That makes Klaviyo different from most tools in this series. With Hotjar or the Meta Pixel, the risk is a regulator or a class-action firm finding you — the URMC $2.85M and Froedtert $2M tracking settlements are the template. With Klaviyo, there's a second failure mode that arrives faster: the vendor itself cuts you off. For a practice whose reactivation campaigns, appointment reminders, and post-visit sequences all live in Klaviyo, a deplatforming isn't a compliance abstraction. It's every automated patient touchpoint going dark in one afternoon, mid-campaign, with your data on the wrong side of a suspended login.

Why Klaviyo says no

Klaviyo was built for e-commerce. Its data model, its terms, and its risk appetite all assume you're selling sneakers, not scheduling colonoscopies. Three things follow:

1. No BAA. Under HIPAA, any vendor that stores or transmits PHI on your behalf is a business associate and must sign a BAA. Klaviyo doesn't offer one. Without it, sending PHI into Klaviyo is an impermissible disclosure — full stop, before we discuss a single feature.

2. The terms prohibit sensitive health data. Klaviyo's acceptable-use terms restrict processing of protected health information. When healthcare brands upload patient lists anyway, they're not in a gray area; they're in breach of contract. That's the legal basis for the deplatformings.

3. Everything useful about Klaviyo is a disclosure. Klaviyo's value is behavioral: segments built from what people clicked, browsed, and bought. Port that to a practice and the "behavior" is health behavior. A segment called booked-consult-no-show or viewed-GLP-1-page, a flow triggered by an appointment, an email address in an account tagged as a weight-loss clinic — each pairs an identifiable person with the seeking of care. That's PHI even when no chart data was ever synced.

What the deplatformings actually tell you

It's tempting to read the telehealth suspensions as Klaviyo being difficult. Read them the other way: Klaviyo understood its own exposure better than its healthcare customers did. A platform holding health-linked lists without a BAA is itself in a position it never priced. Suspending those accounts was the rational move.

Three lessons for 2026:

• "It works fine" is not a compliance signal. Every deplatformed brand had months or years of campaigns running smoothly before the ban. The tool functioning is unrelated to the tool being permitted.
• Platform risk compounds regulatory risk. Even if OCR never emails you, your ESP can. You're exposed on two fronts, and the vendor's trigger is faster than the government's.
• Your patient list can become a hostage. Exports from a suspended account range from slow to impossible. A practice's most valuable marketing asset — its patient relationships — should never live inside a platform that can lawfully freeze it.

And no, the June 2024 ruling that partially vacated OCR's web-tracking guidance (N.D. Tex.) doesn't help here. That decision narrowed one interpretation about unauthenticated website visits. It changed nothing about HIPAA's rules for known patients' names, emails, and appointment data — which is precisely what an email platform holds.

"But Mailchimp / HubSpot signs a BAA now"

Some ESPs do offer healthcare terms, with fine print that does a lot of work — we cover them in Is Mailchimp HIPAA compliant? and Is HubSpot HIPAA compliant?. But a BAA is the entry ticket, not the finish line. A signed BAA with segments still built on condition pages viewed, subject lines still leaking diagnoses, and staff exporting CSVs to their desktops is compliant on paper and a breach in practice.

The email platform checklist for medical practices

Before patient data touches any email tool, all seven — ungated, take it:

1. Signed BAA in hand — not "HIPAA-eligible," not "compliance-friendly." A countersigned agreement.
2. Terms of service permit PHI for your account tier. (Klaviyo fails 1 and 2.)
3. PHI encrypted at rest at the field level, not just disk-level, in whatever system feeds the ESP.
4. Access is logged immutably — who viewed which patient record, when, from where.
5. Anomalous access gets flagged — a login from a new device or an impossible-travel pattern should page someone, because exported lists are how breaches actually happen.
6. Segments never encode conditions. "Active patients, 6+ months since visit" is fine; "ED-consult abandoners" is a diagnosis in a segment name.
7. You can extract everything, today. If leaving the platform takes more than a day, you've recreated the deplatforming hostage scenario with a friendlier vendor.

How to migrate off Klaviyo without losing the list

If your practice is on Klaviyo today, the order of operations matters, because the risk is a suspension landing mid-migration. Do it in this sequence:

1. Export everything first, before touching anything else. Full contact list with properties, suppression/unsubscribe list, and per-flow performance stats (you'll want the benchmarks). Klaviyo exports are self-serve while the account is in good standing — that's exactly the window a deplatformed brand loses.
2. Export your templates and flow logic as documentation. Screenshots and trigger notes are enough. You're rebuilding the logic, not importing HTML that references Klaviyo-hosted assets.
3. Stand up the compliant destination and re-establish sending reputation. New sending domain or subdomain, SPF/DKIM/DMARC, and a warm-up ramp — don't blast your full list from a cold domain on day one.
4. Carry the suppression list over verbatim. Unsubscribes and hard bounces follow the practice, not the platform. Re-mailing someone who opted out because the new system didn't know is a TCPA/CAN-SPAM problem you created during a compliance migration.
5. Rebuild flows on scheduling triggers, then shut Klaviyo flows off — only after the replacement is confirmed sending. Then close the account so the health-linked list stops existing on a platform with no BAA.

One more thing to fix in transit: consent scope. E-commerce consent ("send me offers") does not automatically cover appointment reminders tied to care, and HIPAA's marketing rules treat communications about treatment differently from promotions. Migration is the natural moment to re-anchor consent language — and to rename every segment that encodes a condition (checklist item 6) before it's imported anywhere new.

How practices actually run email in 2026

Here's the do-marketing answer. Patient email — recalls, reactivation, reminders, post-visit sequences — works, and it's usually the highest-ROI channel a practice owns. The compliant architecture is: keep patient data in a system built for it, and let email be an output, not a database.

That's how PilotPractice runs it. Patient records in our platform carry field-level encryption on leads, messages, calls, and files — a Klaviyo-style plaintext contact table doesn't exist to leak. Every access to patient data lands in an append-only HIPAA audit log, PHI access is tracked at the middleware level on every request, and login auditing catches impossible-travel and new-device sign-ins before a staff account becomes an export pipe. Insider-threat analytics score unusual PHI-access patterns continuously — the failure mode BAAs never address, because most healthcare data incidents walk out through a legitimate login.

On top of that sits the marketing layer: reactivation campaigns and follow-up sequences that read scheduling state from your EHR (booked, no-showed, lapsed) instead of behavioral surveillance, under a BAA, inside SOC 2-audited infrastructure — documented publicly at trust.pilotpractice.com, subprocessor list included. It's the architecture behind our patient reactivation playbook and the full 2026 HIPAA-compliant marketing guide, and the same encrypted core our HIPAA-compliant marketing automation runs on.

The verdict

Klaviyo is not HIPAA compliant — no BAA, prohibitive terms, and a documented history of suspending healthcare accounts. If your practice is on it, run the migration sequence above now, before the platform sets the timeline for you. Don't wait for the suspension email to start.

First, check what else is leaking. Email platforms rarely travel alone — run our free PHI leak scanner to see every third-party tool transmitting visitor data off your site, no email gate.

Want the whole channel run for you? PilotPractice builds and operates HIPAA-compliant patient email — encrypted data layer, audited access, campaigns that fill the schedule — as part of a done-for-you marketing stack. Book a demo and bring your Klaviyo export.

All compliance infrastructure documented at trust.pilotpractice.com.