Is Mailchimp HIPAA compliant?
No, Mailchimp does not offer a business associate agreement and its terms put HIPAA responsibility entirely on you, so patient health details must stay out of your audiences, campaigns and merge fields.
Applies to Mailchimp email marketing. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
If you keep using it anyway
- If you use Mailchimp for general marketing, keep audiences free of anything revealing a diagnosis, treatment, medication, appointment, insurance or provider relationship, including audience names, tag names, segment names and merge fields.
- Do not export patient lists from your EHR or practice management system into Mailchimp.
- Remember that a list built solely from patients of a specialty practice can itself reveal a health condition, so avoid specialty-specific segmentation.
- Route appointment reminders and clinical follow-up through a vendor that will sign an agreement.
Does Mailchimp sign a business associate agreement?
Mailchimp does not offer one. Not applicable. Mailchimp's terms place responsibility for determining suitability on the customer and disclaim liability rather than offering an agreement.
What this means in practice
Mailchimp offers no agreement on any plan, and its terms push the risk back onto you: if you are subject to regulations like HIPAA, Mailchimp says it is not liable if the service does not meet those requirements. Its acceptable use policy separately bars importing sensitive personal information regulated by law into any account, audience or email. Mailchimp Transactional, the product many practices know as Mandrill, is in the same position.
Most people grasp the obvious part, which is not to write about someone's diagnosis in a newsletter. The subtler point is that the list itself is the disclosure. A tag named after a procedure, a segment named after a medication, an audience made up solely of patients of a single-specialty practice: each of those reveals a health condition without a single word appearing in the email body.
So the discipline covers audience names, tag names, segment names and merge fields, not just content. Anything clinical, including appointment reminders and treatment follow-up, moves to a vendor that will actually sign an agreement.
How organizations get this wrong
- Exporting a patient list out of the practice management system for a newsletter, on the basis that it is only names and email addresses.
- Naming a segment or tag after a condition, procedure or medication, which discloses as much as the message body ever would.
- Using Mailchimp Transactional, formerly Mandrill, for appointment reminders because it feels like technical plumbing rather than marketing.
- Assuming a higher paid tier unlocks an agreement, when no Mailchimp plan includes one and the terms disclaim liability instead.
What the agreement does not cover
- Every Mailchimp plan.
- Mailchimp Transactional, formerly Mandrill.
- Mailchimp's Acceptable Use Policy bars importing into any account, audience or email any sensitive personal information regulated by applicable law.
- Mailchimp's Standard Terms state that if you are subject to regulations like HIPAA, Mailchimp is not liable if the service does not meet those requirements.
Use instead
Named on Google's Included Functionality list, so patient email is covered once a super administrator accepts the amendment
On Twilio's eligible services list, so appointment reminders can be covered by a signed addendum
You just found one. What else is in your stack?
If Mailchimp was a surprise, the rest of your tools are worth checking the same way.
Sources
- Mailchimp's Standard Terms of Use: Mailchimp. Read July 29, 2026.
- Mailchimp's Acceptable Use Policy: Mailchimp. Published September 26, 2025. Read July 29, 2026.
- Mailchimp's Legal Policies: Mailchimp. Read July 29, 2026.
Mailchimp can change these terms at any time. If something here no longer matches what Mailchimp tells you, tell us.