On this page
HIPAA compliance means that a covered entity or business associate follows the HIPAA Privacy, Security and Breach Notification Rules: it limits how protected health information (PHI) is used and shared, secures electronic PHI, and reports breaches. For marketers it comes down to what websites, forms and ad tools share, because HHS says “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS). Curve Compliance, a marketing and website tracking service for healthcare that signs a BAA on every plan, checked each rule below on HHS, eCFR and the Federal Register on November 2, 2026.
Book a call. Running ads for a practice or health brand? Curve Compliance helps with what your website sends to ad platforms. It replaces browser ad pixels with one script, strips PHI before data reaches an ad platform and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What HIPAA compliance means
HIPAA is the Health Insurance Portability and Accountability Act of 1996 (see what HIPAA stands for). Congress set the framework and HHS wrote the detailed rules, including the “Federal privacy protections for individually identifiable health information” the law mandated (HHS). The official text sits in 45 CFR Parts 160, 162 and 164.
Being HIPAA compliant means meeting those rules every day, not passing a one-time test. Three rules carry most of the work:
- Privacy Rule. “The Privacy Rule standards address the use and disclosure of individuals' health information,” and it gives patients rights over that information (HHS).
- Security Rule. It “sets forth the administrative, physical, and technical safeguards” that covered entities and business associates put in place for electronic PHI (HHS).
- Breach Notification Rule. It “requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information” (HHS).
The Enforcement Rule sets out how HHS investigates and penalizes violations, and the 2013 Omnibus Rule updated the others. See the five HIPAA rules explained for each one, and the HIPAA Privacy Rule for marketers for the rule marketing teams meet most often.
Who must comply: covered entities and business associates
HIPAA applies to two groups. A covered entity is “A health plan,” “A health care clearinghouse,” or “A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter” (45 CFR 160.103). HHS lists doctors, clinics, psychologists, dentists, chiropractors, nursing homes and pharmacies as providers, “but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard” (HHS).
A business associate is a person or company, other than the covered entity's own workforce, that creates, receives, maintains or transmits PHI on the covered entity's behalf (45 CFR 160.103). An agency, CRM, form builder or call tracking vendor can be one when it handles PHI for a practice; see agency BAA obligations. HHS says business associates “are directly liable for compliance with certain provisions of the HIPAA Rules” (HHS).
If neither definition fits, HIPAA does not apply: “If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules” (HHS). State health privacy laws may still apply (see the state health privacy laws table). For the tests in detail, see what a covered entity is and what a business associate is.
The rules you comply with
Each row names a rule, what it asks of you and where to read it. Every link goes to HHS, eCFR or the Federal Register, opened November 2, 2026.
| Rule | What it requires | Where to read it |
|---|---|---|
| Privacy Rule | Limits uses and disclosures of PHI, gives patients rights such as access, and requires a privacy official, a notice of privacy practices and workforce training | HHS summary; 45 CFR 164.530 |
| Security Rule | Administrative, physical and technical safeguards for electronic PHI, starting with a risk analysis | HHS summary; 45 CFR 164.308 |
| Breach Notification Rule | Notice to affected individuals “in no case later than 60 calendar days after discovery of a breach,” plus notice to HHS and, for a breach affecting more than 500 residents of a State or jurisdiction, to the media | 45 CFR 164.404; HHS |
| Enforcement Rule | Compliance and investigations, civil money penalties and hearings, codified at 45 CFR Part 160, Subparts C, D and E | HHS |
| Omnibus Rule (2013) | Modified the Privacy, Security, Enforcement and Breach Notification Rules under the HITECH Act; effective March 26, 2013 | 78 FR 5566 |
HHS's Office for Civil Rights “is responsible for enforcing the Privacy and Security Rules” (HHS). See who enforces HIPAA and the Omnibus Rule for marketers.
What compliance looks like day to day
Most of HIPAA compliance is routine work with an owner and a paper trail:
- A privacy official. “A covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity” (45 CFR 164.530). See the privacy officer's role in marketing.
- A risk analysis. The Security Rule requires “an accurate and thorough assessment of the potential risks and vulnerabilities” to electronic PHI (45 CFR 164.308), and HHS calls risk analysis “the first step” (HHS). See HIPAA risk assessment for marketing tools.
- Workforce training. A covered entity “must train all members of its workforce on the policies and procedures with respect to protected health information” (45 CFR 164.530).
- Business associate agreements. A covered entity may let a vendor handle PHI “if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information” (45 CFR 164.502), documented in a written business associate contract (HHS). See what a BAA is.
- A notice of privacy practices. See the notice of privacy practices and your website.
- Records. Required documentation is kept “for six years from the date of its creation or the date when it last was in effect, whichever is later” (45 CFR 164.530). See HIPAA document retention.
