HIPAA for a telehealth store: what a BAA actually covers
The short answer
A BAA is a contract that makes a vendor accountable for the protected health information you hand them. It does not make your brand compliant on its own: a signed BAA with a compliant platform sits alongside your own obligations for how you collect, show and talk about patient information. The leaks that actually happen are rarely in the database. They are in analytics, ad pixels, support inboxes and screenshots.
What is a BAA, in plain terms?
If a vendor touches protected health information on your behalf, HIPAA requires a business associate agreement between you. It commits them to safeguard that information, to use it only for the agreed purpose, to tell you if it is breached, and to let you audit that.
Dispense Flow signs one, and it is included on every plan rather than sold as an upgrade. The current BAA is published, so you can read it before you have a sales conversation about it.
What does a BAA not do?
It does not cover what you do outside the platform. If you paste a patient's intake answers into a shared spreadsheet, or into a support tool with no BAA of its own, that is yours.
It does not make your marketing compliant. HIPAA governs health information; the FTC governs your claims. A page promising a result is a different problem with a different regulator, and a BAA says nothing about it.
It does not substitute for legal advice. Nothing in this article is legal advice. A telehealth brand should have counsel review how it handles patient information and what its pages claim.
Where does protected health information actually leak?
Analytics and ad pixels. The most common real-world leak. A conversion event that carries the product name from a URL can tell an ad network which treatment a named visitor bought. On Dispense Flow, merchant analytics are injected into the storefront only, and the admin app never ships a patient-identifying payload to a third party.
Support inboxes. A patient replies to an order email with a photograph of a rash. That inbox is now holding protected health information and needs to be treated that way.
Screenshots and exports. A CSV on a laptop is still protected health information. So is a screenshot in a group chat.
URLs. A page at /orders/semaglutide-refill names a treatment in a link that ends up in browser history, referrer headers and anywhere the link is pasted.
What should you ask a platform?
Is a signed BAA included, or an upgrade? Can I read it before signing? What protected health information reaches your logs and backups, and how long is it kept? What do you send to third parties, and what do my own analytics tags see? Who at your company can read patient data, and is that access logged?
The last one is worth insisting on. A platform that cannot say who on its own staff can read a patient's intake has not thought about this properly.
Questions
Is a BAA included on every Dispense Flow plan?
Yes. A signed business associate agreement is included on Starter, White Label and Enterprise. It is not an upgrade.
Does a signed BAA make my brand HIPAA compliant?
No. It covers the vendor relationship. Your own handling of patient information, and your marketing claims, remain yours.
Can I run Meta or Google ad pixels on a telehealth store?
Carefully, and not everywhere. A pixel that can associate a named visitor with a treatment is the leak regulators have acted on. Keep tags off pages that reveal a specific treatment for a specific person, and take advice on your setup.
Who can read patient data inside the platform?
Access is scoped by role and logged. A merchant sees their own patients; platform staff access is restricted and recorded in an audit trail.