with us"	"Use the Enterprise plan in Piwik PRO." Its activation module was formerly called Customer Data Platform	Piwik PRO Help Center; shared responsibility
Freshpaint	"offers a Business Associate Agreement (BAA)"	Its FAQ sets it apart from a traditional CDP: "Nothing is shared unless you explicitly allow it"	Freshpaint FAQ

For one vendor in depth, see is Twilio Segment HIPAA compliant. For server-side tools more broadly, see the best HIPAA compliant server-side tracking tools.

The export problem: what happens after data leaves the CDP

A BAA covers the CDP vendor. It does not travel with the data. Piwik PRO says so on its own help page: "Piwik PRO does not sign business associate agreements (BAA) with the vendors for the solutions Piwik PRO can be integrated with," and "Piwik PRO does not de-identify data exported from Piwik PRO account" (Piwik PRO). The same logic applies to any platform that forwards events: the destinations are separate companies.

The ad platforms at the end of the pipe are outside that BAA too, and Curve's BAA Directory lists Meta and Google Ads as not signing one. Meta's Business Tools Terms say you will not share data that "includes or is based on, directly or otherwise, health information," and that the names you choose for events and conversions "must not reflect, imply or be based on" that information (Meta). Google says it does not offer BAAs for Google Analytics and does not intend its Google Ads call features to create HIPAA obligations. See which ad platforms sign a BAA.

So the question for any CDP is not only whether it signs, but what it forwards, field by field, to each destination that does not.

A buyer checklist

• A BAA on the plan you would buy. Several vendors above tie the BAA to a tier or plan. Ask which products the BAA names.
• Field control per destination. Each ad platform should receive a fixed list of fields that you can read, not everything the CDP holds about a person.
• PHI checks before anything leaves. HHS says tracking can disclose "an individual's medical record number, home or email address, or dates of appointments" (HHS). Check URLs, page titles, event names and form answers too. See what counts as PHI in website tracking and whether UTM parameters are PHI.
• Proof of what was sent. You want a log of each event sent to each destination, and what the destination accepted.
• A plan for consent and authorization. A cookie banner records a preference. It is not a HIPAA authorization; see consent management vs HIPAA authorization.
• Who sets it up. Ask who builds the destination mappings, who checks them after a site change, and how long it takes to go live.

Do you need a full CDP, or a conversion layer?

A CDP fits when you need one record per person across many systems, such as web, app, CRM, email and support, to feed personalization and analytics. That is the work the vendors above are built for.

If your goal is ad performance, the job is narrower. You need each booking, lead or purchase to reach Meta, Google Ads and your other ad platforms, credited to the right click, with nothing those platforms should not see. A conversion layer built for exactly that job gets there by the shortest path. If you are replacing pixels, see HIPAA compliant Meta pixel alternatives and how to remove the Meta pixel from a healthcare website.

How Curve Compliance helps

Curve Compliance handles the ad side directly, under the BAA it signs on every plan. Curve replaces browser ad pixels with one script and sends conversions server-side to the Meta Conversions API, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted.

Outcomes reach Curve from booking systems, CRMs and call tracking through incoming webhooks, from EHR and intake tools through Keragon, and as offline conversion uploads from a CRM or EHR. Curve credits each one to the original ad click, and bookings made days later still match. Campaign Reporting puts Meta and Google Ads spend next to those conversions. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; Twilio Docs, HIPAA Eligible Segment; Tealium for Healthcare; RudderStack security; RudderStack plans; Hightouch security overview; Hightouch plans; Piwik PRO, How to make your website compliant with HIPAA; Piwik PRO and customer shared responsibility for HIPAA compliance; Freshpaint FAQ; Curve's BAA Directory.

Frequently Asked Questions

What is a HIPAA compliant CDP?

A CDP whose vendor signs a BAA with you and sends each downstream tool only what it may receive, since HHS says disclosing PHI to a vendor without patient authorization needs a signed BAA and a Privacy Rule permission (HHS). For ad conversions on their own, Curve Compliance signs a BAA on every plan and sends each ad platform a fixed list of fields.

Is Segment HIPAA compliant?

Twilio says Segment is "a HIPAA eligible platform" and that "Twilio BAAs are available to customers on a Business Tier plan" (Twilio; Directory entry). That BAA covers Segment, not the tools it sends data to. Our Segment guide covers the details.

Does a CDP need a BAA?

Yes, if it will receive PHI from you. HHS says "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI" (HHS).

Can a CDP send data to Meta or Google Ads?

It can send what you configure, but Curve's BAA Directory lists neither Meta nor Google Ads as signing a BAA. Meta's Business Tools Terms say you will not share data that includes or is based on health information (Meta), and Google says it does not intend its Google Ads call features to create HIPAA obligations (Google Ads). Whatever reaches them must leave PHI behind.

What should a CDP keep out of what it sends to ad platforms?

PHI, including the examples HHS gives, such as "an individual's medical record number, home or email address, or dates of appointments" (HHS). Meta also says event and conversion names must not reflect or imply health information (Meta), so keep condition names out of event names, URLs and page titles.

Does a cookie banner make a CDP HIPAA compliant?

No. HHS says "Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization" (HHS). See HIPAA marketing authorization.

How long does setup take?

For a CDP, it depends on the vendor and how many sources and destinations you connect, so ask each vendor. For ad conversions, Curve Compliance's team does the setup for you, typically live in about a week.

Talk to Curve Compliance

Book a call. If your goal is ad performance, Curve Compliance sends conversions server-side with a fixed list of fields for each platform, strips PHI before data reaches an ad platform, and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.