For the full list in order, with a printable table, use the HIPAA compliance checklist for marketing teams.
HIPAA compliance for websites, forms and ads
HHS says “The HIPAA Rules apply when the information that regulated entities collect through tracking technologies or disclose to tracking technology vendors includes protected health information (PHI)” (HHS). It lists what tracking code can pass along: “an individual's medical record number, home or email address, or dates of appointments, as well as an individual's IP address or geographic location, device IDs, or any unique identifying code” (HHS).
Two more lines from the same HHS guidance shape a compliant website (HHS):
- Banners are not authorization. “Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization.”
- A BAA with every tracking vendor that receives PHI. “Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI.”
The same HHS page notes that a federal court vacated part of the guidance on June 20, 2024: the part saying HIPAA applies in “circumstances where an online technology connects (1) an individual's IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers” (HHS). The guidance's sections on user-authenticated pages and mobile apps were not vacated. How it applies to your site depends on your setup, so talk to your counsel.
A practical website check: list every tag on your pages with a free website scan, look at what each one sends from booking, form and logged-in pages, and keep conditions out of URLs and event names. If you want Curve to look at that part with you, book a call. The HIPAA compliant website checklist walks through each step, and is a cookie banner enough for HIPAA covers consent tools.
The most common gaps
HHS publishes the compliance issues most often alleged in complaints since the Privacy Rule's compliance date in April 2003. In its results as of October 31, 2024, in order of frequency, they are (HHS):
- Impermissible uses and disclosures of protected health information
- Lack of safeguards of protected health information
- Lack of patient access to their protected health information
- Lack of administrative safeguards of electronic protected health information
- Use or disclosure of more than the minimum necessary protected health information
Marketing touches the first item most. Sending PHI in page views, form answers or contact lists to an ad platform is a disclosure, and HHS says regulated entities “must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI” (HHS). See the minimum necessary rule and ad tracking and HIPAA violation examples.
How Curve Compliance helps
Curve Compliance helps with the website and ad tracking side. Your privacy official, risk analysis, policies and training stay with your own team. Curve's job is what your website and ad accounts send.
Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted.
Curve's team reviews what your website sends to Meta, Google and TikTok with you, and Curve's consent management handles cookie choices. Curve is SOC 2 Type II and signs a BAA on every plan (BAA Directory entry). Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: HHS, Covered Entities and Business Associates; HHS, Summary of the HIPAA Privacy Rule; HHS, Summary of the HIPAA Security Rule; HHS, Breach Notification Rule; HHS, The HIPAA Enforcement Rule; HHS, HIPAA Enforcement; HHS, HIPAA Enforcement Highlights; HHS, Guidance on Risk Analysis; HHS, HIPAA for Professionals; HHS, Use of Online Tracking Technologies; 45 CFR 160.103; 45 CFR 164.308; 45 CFR 164.404; 45 CFR 164.502; 45 CFR 164.530; 78 FR 5566; 90 FR 898.
Frequently Asked Questions
What exactly is HIPAA compliance?
HIPAA compliance means a covered entity or business associate follows the HIPAA Privacy, Security and Breach Notification Rules: it limits how PHI is used and shared, secures electronic PHI and reports breaches (HHS). For a website, HHS says regulated entities “must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI” (HHS).
What are the 5 main HIPAA rules?
Most lists name the Privacy Rule, the Security Rule, the Breach Notification Rule, the Enforcement Rule and the 2013 Omnibus Rule, which modified the other four (HHS; 78 FR 5566). See the five HIPAA rules explained.
Who must comply with HIPAA?
Covered entities (health plans, health care clearinghouses and providers that conduct standard transactions electronically) and their business associates (HHS). An entity that is neither “does not have to comply with the HIPAA Rules.”
What are the 10 most common HIPAA violations?
HHS publishes a top five rather than a top ten: impermissible uses and disclosures of PHI leads its list of issues most often alleged in complaints, followed by lack of safeguards (HHS, results as of October 31, 2024). See HIPAA violation examples.
Does a cookie banner make a website HIPAA compliant?
No. HHS says banners that ask visitors to accept or reject tracking “do not constitute a valid HIPAA authorization” (HHS). See is a cookie banner enough for HIPAA.
What is the new HIPAA rule in 2026?
One headline change, HHS's proposed Security Rule update, was published in the Federal Register on January 6, 2025 (Federal Register). On November 2, 2026 the Federal Register still lists only that proposal under its rulemaking, so it is not yet in force; see new HIPAA rules for 2026 for what is final, proposed and pending.
Talk to Curve Compliance
Book a call. Want ad tracking that keeps PHI out of ad platforms? Curve Compliance strips PHI before data reaches an ad platform, sends conversions server-side and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.