Guide / Stack

The healthcare marketing stack, layer by layer.

A DTC brand can wire up any tools it likes. A healthcare brand has to ask one question first: which of these will see patient data, and do they sign a BAA?

Here is the stack we recommend for telehealth and healthcare growth, and where each tool fits.

The stack

Layer	Tools we use	Privacy notes
Lifecycle email and SMS	Customer.io or Braze	Customer.io offers HIPAA support on its Premium and Enterprise plans; Braze publishes a BAA. Confirm terms on your plan.
SMS delivery	Twilio	Offers a BAA on its Security and Enterprise Editions, for HIPAA-eligible products.
Conversion tracking	Freshpaint or server-side tagging	Freshpaint is built for healthcare and signs a BAA. Server-side tagging works if you control what leaves.
Ad platforms	Meta, Google, TikTok	No BAAs. They receive only generic, de-identified events.
Payments	Stripe	Revenue source of truth. Keep conditions and medications out of product names and metadata.
Data and reporting	A database or warehouse under a BAA	Joins ad, revenue, and lifecycle data for cohort reporting.
AI	Claude through the Anthropic API	Use providers under a BAA for anything touching patient data, or remove identifiers first.

Vendor plans and BAA terms change. Confirm availability and plan requirements directly with each vendor before you sign.

Tools to be careful with

Klaviyo and most DTC email tools. Great for ecommerce, generally not set up for protected health information.
Google Analytics. Google does not offer a BAA for it. Keep it off sensitive pages or use a healthcare analytics tool.
Browser pixels. Fine on a homepage, risky on intake and checkout. See HIPAA-compliant tracking.

How the pieces connect

The storefront, Stripe, and clinical and pharmacy partners send events such as intake started, approved, shipped, and payment failed. Those events trigger lifecycle flows in the CRM, feed de-identified conversions to ad platforms through the tracking layer, and land in the reporting database. The AI layer reads from that data to choose creative, budget, and messages. One event stream, many uses, and patient data stays inside covered systems.

What it costs to run

The HIPAA tiers are the expensive part. Lifecycle platforms with BAAs typically start in the low thousands of dollars per month, well above DTC email pricing. Budget for it from the start rather than migrating later.

Free first step

Want your real number instead of an estimate?

We request an appointment the way a new patient would: your form, your phone line, your hours. Then we time every step and send a short written report in two business days. Reply speed, booking friction, and where inquiries go quiet. Free, no obligation.

Prefer to talk it through? Book a 30-minute call.

Common questions

Straight answers

Which email platforms sign a BAA?

Customer.io supports HIPAA on its Premium and Enterprise plans, and Braze publishes a BAA. Most DTC email tools, including Klaviyo, are generally not set up for protected health information. Confirm current terms with each vendor.

Does Twilio sign a BAA?

Twilio offers a Business Associate Addendum for HIPAA accounts, which require its Security or Enterprise Edition, and only for HIPAA-eligible products. Check the eligible product list before sending patient information by SMS.

Do ad platforms sign BAAs?

No. Meta, Google, and TikTok should only receive generic, de-identified conversion events, sent server-side.

What is the minimum HIPAA-ready marketing stack?

A lifecycle platform with a BAA, an SMS provider with a BAA, server-side tracking that strips sensitive data, and payments kept free of clinical details. Everything else can be added as the brand grows.

Go deeper: HIPAA-compliant tracking, telehealth lifecycle email and SMS, AI marketing automation, telehealth marketing.

Tool guides

Setup guides for each layer: Customer.io for Healthcare, Braze vs Customer.io, Klaviyo Alternatives for Healthcare, Twilio for HIPAA SMS, Meta Conversions API for Healthcare, Using Claude for Healthcare Marketing.