HIPAA-Friendly Email Marketing Apps

Mailchimp provides security measures to reduce the risk of unauthorized access, including physical security controls and encryption. Since encryption is built into the service, it may meet certain HIPAA compliance regulations, but using Mailchimp doesn’t guarantee that all HIPAA compliance standards will be met.According to Mailchimp’s terms and conditions, customers are responsible for ensuring they comply with regulations like HIPAA.Uploading patient information to a Mailchimp email list likely constitutes a disclosure of protected health information (PHI).

SendGrid doesn’t mess around when answering this question: “Twilio SendGrid does not natively support HIPAA (Health Insurance Portability and Accountability Act) compliant data transmission.” The platform doesn’t offer any encryption or security measures beyond simple mail transfer protocol (SMTP). SendGrid suggests its users encrypt their emails themselves if they are worried about HIPAA compliance and provide a secure download link for sensitive documents. There is no mention of a Business Associate Agreement (BAA) on the SendGrid website.

ActiveCampaign has stated that it enables HIPAA compliance. This service offers security features that align with HIPAA regulations.HIPAA compliance features are available with ActiveCampaign’s Enterprise plan. The security page states that ActiveCampaign can meet HIPAA standards for enterprise-level customers, but no further information is available about specific security features for HIPAA compliance.The company stresses that each customer is responsible for using the service in a HIPAA-compliant manner. ActiveCampaign provides security to support these needs. According to the HIPAA Security Rule, entities and business associates must take reasonable steps to protect PHI, including end-to-end security.

Constant Contact offers many security features that appear to align with HIPAA requirements, such as multiuser access, account management, and the ability to limit user access. The service has technical, physical, and administrative safeguards in place to protect email subscriber data. While these security features are sufficient for general email communication, they may not meet the privacy safeguards necessary for transmitting patient information.The HIPAA Privacy Rule applies to protected health information (PHI), which includes any information found in a medical record that’s tied to the identity of an individual, including diagnoses, treatments, and billing. HIPAA rules don’t prohibit covered entities from sending marketing emails, as long as they don’t include protected health information. For example, a medical provider can email patients about changes in business hours or new office policies. However, patients must first give their permission to be added to the email marketing list.Constant Contact is a good solution for general communication. But its email marketing platform doesn’t appear to support the transmission of highly sensitive PHI (personal health and medical information).