Constant Contact will sign a business associate agreement. Its own knowledge base says so, and tells you to email the legal team to request one before you start using the service. So the answer to the question most healthcare marketers ask is yes.

The sentence worth reading is the one after it. Constant Contact tells customers "not to import or incorporate any PHI in the services other than the fact that the individuals on your email subscriber lists may have a relationship with your business."

The permitted data set is: this person exists, here is how to reach them, and they have some relationship with your practice. That is the ceiling.

What that rules out is most of healthcare email

Think about what actually drives a patient communication program. Which service line they came in for. When they were last seen. Which provider. Which treatment they were quoted for and never booked. Whether they finished the plan of care. How many units they bought and when they’ll run out.

Every one of those is a fact about an individual’s health care or payment for it. Put any of them into a contact record or a segment name, and you’re past the line the vendor drew.

Which means the campaigns that make the math work are the ones the restriction reaches first. A recall campaign is a segment built out of clinical dates. A reactivation campaign is a segment built out of what someone was treated for and when they stopped coming. The revenue sitting in an inactive patient list is only reachable if you can sort that list by something clinical. Sorting it by nothing is a newsletter.

You can technically run a general newsletter to a patient list inside those bounds. That’s a real use, and for some practices it’s enough. It just isn’t a patient communication program.

Two more limits people miss

Whole categories are excluded regardless. Constant Contact’s terms prohibit sensitive personal or health information of any kind from being stored or transmitted, and it names mental health, substance abuse, and HIV information as examples. If you’re a behavioral health group, an addiction medicine practice, or a multispecialty organization with any of those service lines inside it, that carve-out isn’t a footnote. It applies to the list itself, not just the copy in the email.

And the agreement isn’t negotiable. Constant Contact signs its own form and won’t sign yours. For a solo practice that’s normal. For a health system or a DSO whose counsel has a standard BAA rider, it’s a real procurement conversation, and it’s better to have it in week one than in week nine.

This isn’t a scandal. It’s a design decision.

A BAA isn’t a compliance badge. It’s a contract, and HHS is explicit that its job is to "establish the permitted and required uses and disclosures of protected health information by the business associate." Permitted uses. A narrow BAA from a vendor that never built for PHI is the honest outcome, not a trick. Constant Contact says plainly that its services weren’t built for medical records, and the scope of the agreement matches the product.

The mistake happens on the buyer’s side. "They’ll sign a BAA" gets heard as "we can put patient data in here," and nobody opens the document until something goes wrong. We’ve made the point before that a vendor that won’t sign a BAA is disqualified. That filter still holds. It’s just the first gate, not the last one.

Better questions than “will you sign a BAA”

Ask what the BAA lets you put in the tool, and get the sentence, not the reassurance. Ask whether any categories of health information are excluded outright. Ask whether the agreement covers every product you plan to use, because email, SMS, forms, and analytics are often separate services with separate scopes. And ask who else touches the data downstream, since your vendor’s sending infrastructure is holding the same list your vendor is.

PatientCampaign is built the other way around. Clinical segmentation is a supported use rather than a prohibited one, because a platform for patient communication that can’t hold patient data isn’t much of a platform. The BAA is the floor.

None of this is an argument for marketing less. HIPAA doesn’t prohibit talking to patients, and HHS carves communications made for treatment, case management, and care coordination out of the definition of marketing entirely. Recall and follow-up are usually the most defensible things a practice sends. The question is only whether the tool you’re sending them from is allowed to know enough to send them well.