On this page
No. As of November 11, 2026, Mailchimp publishes no BAA, and its data processing addendum says customers must not give it health information. A practice can still use Mailchimp for a general newsletter sent to people who signed up for it. Lists, tags and emails built around patients, programs or conditions need a tool that signs a BAA.
Checked November 11, 2026 on Mailchimp's data processing addendum and its acceptable use policy (updated September 26, 2025). Confirm with Mailchimp before any patient detail goes in.
What does Mailchimp say?
Mailchimp's data processing addendum defines "Sensitive Data" to include "health information." Section 2.3 says "Customer will not provide (or cause to be provided) any Sensitive Data to Mailchimp," and Annex A says Mailchimp "does not want to, nor does it intentionally, collect or process any Sensitive Data." The addendum also says it doesn't apply to sensitive data at all.
Its acceptable use policy adds that you may not upload "sensitive personal information regulated by applicable law." Neither page mentions a BAA, and we found no Mailchimp page that offers one on any plan.
So the answer isn't just "Mailchimp won't sign." Its own terms put health information outside what you're allowed to send it.
Where practices go wrong with email marketing
Few owners would paste lab results into a campaign. The risk is quieter: the list itself. Three patterns we see:
- Uploading the EHR patient list. An export of current and past patients tells Mailchimp who your patients are. We treat that as patient information, even with no diagnosis attached, because the list exists only because they received care from you.
- Tags and segments by program or condition. A segment called "Menopause program" or a tag like "weight-loss, month 3" ties each name to their care. The tag is the health information.
- Reactivation emails to lapsed patients. "It's been six months since your last hormone check" names a treatment and confirms the person is a patient. That message belongs in a tool with a BAA.
Campaign reports add a layer. Opens and clicks on a campaign about a specific condition, tied to a named subscriber, can start to describe that person's health interests. Keep campaign topics general if the list is mixed.
What you can still do with Mailchimp
Mailchimp works for marketing to people who opted in to hear from your practice, where nothing in the list or the content links a named person to their care. That covers:
- a monthly newsletter with general articles, office news and new services
- a sign-up form on your website that asks for name and email only
- event announcements and educational content open to anyone
- segments built on non-health facts, such as sign-up source or city
Keep out of Mailchimp:
- imported patient lists, and any field or tag that marks someone as a patient
- segments by condition, program, treatment or visit type
- appointment reminders, lab-fee requests and post-visit follow-ups
- sign-up questions like "What are you struggling with?"
If a patient also signs up for your newsletter on their own, that's fine. They're on the list as a reader, not as a patient, and nothing in Mailchimp should say otherwise.
Where patient emails should go instead
Patient-facing emails, the ones tied to someone's care, should come from a tool that signs a BAA. From our BAA table:
| Message | Send from | BAA |
|---|---|---|
| Reminders, intake links, lab-fee requests | Your EHR | Covered by the EHR's BAA (Healthie, OptiMantra and Jane sign one) |
| One-to-one replies to patients | Google Workspace or Microsoft 365 | Yes, once accepted (Workspace) or under the business plan's addendum (Microsoft) |
| Patient email through a dedicated HIPAA email service | Paubox | Yes, Paubox says on all accounts |
| Program follow-up and reactivation to patients | Your EHR, or a CRM on a plan that signs a BAA | HubSpot only on Enterprise with sensitive data turned on; GoHighLevel with its paid HIPAA add-on |
| General newsletter to opted-in readers | Mailchimp | None needed if no health information is involved |
The split is the point: Mailchimp for readers, a covered tool for patients. Our reactivation guide covers what to send lapsed patients and from where, and the follow-up templates show wording that keeps clinical detail out of the message.
Flodesk and Kit, two other popular newsletter tools, publish no BAA either, so the same rules apply. To check your own stack, use the BAA checker.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does Mailchimp sign a BAA?
No. Mailchimp publishes no BAA, and its data processing addendum says customers must not provide health information to Mailchimp (as of November 2026).
Can a medical practice use Mailchimp?
Yes, for a general newsletter to people who opted in, with no patient lists, no tags by condition or program, and no content that ties a named person to their care.
Can I upload my patient list to Mailchimp?
We advise against it. A list exported from your EHR shows who your patients are, and Mailchimp's terms bar health information. Invite patients to sign up for the newsletter themselves instead.
What is a HIPAA-compliant alternative to Mailchimp?
For messages tied to care, send from your EHR or another tool that signs a BAA. Paubox says it includes a BAA with all accounts, and HubSpot signs one on Enterprise with sensitive data turned on.