Is the Amazon Ads MCP HIPAA Compliant? A Health Verdict

No, the Amazon Ads MCP server is not HIPAA compliant, because no Business Associate Agreement covers Amazon Ads: AWS's BAA lists only specific AWS services, Amazon Ads is not one, and Amazon's own pixel policy bars targeting audiences based on health or medical information. It can also create, change and delete campaigns, so the risk is control as well as privacy. Curve controls what Amazon receives: mapped, neutrally named conversion events sent server-side, with a signed BAA on every plan. Curve MCP gives your AI assistant aggregate answers about your own site that withhold small groups.

What Amazon's MCP server can see and do

Amazon Ads launched its MCP server as an open beta on February 2, 2026, available globally to holders of active Amazon Ads API credentials. It is a remote server that Amazon hosts, with separate endpoints for North America, Europe and the Far East (the North American one is advertising-ai.amazon.com/mcp).

Amazon's announcement and its MCP developer docs describe what the server does:

• Reporting. Campaign performance queries and report generation.
• Campaign management. Create, update and delete campaigns, change budgets and bids, and launch a Sponsored Products campaign end to end from one prompt.
• Expansion. Add new countries to an existing campaign with its own budget.
• Accounts and money. Create accounts, manage account settings, and read billing and financial data such as invoices.
• DSP and Amazon Marketing Cloud. Amazon's setup guide says some tools take a DSP advertiser account or an Amazon Marketing Cloud (AMC) instance ID, so the catalog reaches past Sponsored Products.

It comes in two forms. The Regular endpoint registers one tool per operation, with names like campaign_management-delete_campaign. The Lite endpoint (/mcp/lite) exposes three meta-tools, amazon_ads_mcp-search_tools, amazon_ads_mcp-describe_tools and amazon_ads_mcp-invoke_tool, and Amazon says it can do everything the Regular one can. Amazon's own Lite example updates a target bid through invoke_tool.

Access runs through Login with Amazon. The OAuth 2.1 route lets your client handle tokens (in public-client mode the access token expires after an hour), while the token-based route has you paste tokens into the client's config yourself. Some third-party blogs describe a read-only launch mode; Amazon's own announcement lists create, update and delete, so plan for a server that writes and spends.

Why the answer is no: check every hop

HIPAA compliance is a property of the whole data path, not a badge on one product. For a HIPAA covered entity (most clinics and pharmacies, and telehealth providers that bill insurance), any outside party that creates, receives, maintains or transmits PHI on your behalf is a business associate under 45 CFR 160.103, and HIPAA requires a written agreement, the BAA, before PHI flows to it.

Not every health brand on Amazon is in that position. A telehealth business falls under HIPAA only if its providers bill electronically for covered transactions such as insurance claims, or if it works as a business associate of a medical group that does. Cash-pay brands can sit outside HIPAA and still answer to the FTC and state health privacy laws. Our guide to PHI-safe Amazon Ads conversions for health brands sorts out which rules apply.

For a covered entity, walk the path an Amazon Ads MCP answer takes:

1. Your Amazon Ads account. AWS's list of HIPAA-eligible services includes Amazon Bedrock and Bedrock AgentCore. It does not include Amazon Ads or Amazon Marketing Cloud, and we found no BAA that Amazon offers for its advertising products.
2. The MCP server. Amazon hosts it, and none of the MCP pages we reviewed mention health or sensitive data. Amazon also says it does not own or operate the AI applications that connect.
3. The AI client. Anthropic's BAA page says MCP connectors can be used on HIPAA-ready Claude Enterprise, but data sent to third parties through them is not covered. Running your agent on Bedrock under an AWS BAA covers the model hop, not the Amazon Ads hop.
4. The credentials. The token-based setup has you save access and refresh tokens yourself. The access token is short-lived; the refresh token, with your client credentials, can mint new ones for every account that login reaches.

No hop in that chain puts Amazon Ads under a BAA. So the working rule is simple: nothing that could be PHI goes into the Amazon account, and nothing patient-level goes into the chat next to Amazon data. Our HIPAA-safe MCP server checklist applies the same test to any server.

Where health signals leak on Amazon Ads

The MCP server creates no health data. It surfaces what your account holds and lets the model act on it. Four places carry the signal.

