HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Is Mandrill HIPAA Compliant?

Is Mandrill HIPAA compliant? Can MailChimp’s transactional email service be used by healthcare organizations without violating HIPAA Rules?

Use of Mandrill by Healthcare Organizations

Mandrill is a transactional email offering from MailChimp, the leading automated email marketing platform. Mandrill allows businesses to automatically send emails to customers and individuals that interact with their web apps and connects to MailChimp via an API.

Transactional emails differ from marketing emails in that they are programmed to be triggered by events such as password resets, confirmation of placement of orders, welcome messages, and sending receipts. In contrast to marketing emails, which require an opt-in from patients/plan members under HIPAA Rules, in most cases, transactional emails do not.

That does not mean that there are no HIPAA issues for healthcare organizations that are considering using Mandrill. Any email service used by a healthcare organization that requires electronic protected health information (ePHI) to be uploaded would have to have privacy and security safeguards built into the platform to prevent unauthorized ePHI access and an audit trail would need to be maintained. Any ePHI uploaded would need to be secured in transit, and stored data would need to be encrypted.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

If the service is to be used with any ePHI, the service provider would be classed as a business associate and a business associate agreement would therefore be required.

Most service providers that support HIPAA compliance and are prepared to enter into a business associate agreement with HIPAA-covered entities make it clear that they support HIPAA compliance and offer a BAA.

Is Mandrill HIPAA Compliant?

Users of Mandrill are bound by the terms and conditions of MailChimp. You can find out more about Mailchimp and HIPAA compliance here, but to summarize that post, MailChimp states that “You’re responsible for determining whether the Service is suitable for you to use in light of your obligations under any regulations like HIPAA” and since, at the time of writing, MailChimp does not offer a BAA, neither MailChimp or Mandrill are HIPAA compliant.

MailChimp and Mandrill can be used by healthcare organizations, but since they are not HIPAA compliant they cannot be used in connection with any ePHI.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.