Navigating HIPAA as a Digital Agency : What Changes When Patient Data Touches Your Stack

Most agencies don’t realize they became a HIPAA business associate the day a client’s patient forms started landing in their CRM.

There’s no signing ceremony and no compliance kickoff. One day you’re building a landing page for a dental group or running paid search for a health system. The next, you’re holding protected health information. That shift changes your legal exposure, your tech stack and the way you should pitch healthcare work.

Here’s what every agency serving healthcare clients should understand.

Touch patient data, and you’re a business associate
Under HIPAA, a business associate is any organization that creates, receives, maintains or transmits protected health information (PHI) on behalf of a covered entity, such as a hospital, clinic or health plan.

Since the 2013 Omnibus Rule, business associates carry direct liability under HIPAA. If something goes wrong, it isn’t only your client’s problem. It’s yours too.

And it happens through ordinary agency work:

Appointment-request forms routed into your CRM or email platform
Call tracking that records conversations with patients
Patient lists uploaded to ad platforms for retargeting or lookalike audiences
A tracking pixel firing on a “book a visit” page

If any of these sound familiar, you need a business associate agreement (BAA) with that client, and you need to operate like a business associate.

The stakes are real – Tracking pixels are where the money is going.

In 2022, the HHS Office for Civil Rights (OCR) warned that tracking technologies on healthcare websites can disclose PHI to third parties, and it updated that guidance in 2024. A federal court narrowed part of the guidance in mid-2024, but the class-action lawsuits kept coming.

Sutter Health’s $21.5 million settlement over pixels and analytics on its patient portal received final approval in February 2026. Advocate Aurora Health settled for $12.25 million. Inova, Duke Health and many others have settled similar suits.

Most of these cases trace back to marketing and analytics code added to a website to measure performance. In other words, the kind of work agencies do every day.

The rules are still moving

In January 2025, HHS proposed the first major overhaul of the HIPAA Security Rule in more than a decade. It would turn controls like encryption, multi-factor authentication and network segmentation into explicit requirements.

That final rule was expected in 2026. It has now slipped to July 2027.

Don’t read the delay as a reprieve. The current Security Rule remains fully in effect and enforceable today, and the direction is clear: regulators expect more rigor, not less.

What keeps agencies out of trouble
You don’t need a compliance department to work responsibly with healthcare clients.
You need a few non-negotiable habits.

Before you touch the stack, document where every form submission, phone call and click ends up. Which systems store it? Which vendors can see it? OCR has long cited inadequate risk analysis as the most common Security Rule failure it finds, and a data-flow map is where that analysis starts.

You need a BAA with each healthcare client whose PHI you handle. You also need BAAs with every downstream vendor that touches that data: your CRM, form builder, call-tracking platform and hosting provider.

Most ad platforms and standard analytics tools won’t sign one. Plan around that from the start: choose vendors that will sign, strip identifiers before data leaves your client’s environment, and be upfront with clients about what can and can’t be measured.

Third-party pixels don’t belong on patient portals, appointment booking flows or pages about specific conditions and treatments. If a page can tell a vendor who someone is and why they need care, treat it as off limits.

OCR has been clear that a banner asking visitors to accept or reject tracking is not a valid HIPAA authorization. A consent pop-up won’t cover a disclosure HIPAA doesn’t otherwise allow.

Make compliance part of your pitch

Healthcare clients are cautious for good reason. Many have watched peers write seven- and eight-figure settlement checks over marketing tools.

That’s an opportunity. Clients don’t need an agency that says “we’re HIPAA compliant.” They need one that can show them exactly where their patients’ data goes, explain the trade-offs in plain language and build campaigns that perform without putting the organization at risk.

The agencies that win healthcare work over the next few years will treat privacy as part of the craft, not a box to tick.