Conversion events

The Amazon Ad Tag runs in the visitor's browser, so it sees the page it fires on, and a URL like /consult/low-testosterone is a health inference about an identifiable device. Amazon's pixel requirements forbid passing names, email addresses or phone numbers through its cookies, but on a health site the page is the disclosure.

The server-side Events API is not automatically safer. Each event carries a free-text name, optional custom attributes such as brand, product ID or category, and match keys, and Amazon's guide says passing as many identifiers as you have produces better matches. Amazon also says the Events API supports richer audience creation, so a conversion you send can become a targeting segment. Once a conversion definition called "ED consult booked" exists, any report that lists it puts that name in the model's context.

Two details make mistakes permanent or portable. Dataset names are immutable once set, so a dataset named for a service line stays that way. And every custom attribute you send is available in Amazon Marketing Cloud, which some Amazon Ads MCP tools address by AMC instance ID. Amazon's own example attribute is a postal code, and a full ZIP code is one of the identifiers HIPAA's Safe Harbor method removes.

Curve's Amazon Ads destination settles the event name, attached fields and match key on the server before Amazon sees anything (mechanism below).

Audience segments

Amazon DSP builds custom audiences from rules, pixels or hashed files. A hashed patient file still discloses who your patients are: hashing is the matching mechanism, not a privacy control. Amazon's pixel policy says advertisers must not use its cookies to reach audiences based on sensitive personal information, including health or medical information. Names travel too: an audience called "Lapsed GLP-1 patients" is a health statement before anyone queries it, which our customer list upload audit covers in detail.

Campaign, keyword and report names

Sponsored Products campaign names, keyword targets and ad group labels often spell out conditions. On their own they are marketing data, not PHI. They become a problem when a report cuts a narrow campaign down to a handful of conversions and someone in the conversation knows who those people are.

The chat window

The most common leak is the user. Someone pastes an order export into the chat to match against Amazon results, or attaches a CRM server to the same session, and PHI now sits in the model's context where it can end up in a tool call to Amazon. Our piece on where MCP tool calls leak health data traces those paths. The better source for "how many people booked last month" returns counts without rows, which is the job Curve MCP does.

What you can safely ask it, and the guardrails

If the account holds no PHI, Amazon's server is a reasonable tool for aggregate questions: spend pacing, cost per click by campaign, budget headroom, invoice lookups, and bid changes you approve one at a time. The risk then shifts to control, because the session that reads a report can also raise a budget or delete an ad.

• Pin one account, then enforce it with the login. The default Dynamic Account Context lets the model look up and reuse any account ID your login can reach. Fixed Account Context pins requests to one account, but it is a header, not a permission: the token still reaches every account the login can. The real boundary is a dedicated Amazon user invited only to that advertiser account (see client data boundaries for healthcare agencies).
• Deny every write tool on the Regular endpoint. Amazon's example config (for the Kiro client) disables only campaign_management-delete_campaign and campaign_management-delete_ad. That leaves every create, update, budget, launch and account tool live. Deny all of them, and re-read the tool list after Amazon updates the server, because a deny-list lets new tools through.
• Avoid Lite for anything sensitive. On Lite, every operation runs through amazon_ads_mcp-invoke_tool, so a per-tool block cannot separate reads from writes.
• Keep a human on every write. The MCP spec says a human should always be able to deny a tool call, and it treats read-only and destructive annotations as hints, not guarantees.
• Prefer OAuth to pasted tokens. Hand-copied tokens end up in config files, notes and chat logs. OAuth keeps them out of those places, but in private-client mode the refresh token sits in the keychain or a credentials file, so that machine holds the keys.
• One data source per session. Do not attach a CRM, EHR or intake-form server alongside Amazon.

How Curve limits what Amazon and the AI can see

What Amazon receives

Curve's tracking script takes the place of the Amazon Ad Tag on your pages, so events land on US-hosted infrastructure instead of going from the browser to Amazon. The Amazon Ads destination then forwards them server-to-server through Amazon's Events API, and only the fields you map for Amazon go; by default, nothing does. Each event uses a neutral name and one of Amazon's standard conversion types, such as LEAD or CHECKOUT, rather than the service line.

The match key is a first-party pseudonymous ID by default. SHA-256 hashed email or phone goes only if you switch it on, and hashing only meets Amazon's format rule: Amazon can still match it to a person, which is why it is off by default.

