Is Mailchimp HIPAA Compliant?

What Mailchimp's Policies Say

Mailchimp's Acceptable Use Policy lists things members may not upload or send. One item covers Social Security numbers, passwords, security credentials and sensitive personal information regulated by applicable law.

We looked for a Business Associate Agreement in Mailchimp's published legal and help materials and did not find one. Independent compliance publications reach the same conclusion, that Mailchimp is not set up for protected health information.

Why Your List Itself Matters

Many practices assume a newsletter is safe because the emails are general. The issue is the list. If it is a list of your patients, the list can itself be protected health information, because it shows who receives care from you. A vendor that stores that list on your behalf would need to sign a BAA.

Marketing Rules Still Apply

A BAA is only one part of the picture. HHS guidance says a patient's written authorization is generally required before protected health information is used for marketing, with exceptions such as communications about treatment and a practice describing its own health-related services. If you are not sure whether a message needs authorization, ask a compliance professional.

What to Use Instead

The Aspire Builder Pro HIPAA plan includes email marketing under a signed BAA, connected to your CRM. See HIPAA compliant email marketing.

• Keep general marketing lists that contain no patients separate from patient lists
• Use an email platform whose vendor signs a BAA for anything involving patients
• Keep details about a person's care out of marketing emails
• Record consent when people join your list