Is Shopify HIPAA Compliant? DTC Telehealth Stores

No, Shopify is not HIPAA compliant. Shopify does not sign a Business Associate Agreement for Shopify or Shopify Plus, which means a covered entity cannot lawfully store protected health information in a standard Shopify store. That does not automatically rule Shopify out for direct-to-consumer telehealth, because a store can be architected so that PHI never enters it, but it does rule out the common pattern of collecting intake answers at checkout. For the advertising layer specifically, Curve is the HIPAA-compliant tracking platform that lets a DTC health brand keep Meta and Google conversion tracking on a Shopify storefront without exposing patient data, with a signed BAA on every plan.

The direct answer, in more detail

Shopify positions itself as commerce infrastructure, not healthcare infrastructure. Its standard terms do not include a BAA, its support and fraud-review staff can access order data, and its app ecosystem is built around apps reading order and customer records freely. Each of those is fine for selling sneakers and disqualifying for storing a patient's medication history.

Shopify has never claimed otherwise, and this is worth stressing because the gap is not a vendor failing. The confusion comes from the merchant side, where a telehealth founder sees that Shopify is SOC 2 audited and PCI DSS compliant and reasons that a platform secure enough for card numbers must surely be secure enough for health data. Those are different regimes. PCI DSS governs payment card data. HIPAA governs protected health information and imposes a contractual requirement, the BAA, that no amount of encryption substitutes for. A vendor can be extremely secure and still be unusable for PHI because it will not sign the paperwork.

When Shopify is genuinely fine

Plenty of health-adjacent businesses run on Shopify without a HIPAA problem, because HIPAA only applies to covered entities and their business associates. If you are a supplement brand, a wellness retailer, a fitness equipment seller, or a cosmetics company, you are generally not a covered entity, and the health-adjacency of your products does not by itself pull you into HIPAA.

The line gets crossed when your business provides or bills for care. A DTC telehealth brand that connects patients to prescribers, dispenses prescription medication, or bills insurance is operating as a covered entity or working directly with one. At that point the data your store touches starts to matter enormously.

State privacy laws complicate this further. Washington's My Health My Data Act and comparable statutes reach consumer health data far beyond the HIPAA definition, and they apply to businesses that are not covered entities at all. A supplement brand outside HIPAA can still be inside those laws.

The architecture that works

The workable pattern for DTC telehealth is a split stack. Shopify handles commerce. A separate HIPAA-eligible system handles clinical work. The two exchange as little as possible, and specifically never exchange clinical content.

In practice that means:

• Shopify holds the transaction. Product purchased, price, shipping address, order status. If the product is a subscription for a consultation or a treatment plan, the SKU should be generic enough not to encode a condition.
• The clinical platform holds the care. Intake questionnaires, prescriber notes, eligibility decisions, medication details, and messaging live in a system whose vendor has signed a BAA.
• The handoff carries an identifier, not a record. An order ID or a customer reference passes between systems. The questionnaire answers do not flow back into Shopify to sit in order notes or customer tags.

The failure mode is almost always convenience creep. Someone adds intake questions as checkout line-item properties so the fulfilment team can see them in one place. Someone tags customers by condition so they can be segmented for email. Someone pipes the prescriber's approval status into a Shopify metafield to gate reorders. Each is a small, sensible-feeling decision that puts PHI into a system with no BAA behind it.

Where the tracking problem shows up

Even with a clean split, the advertising layer creates its own exposure, and it is the layer most teams have not thought about.

A Shopify storefront running a standard Meta Pixel or a raw Google tag sends browser events directly to those platforms. Those events carry the page URL, and for a telehealth store the product page URL routinely names the treatment. They carry the product title in commerce events. They carry a persistent browser identifier that ties the whole sequence to one person. Meta and Google do not sign BAAs for their advertising products, so every one of those calls is a disclosure to a vendor with no BAA in place.

This is the same mechanism behind the pixel litigation that has produced more than $100 million in healthcare settlements. The plaintiffs' theory does not require that a diagnosis was transmitted. It requires that an identifiable person's health interest was disclosed to a third party. A product page for a specific medication does exactly that.

Shopify's native marketing integrations do not solve this. The Facebook and Google sales channels are built to send rich commerce data, including product names, because that is what makes catalogue advertising work. That richness is the problem.

How Curve handles a Shopify telehealth store

Curve is HIPAA-compliant ad tracking, attribution, and analytics for healthcare. On a Shopify store it replaces the client-side pixels with a server-side path that gives you a place to make decisions before anything leaves.

