Skip to content
A HIPAA-ready marketing agency signs a business associate agreement whenever its work touches protected health information and knows every tag on the practice’s website. It keeps tracking off booking, intake, and portal pages, sends ad platforms no contact or health details, gives each person a unique login, and removes its access cleanly at the end.
Why do unique logins matter when an agency manages your accounts?
Unique logins matter because a shared login makes every action impossible to trace to one person. The HIPAA Security Rule lists unique user identification as a required implementation specification at 45 CFR 164.312(a)(2)(i): “Assign a unique name and/or number for identifying and tracking user identity.”
That rule governs systems that hold electronic protected health information. Beacon’s working standard applies the same principle to every ad account, analytics property, CRM, and website login an agency touches, because a practice owner should be able to see who did what, and when, without guessing.
Account security matters because hacking dominates the breach numbers. The HHS Office for Civil Rights report to Congress on 2024 breaches counted 663 breach reports affecting 500 or more people in calendar year 2024, and 534 of them (81%) were hacking or IT incidents.
What should an agency know about the tracking on your website?
An agency should be able to list every tag firing on the practice’s website, what each tag sends, and where it goes. HHS guidance on online tracking states that “Tracking technologies on a regulated entity’s user-authenticated webpages generally have access to PHI,” and that tracking on unauthenticated appointment or symptom-checker pages “may have access to PHI in certain circumstances.”
A federal court in Texas vacated part of that guidance in June 2024, so the status of general public pages is contested. The conservative expectation avoids that question: tracking stays off booking, intake, and portal pages, and no names, contact details, or health information go to an ad platform in any form. FTC technology staff wrote that hashes “can still be used to identify users.”
The same care applies to analytics. Google’s Analytics help page on HIPAA says Google “does not offer Business Associate Agreements in connection with this service,” so an agency using it should say how protected health information stays out.
What else belongs in a HIPAA-ready agency relationship?
A business associate agreement belongs in the relationship when the agency creates, receives, maintains, or transmits protected health information for the practice. An agency answering web inquiries, storing call recordings, or managing a CRM with patient details likely fits that description. An agency that only buys ads may not, and it should say plainly which it is. What Is a Business Associate Agreement and When Do You Need One? covers the basics.
Patient lists should never go to ad platforms in any form. When the engagement ends, the agency should remove every login it held and confirm that in writing. OCR Director Paula M. Stannard put the principle simply in an August 2025 settlement announcement: “A HIPAA risk analysis is essential for identifying where ePHI is stored and what security measures are needed to protect it.” Agency access belongs in that analysis.
What does this checklist not cover?
This checklist does not cover whether a specific practice, agency, or tool meets HIPAA requirements. Compliance is the covered entity’s obligation, and no agency or vendor can make a practice compliant on its behalf. Clinical documentation, EHR configuration, and staff training sit outside the marketing relationship and outside this page.
The page also leaves out rules outside HIPAA. Substance use disorder programs covered by 42 CFR Part 2, practices subject to state health privacy laws, and practices facing Federal Trade Commission rules on health data have obligations this list does not address. The court ruling mentioned above is described only as HHS reports it, and nothing here predicts how any pending case will end.
This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.
Frequently asked questions
Does every marketing agency need to sign a BAA?
Not necessarily. HHS describes a business associate as a party that creates, receives, maintains, or transmits protected health information for a covered entity. An agency that never touches that information may not qualify. An agency that handles inquiries, call recordings, or CRM records usually does.
Should an agency upload patient lists to Facebook or Google?
Beacon’s working standard is no. A patient list tells an ad platform that each person on it receives care from the practice, and FTC technology staff wrote that hashing does not make such data anonymous. A practice should ask any agency whether it has ever uploaded one.
What should happen to agency access when a contract ends?
The agency should remove its own users from every account, return ownership of ad accounts and analytics properties to the practice, and confirm the removal in writing. The practice should then review each account’s user list itself. Unique logins make that review possible, because every remaining user has a name attached.
How Beacon handles the form data and tracking on its clients’ websites is explained in What’s Actually Behind Your Practice’s Contact Form?
