A signed BAA does not make your clinic client's CRM automations HIPAA safe. Map where the data goes next

If you build CRM automations for clinics, dentists or med spas, the risky part is rarely the CRM. It is everything the CRM sends data to.

What happened

In a MarTech article published October 9, Kevin Haag, chief data officer at Qualified Digital, argued that a business associate agreement is not a compliance fix. It is a contract with one vendor. His key points:

• A BAA covers only the vendor that signed it, not ad platforms or pixels added later. It may not cover every product, add-on or AI feature either.
• Hashing an email does not de-identify it, because hashing exists to enable matching.
• Server-side tagging moves collection, not disclosure. Its value is as a point where you can filter data before it leaves.
• Once appointment history or diagnosis codes flow from an EHR into marketing automation, that data is PHI.
• Risky exits include audiences synced to ad platforms, which typically will not sign BAAs, and condition-triggered journeys that expose a diagnosis in email subject lines or text previews.
• Send each platform only the fields a use case needs.

On tracking, a June 2024 federal court ruling vacated the part of HHS guidance that treated an IP address plus a visit to an unauthenticated health page as PHI, Morrison Foerster reports. The rest of the guidance stands, including cautions on authenticated pages like patient portals.

My take

Many clinic automations get built for speed: form to CRM, CRM to SMS, CRM to ad audience. Nobody drew the map. Before adding anything new, do this:

1. List every exit. Each webhook, Zap, SMS gateway, email tool, ad audience sync and enrichment call, and which fields it sends.
2. Strip by default. Pass IDs and the minimum fields. The condition or service line rarely needs to leave the CRM.
3. Write neutral messages. "Your appointment is confirmed" works. A subject line naming the treatment is a disclosure.
4. Check the AI add-ons. If you switch on AI features in the CRM, confirm the BAA actually covers them.
5. Keep a written record of what you decided and why.

None of this is legal advice, and the article notes lawyers still disagree on some edge cases. Bring the client's compliance person in early, and give them a diagram they can read.