The longer answer matters more, because thousands of medical practices are running patient lists through Mailchimp right now — and the enforcement climate has stopped being theoretical. In 2024, the University of Rochester Medical Center paid $2.85 million over marketing-adjacent data disclosures, and Froedtert Health paid $2 million in a case tied to web tracking data flowing to third-party marketing vendors. Cerebral self-reported exposing the data of 3.1 million users to ad platforms. And email specifically got its own wake-up call when Klaviyo began deplatforming telehealth and healthcare senders — cutting off accounts mid-campaign because health data in a marketing ESP is a liability the vendor doesn't want either.

If your patient list lives in Mailchimp, you have both problems at once: a HIPAA exposure and a vendor that can terminate you for the exact usage you signed up for.

Why Mailchimp fails the HIPAA test

HIPAA doesn't ban email marketing. It bans handing PHI to a vendor without a signed Business Associate Agreement (BAA), and it requires safeguards on how that data is stored and accessed. Mailchimp (owned by Intuit) fails on every prong:

• No BAA, at any price. Intuit's position is explicit: Mailchimp is not intended for PHI and no BAA is available. Without a BAA, every upload of patient data is an impermissible disclosure — before you've sent a single email.
• Terms of Use prohibit health data. Mailchimp's acceptable-use terms exclude sensitive health information. Using it for patient lists isn't just a compliance risk; it's a contract violation that gives Mailchimp grounds to suspend your account without notice. That's the same mechanism behind the Klaviyo telehealth deplatformings — the vendor enforcing its own terms, suddenly.
• No PHI-grade safeguards. No field-level encryption commitments for health data, no HIPAA-scoped access controls, no audit trail you could produce for the Office for Civil Rights (OCR).

"But it's just an email address" — the mistake that costs practices

The most common defense we hear: "We only upload names and emails, not medical records."

Here's the problem. PHI is any individually identifiable information held by a covered entity that relates to health status, care, or payment for care. The moment an email address sits in a list called "Botox Patients," "Post-Op Follow-Up," or even just "Patients," it's PHI — because the list membership itself reveals that the person receives care from you, and often what kind.

It gets worse with normal ESP usage:

• Segments and tags ("IVF inquiries," "TMS candidates," "no-show reactivation") encode diagnosis and treatment interest.
• Campaign content ("Time for your next dermal filler appointment") ties identity to treatment in the vendor's stored campaign history.
• Open and click tracking builds a behavioral record of which patients engaged with which condition-specific content — stored indefinitely on servers with no BAA.
• E-commerce and automation integrations can sync appointment or purchase data straight into contact profiles.

A dental practice emailing "whitening special" to its full patient list has disclosed its entire patient roster to Intuit. OCR doesn't need the emails to contain lab results for that to be a reportable breach.

What OCR and the plaintiffs' bar actually look for

Enforcement in 2025–2026 has followed a pattern worth understanding:

1. Vendor disclosures without BAAs are the low-hanging fruit. It's a bright-line violation — either the agreement exists or it doesn't.
2. Marketing use of PHI without authorization is a second, independent violation. HIPAA's marketing rule requires specific written authorization for most marketing communications made using PHI (treatment reminders and certain care communications are carved out — promotional campaigns are not).
3. Class actions move faster than OCR. The Meta Pixel litigation wave showed that plaintiffs' firms subpoena vendor data flows. An ESP export of your patient segments is discoverable.

Is anything about Mailchimp usable for a practice?

Narrowly, yes. Mailchimp is fine for content that involves zero patient data: a newsletter list built from public opt-ins where subscribers are not identifiable as patients, staff communications, or B2B outreach (e.g., a practice emailing referring providers about CE events — though even referral patterns get murky fast).

In practice, almost no practice maintains that separation cleanly. The patient list ends up in the same account, a front-desk export gets uploaded "just this once," and the compliant use case collapses. If you can't enforce the wall, don't build on it.

HIPAA-compliant alternatives that will sign a BAA

If you want a standalone ESP, the realistic 2026 shortlist:

• Paubox Marketing — built for healthcare, BAA standard, encrypted delivery.
• LuxSci — HIPAA email infrastructure with marketing sends.
• Hushmail / Virtru-secured flows — better for transactional and 1:1 than campaigns.
• HubSpot — since June 2024, HubSpot offers a BAA and sensitive-data support on certain tiers, which most comparison articles still get wrong. It's a real option now, with real configuration caveats — see our full breakdown: Is HubSpot HIPAA Compliant? The Answer Changed.

A BAA alone isn't the finish line, though. You still need consent management, minimum-necessary segmentation, and — for anything promotional — HIPAA marketing authorizations. The tool is maybe 40% of the compliance problem.

The Mailchimp migration checklist (ungated, use it today)

1. Export everything — lists, segments, tags, campaign history — before you touch the account. You need the record of what was disclosed.
2. Inventory the exposure. Which lists identify people as patients? Which segments encode conditions or treatments? This determines whether you have a reportable incident. Talk to your privacy officer or counsel — honestly, not aspirationally.
3. Kill the integrations first. Disconnect any EHR, booking, forms, or e-commerce sync feeding Mailchimp before deleting lists, or the data repopulates.
4. Delete contacts and request account data deletion from Mailchimp, in writing, and keep the confirmation.
5. Stand up the compliant destination (BAA signed and countersigned before the first import).
6. Rebuild consent. Migrating a list doesn't migrate marketing authorization. Separate transactional/care communications from promotional sends, and capture HIPAA marketing authorization for the latter.
7. Re-warm the sending domain — new ESP, new IPs, throttled volume, or your first compliant campaign lands in spam.
8. Document the whole thing. If OCR ever asks, a dated migration record turns "willful neglect" into "corrected in good faith." The penalty difference is an order of magnitude.

How practices on PilotPractice actually run email

We built email into the platform the way a covered entity's vendor should have to:

• Field-level encryption on every lead, message, and call record — patient identifiers aren't sitting in plaintext waiting for an incident, they're encrypted at the field level in the database.
• An append-only HIPAA audit log records every access to PHI, with middleware-enforced tracking on read — so "who saw this patient's record and when" is a query, not a forensic project. Login auditing flags impossible-travel and new-device access, and insider-threat analytics score unusual PHI access patterns.
• AI that can't go rogue. Automated replies and campaign assistance run behind deterministic gates: a hard cap on automated SMS/email touches per 24 hours, human-in-the-loop review, medical and legal guard models screening outbound content, and a fail-closed egress guard so patient data can't leak into places it shouldn't. Every AI action lands in a compliance log.
• A BAA, offered as a matter of course, backed by SOC 2 and a public trust center.

And because we're a done-for-you agency, not just software: our team writes the campaigns, manages the authorizations, handles reactivation sequences, and reports results — under the same BAA. You get the growth channel without becoming a part-time compliance officer.

Wondering what else on your site is leaking patient data? Run our free PHI leak scanner — it checks your pages for trackers and forms sending patient data to third parties, no email gate.

Ready to run patient email the compliant way — done for you? Book a demo and we'll show you a reactivation campaign built on your actual patient list, safely.

Related: HIPAA-Compliant Email Newsletters & Patient Reactivation · Is Klaviyo HIPAA Compliant? · The 2026 Guide to HIPAA-Compliant Marketing

Security details: trust.pilotpractice.com