ActiveCampaign is a cloud-based marketing automation platform that helps organizations manage their email marketing, customer relationships, and sales automation, and it can be HIPAA compliant for enterprise deployments. The platform’s automation capabilities enable organizations to streamline their workflows and carry out marketing campaigns with less administrative overhead, saving both time and money. Additionally, ActiveCampaign’s advanced segmentation tools allow companies to personalize campaigns according to demographics, behavior, and past interactions.
While these capabilities are highly sought after by healthcare organizations who want to enhance their engagement with patients and customers, they require one characteristic above all in their marketing platform of choice: HIPAA compliance.
More specifically, for a company to send electronic protected health information (ePHI) through an email marketing platform, it must comply with the Health Insurance Portability and Accountability Act (HIPAA).
Let’s take a closer look…
Is ActiveCampaign HIPAA Compliant?
Firstly, to address the question directly – is ActiveCampaign HIPAA compliant? – it is not HIPAA-compliant by default. Healthcare organizations can only conduct HIPAA compliant marketing campaigns if they are signed up for the Enterprise version of the solution.
Our findings revealed that companies are required to configure ActiveCampaign accordingly to ensure HIPAA compliance. Again, that healthcare organizations need to ensure compliance themselves – and how they do so – isn’t made 100% clear in any of the company’s literature.
ActiveCampaign’s Security Features
ActiveCampaign does not provide message-level encryption for outbound campaign emails (e.g., portal-based pickup or enforced encryption to recipients), so you generally should not put PHI in the body of campaign emails. This limits your ability to engage patients with personalized and relevant messages that result in more opens, clicks and conversions.ActiveCampaign’s sole mention of HIPAA compliance is on their security features page, on which they state:
“ActiveCampaign is heavily focused on GDPR, SOC 2, and HIPAA compliance. We constantly improve our security to go above and beyond compliance standards.”
Now, while they don’t go into further detail, ActiveCampaign does indeed feature some security controls that lend themselves towards HIPAA compliance. These include:
- Single Sign-On (SSO): users can sign into ActiveCampaign through an existing identity provider, such as Google, without requiring a separate set of credentials. This helps protect data through stronger access control and allows for simpler user authentication.
- Multi-Factor Authentication (MFA): ActiveCampaign supports MFA, requiring users to verify their identity through text or time-based one-time password (TOTP) authentication. This adds another layer of security, in line with HIPAA regulations, and is something that could be more emphasized if changes to the Security Rule come into effect later this year.
- Automatic Session Timeouts: idle sessions are automatically logged out after a short amount of time: protecting them from session hijacking and related cyber threats.
Additionally, users are responsible for setting up the proper email authentication protocols themselves, including:
SPF (Sender Policy Framework): Specifies authorized mail servers for your domain.DKIM (DomainKeys Identified Mail): Adds a digital signature to your emails, verifying their authenticity.DMARC (Domain-based Message Authentication, Reporting & Conformance): Provides instructions to email providers on handling messages that fail SPF or DKIM checks.
Setting up these protocols helps fight against email spoofing and phishing attacks, ensuring that your emails are recognized as legitimate by recipients’ mail servers.
Will ActiveCampaign Sign a BAA?
Now, even with some security features and stating they are focused on compliance, a marketing platform can’t truly comply with HIPAA regulations unless they sign a Business Associate Agreement (BAA).
ActiveCampaign’s BAA availability appears limited and may depend on plan level; confirm directly with ActiveCampaign.
Discover HIPAA Compliant Alternatives to ActiveCampaign
As this post illustrates, while it is possible to make ActiveCampaign HIPAA compliant, it’s not straightforward. Fortunately, there are alternative email and marketing solutions that are fully HIPAA-compliant – out-of-the-box – removing the guesswork and ambiguity from securing your digital communications and allowing you to focus on engaging with your patients and customers. This includes LuxSci Secure Marketing, which enables healthcare organizations to proactively reach patients and customers with HIPAA compliant email marketing campaigns that can securely include PHI for increased engagement, lead generation and sales.
Discover how LuxSci can elevate your secure healthcare engagement efforts with PHI data, resulting in better health outcomes for your patients, in addition to enhancing your brand identity and achieving your company’s growth objectives. Reach out today for a call or demo.
SSL and TLS play critical roles in securing data transmission over the internet, and AES-256 is integral in their most secure configurations. The original standard was known as Secure Sockets Layer (SSL). Although it was replaced by Transport Layer Security (TLS), many in the industry still refer to TLS by its predecessor’s acronym. While TLS can be relied on for securing information at a high level—such as US Government TOP SECRET data—improper or outdated implementations of the standard may not provide much security.