How we handle Protected Health Information, sign Business Associate Agreements, configure HIPAA-aware analytics, and meet 42 CFR Part 2 confidentiality requirements for behavioral health and addiction treatment clients.
Last updated: June 16, 2026
Allgood Marketing ("we," "our," or "us") is a digital marketing agency that serves behavioral health providers, addiction treatment centers, mental health practices, and other healthcare organizations regulated under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), its implementing regulations (the Privacy, Security, and Breach Notification Rules), and 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records).
This page describes how we approach compliance when we engage with a Covered Entity or another Business Associate. It is a statement of our operating policies — not a legal opinion on your organization's obligations. You should confirm with your own privacy officer or counsel that our role and safeguards meet your specific compliance requirements.
Important: HIPAA does not have a formal "certification" body. Any vendor claiming to be "HIPAA certified" is overstating the regulation. What HIPAA requires is documented policies, technical and administrative safeguards, signed Business Associate Agreements, workforce training, and breach notification — all of which we maintain.
When we deliver marketing services that may involve access to, or transmission of, Protected Health Information ("PHI"), we operate as a Business Associate under HIPAA. Activities that can place us in this role include:
In every engagement where these activities apply, a signed Business Associate Agreement governs our handling of PHI before work begins.
We make a Business Associate Agreement available on request to any Covered Entity client and to any of our own sub-processors that may receive PHI on our behalf. Our standard BAA addresses the requirements of 45 CFR § 164.504(e), including:
If your organization requires execution of your BAA template, we are willing to review and, where appropriate, sign it as part of onboarding. To request a BAA, email contact@allgoodmarketing.com.
Our default posture is to minimize PHI exposure across the marketing stack. Specifically:
Substance Use Disorder (SUD) patient records are subject to additional protections under 42 CFR Part 2, which is generally stricter than HIPAA. For clients providing SUD treatment, we apply the following defaults on top of our HIPAA controls:
Role-based access, single sign-on with multifactor authentication for systems that may touch PHI, principle of least privilege, and prompt deprovisioning when team members change roles or leave.
Encryption in transit (TLS 1.2 or higher) for all data exchanged with client systems. Encryption at rest for any storage that may hold PHI on our infrastructure.
Access and configuration changes to client systems, ad accounts, analytics tools, and CRMs are logged where the platform supports it, and reviewed on a documented cadence.
Workforce devices used for client work are protected with full-disk encryption, automatic updates, screen-lock policies, and endpoint-detection tooling.
All team members who handle client engagements complete HIPAA and 42 CFR Part 2 awareness training at onboarding and on an annual refresh cycle. Training records are retained for at least six years.
We conduct an annual security risk assessment of the systems we use to deliver client services, and we document remediation plans for any findings.
We use a small set of vetted sub-processors to deliver our services. Where these vendors may receive or process PHI on our behalf, we maintain a signed Business Associate Agreement with the vendor before any PHI is transmitted, and we limit each vendor's access to the minimum necessary for its function. A current list of HIPAA-relevant sub-processors is available on request from your account team.
The U.S. Department of Health and Human Services Office for Civil Rights ("OCR") has issued guidance clarifying that disclosure of individually identifiable health information by a Covered Entity or Business Associate through online tracking technologies is regulated under HIPAA. The Federal Trade Commission ("FTC") has issued parallel guidance under Section 5 of the FTC Act, the Health Breach Notification Rule, and state privacy laws.
Our approach to tracking on client websites:
Configurations are documented per client and reviewed when ad platform policies, OCR guidance, or FTC enforcement actions change.
If we discover a use or disclosure of PHI not permitted by the applicable BAA, or a Security Incident as defined in 45 CFR § 164.304, we notify the affected client without unreasonable delay and within the timeframe specified in our BAA — generally within ten (10) business days of discovery, and sooner for incidents that may meet the definition of a Breach under 45 CFR § 164.402. Our notification provides, to the extent known:
We support our clients in meeting their downstream notification obligations to individuals, HHS, and (where applicable) the media under 45 CFR §§ 164.404–164.408.
To set expectations clearly:
The following documentation is available on request to current and prospective clients:
Email contact@allgoodmarketing.com with "HIPAA documentation request" in the subject line.
We update this page as our practices, our sub-processor list, OCR guidance, FTC guidance, and applicable law evolve. The "Last updated" date at the top of this page reflects the most recent material change. We encourage clients and prospective clients to review this page periodically.
For HIPAA, 42 CFR Part 2, BAA requests, security questionnaires, or incident reporting, contact:
We respond to BAA requests and security questionnaires within two business days.
Request a BAAHIPAA & 42 CFR Part 2 Compliance
Allgood Marketing handles all client and patient data in alignment with HIPAA and 42 CFR Part 2. We sign Business Associate Agreements (BAAs) with covered-entity clients, avoid non-compliant pixels and forms on regulated pages, and configure ad accounts, analytics, and CRMs to current HHS OCR and FTC guidance. Read our full HIPAA & 42 CFR Part 2 policy or our Privacy Policy.
© 2026 Allgood Marketing. All rights reserved.