The Curve script installs on the storefront in place of the Meta Pixel and Google tag. Events go to Curve's US-hosted infrastructure rather than straight to the ad platforms. From there:

• Field mapping controls what forwards. Only fields you explicitly map reach a given destination, configured per destination. Product titles, page URLs, and line-item properties stay behind unless you deliberately map them. The default is that nothing goes.
• Identifiers are hashed. Email, phone, and name are SHA-256 hashed to meet each platform's conversion API requirements before forwarding.
• Event aliases stay neutral. The commercial event can be a generic purchase or subscription signal rather than one naming the treatment, so the ad platform interface never displays the condition.
• PHI-pattern detection monitors payloads. Curve flags PHI-shaped values such as SSNs, MRN-style identifiers, and long numeric sequences. This is a monitoring layer that tells you when something upstream changed; the protection itself is the field mapping.
• Bridge tokens preserve attribution across the handoff. When a customer leaves the storefront for a separate intake or booking experience, attribution normally breaks at exactly the moment it becomes valuable. Bridge tokens carry it across.

Clean conversions forward server-side to Meta CAPI, Google Ads Enhanced Conversions, TikTok Events API, Microsoft, and LinkedIn. Because the path is server-side, it is also unaffected by ad blockers and browser tracking prevention, which typically improves measured conversion volume rather than reducing it. Every Curve plan includes a signed BAA.

Subscription billing deserves separate thought

Most DTC telehealth revenue is recurring, and subscription apps sit on top of Shopify with their own data stores and their own vendor relationships. A subscription app that records why a plan was paused, or that stores prescriber approval state, is holding clinical information in a system that almost certainly has no BAA.

Audit the subscription layer separately from Shopify itself. Ask the same two questions of every app in the stack: what does it store, and has its vendor signed a BAA. We have written more on where recurring telehealth billing creates exposure in our piece on subscription telehealth privacy and billing tracking.

What to check in your own store

1. List every app with customer or order data access. Review scopes, not marketing pages.
2. Read your product page URLs as a stranger would. If the slug names a medication or condition, it is a disclosure whenever it travels with an event.
3. Inspect checkout for clinical fields. Line-item properties, cart attributes, and order notes are the usual hiding places.
4. Look at customer tags and segments. Condition-based tags are PHI sitting in a CRM-shaped field.
5. Watch the network tab during a test purchase. Filter to your ad platform domains and read what actually leaves.
6. Confirm your email and SMS vendor's status. See our verdict on whether Klaviyo is HIPAA compliant for DTC health.

Frequently asked questions

Does Shopify Plus include a BAA?

No. Shopify Plus is an enterprise tier with more customization, higher limits, and dedicated support, but it does not change Shopify's position on health data. There is no HIPAA tier of Shopify.

Can I make Shopify HIPAA compliant with an app?

No app can create a BAA between you and Shopify. Apps that describe themselves as HIPAA compliant are generally saying that the app vendor will sign a BAA covering data the app holds, which does not extend to the Shopify platform underneath it. Read carefully what the BAA actually covers.

We only sell supplements. Do we need to worry?

Probably not under HIPAA, since you are unlikely to be a covered entity. State consumer health privacy laws are a separate question and reach further, so the tracking hygiene in this article is still worth applying.

Is the Shopify Facebook sales channel safe for a telehealth store?

Not as configured by default. It is built to send product-level commerce data, which for a telehealth catalogue means transmitting treatment names alongside a browser identifier. Replace it with a server-side path where you control the payload.

What happens to my ad performance if I stop sending product data?

Catalogue and dynamic product ads depend on product feeds, so those specific formats are affected and many telehealth brands should not be running them anyway. Standard conversion optimization is not affected, because it runs on conversion events and matching keys rather than product names. Server-side delivery usually improves match rates.

Can I keep intake answers in Shopify if I encrypt them?

Encryption does not remove the BAA requirement. If Shopify holds PHI, encrypted or otherwise, and has not signed a BAA, the arrangement does not satisfy HIPAA. Keep the answers in a system whose vendor has signed.

The short version

Shopify is not HIPAA compliant and will not sign a BAA, but a DTC telehealth brand can still run on it by keeping clinical data out entirely and treating the storefront as pure commerce. The part most teams miss is advertising, where default pixels quietly transmit treatment names and browser identifiers to platforms that have not signed anything.

Curve exists to close that gap. Server-side collection, per-destination field mapping, hashed identifiers, neutral event aliases, and bridge-token attribution let you keep running Meta and Google campaigns on a Shopify storefront without the disclosure. A signed BAA is included on every plan. Run our free compliance scanner against your store to see what is leaving right now, or visit curvecompliance.com to talk through your architecture.

Reviewed August 2026. Vendor BAA policies and platform advertising terms change. Confirm current terms with each vendor before relying on this summary.