C
Not clearIs Constant Contact HIPAA compliant?
Checked 6 Nov 2026 from 1 vendor source
Constant Contact will sign its standard BAA by email, yet it also tells customers not to put PHI in the service beyond the fact that subscribers have a relationship with the business. The vendor’s position isn’t clear enough to rely on. Treat it as unsafe for patient data until the vendor confirms in writing.
What the BAA leaves out
- PHI beyond the fact of a subscriber’s relationship with the business
- Sensitive health information such as mental health, substance abuse or HIV information, per its Terms of Service as described in the article
- Use for electronic medical records
How to get the BAA
Email [email protected]; only Constant Contact’s standard form is signed, with no changes.
What the vendor says to do
- Email [email protected] for the BAA before using the service with subscribers
- Return the signed agreement to the same address
Proof from the vendor
- Business Associate Agreements, Constant Contact Knowledge BaseStandard BAA by email; limits on PHI; no changes to form (updated June 26, 2026)
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.