PHI-pattern detection watches payloads for PHI-shaped values such as SSNs, MRN-style IDs and dates. It is a monitoring layer that flags problems, not a redaction step. The protection comes from field mapping, neutral event names and contact identifiers left off by default, under a signed BAA included on every plan.

Set up this way, the conversions Curve sends name no condition. Anything already in the account (old Ad Tag conversions, conversion definitions, datasets, audiences) is yours to rename or retire.

What the AI sees

Curve MCP does not return Amazon campaign rows (its campaign figures come from Google Ads and Meta), so Amazon spend questions still go to Amazon's server; Curve MCP answers what happened on your site: visitors, sessions, goal completions and funnel steps. For those campaigns it reconciles your server-side tracking, putting platform-reported spend, clicks and impressions next to the conversions Curve recorded, with cost per conversion by completed week, and one link opens the full sent, accepted and matched view inside Curve. Look-backs are fixed at the last 1, 4, 13 or 52 weeks.

People are counted across the whole window, small groups are withheld, counts are rounded, and a number that could be subtracted from another to expose a small group is withheld too. Our explainer on small-group rules for MCP answers shows why each rule exists.

• Goal, funnel and campaign names appear only if your organization approved them; otherwise they read "(label hidden)".
• No string a visitor can set ever comes back: no UTMs, page paths or referrers.
• Tools are read-only, tokens are scoped and expire, and every call is logged. If the log cannot be written, no data is returned.
• The service runs under a database role that cannot read contact details, form answers or journeys.
• A final guard blocks any answer that looks like an email, phone number, ID, date or name, and it fails closed.

Two limits: Curve MCP returns no revenue or ROAS, and our BAA covers our service, not the AI vendor you connect, so that choice needs its own review. Person-level questions get a one-time link that opens Curve Analyst behind your login and carries no data.

Frequently asked questions

Is the campaign data the Amazon Ads MCP returns PHI?

Usually not on its own. Spend, clicks and conversion counts by campaign are aggregate marketing data. It becomes sensitive when event or audience names describe a condition, when counts are small enough to point at individuals, or when patient-level data sits in the same conversation.

Can the Amazon Ads MCP reach Amazon Marketing Cloud?

Yes, in part. Amazon's setup guide says some tools take an AMC instance ID, and Amazon's Events API guide says every custom attribute you send is available in AMC. Treat any attribute you attach to an Amazon conversion as within an agent's reach, and keep it to neutral values.

Does Fixed Account Context stop the model reaching other accounts?

No. It is a header your client sends, and Amazon describes the bearer token as carrying the application's permission for a given Amazon user, so it reaches every account that user can. Use a dedicated Amazon user invited to one advertiser account.

If our agent runs on Amazon Bedrock under a BAA, is the Ads MCP covered?

No. Bedrock and AgentCore are HIPAA-eligible under the AWS agreement, which covers the model hop. The Amazon Ads MCP server and the ad account behind it are not on that list, so what you send them falls outside the agreement.

Is Kiro a safe client for the Amazon Ads MCP?

Only for Kiro's own side. AWS lists Kiro (excluding Kiro Web) as HIPAA-eligible, but that covers Kiro's processing under an AWS BAA, not Amazon Ads; whatever Kiro sends to the Amazon Ads MCP server lands outside it. The same trap applies to clean rooms: AWS Clean Rooms is on the eligible list, and Amazon Marketing Cloud is not.

Can we make the Amazon Ads MCP server read-only?

We found no read-only mode in Amazon's MCP documentation. On the Regular endpoint, deny every write tool in your client's configuration, not just the two deletions Amazon's example blocks. On Lite that filtering does not work, so require a human to approve every call.

Where to start

1. Run the free compliance scanner on your health pages to see whether the Amazon Ad Tag or any other pixel fires there.
2. Read your conversion definition names, dataset names, audience names and uploaded lists as if they were public. Rename or retire anything that names a condition.
3. If you connect Amazon's MCP server at all, use a dedicated single-account login, deny the write tools and keep human approval on.
4. Book a demo to see the Amazon Ads destination and Curve MCP in action, with the signed BAA included on every plan.

Reviewed September 2026. Checked against Amazon's February 2026 announcement, its MCP and Events API documentation, and AWS's HIPAA-eligible services list. The server is an open beta and its tool catalog changes, so confirm against the live tool list your client loads.