Is Shopify HIPAA Compliant? What Health Brands Need to Know in 2026

Is Shopify HIPAA compliant?

No. Shopify does not offer HIPAA compliance and does not sign Business Associate Agreements (BAAs). Its own Acceptable Use Policy lists "uploading Protected Health Information subject to HIPAA" among the business activities its platform does not support.

That does not mean healthcare brands can't use Shopify. Plenty of supplement, wellness, medical device and telehealth brands run their storefronts on Shopify. What they can't do is let protected health information (PHI) touch Shopify. Everything below explains where that line sits and how to build around it.

What is HIPAA, and who does it apply to?

HIPAA is the US federal law that sets privacy and security rules for health information. It applies to covered entities and their business associates, not to every company that sells health-related products.

• Covered entities are health care providers that conduct standard electronic transactions (doctors, clinics, pharmacies, dentists), health plans (insurers, HMOs, Medicare and Medicaid) and health care clearinghouses.
• Business associates are vendors that create, receive, maintain or transmit PHI on a covered entity's behalf, such as a telehealth platform, an EHR provider or a cloud host. They must sign a BAA with the covered entity and are directly liable for parts of HIPAA.

A store selling vitamins, skincare or fitness gear to the public is usually not a covered entity. A store that works with licensed providers to prescribe medication, run consultations or process insurance usually is, or works with one. If you're not covered by HIPAA but you handle health data, other rules may still apply. The FTC's Health Breach Notification Rule, updated in 2024, covers many health apps and connected devices that fall outside HIPAA, and several US states have their own consumer health data laws.

What counts as PHI in an ecommerce store?

PHI is individually identifiable health information: anything about a person's health, care or payment for care that can be linked to who they are. In ecommerce, the link to identity is the part people underestimate.

A product page about a medication is not PHI. An order for that medication tied to a name, email and shipping address, created by a covered entity, can be. Typical examples in a DTC health store:

• Medical intake forms and health questionnaires (symptoms, conditions, medications, allergies)
• Prescriptions, prescription uploads and refill requests
• Telehealth consultation notes and provider messages
• Lab results, photos submitted for review, or treatment plans
• Insurance details and diagnosis codes
• An account or order history that reveals a condition, when the business is a covered entity or business associate

Where does PHI accidentally end up in Shopify?

Usually through convenience features that were never meant for health data. If a field can hold free text or custom data, someone will eventually type health information into it.

• Forms: contact forms, quiz apps and form builders that store answers in Shopify or in a vendor without a BAA.
• Order notes and line item properties: "Please note I'm allergic to..." or a prescription number added at checkout.
• Customer metafields, metaobjects and tags: tagging customers by condition (for example "diabetic") or storing quiz results on the customer record.
• Apps: reviews, subscriptions, helpdesk, email and SMS tools that sync customer and order data.
• Analytics and pixels: Meta, Google, TikTok and session-replay scripts that see URLs, form inputs or purchase events.

Tracking is the risk regulators focus on. The HHS Office for Civil Rights bulletin on online tracking technologies says covered entities and business associates may not use cookies, pixels, session replay or similar tools in ways that disclose PHI to vendors without a BAA and a Privacy Rule permission. A cookie banner or a privacy policy disclosure is not enough. In June 2024 a federal court in Texas (American Hospital Association v. Becerra) vacated the part of that guidance covering unauthenticated public pages that merely connect an IP address to a health topic. The rest of the bulletin still stands, including pages where users log in, book appointments or fill in health details.

Do you need a separate backend for HIPAA?

Yes, if you handle PHI. PHI has to live in systems whose providers sign a BAA with you, and Shopify is not one of them. In practice that means a separate application or vendor for intake, consultations and prescriptions.

To be precise: you don't need a different technology for its own sake. You need every system that stores, processes or transmits PHI to be covered by a BAA and configured securely. That can be a vendor product (a HIPAA-eligible form, telehealth or pharmacy platform that signs a BAA) or a custom app you build on HIPAA-eligible cloud services. AWS, Google Cloud and Microsoft Azure all offer BAAs. AWS signs through AWS Artifact, Google Cloud through its compliance page, and Azure includes the BAA in its Product Terms. All three are clear that a BAA covers only eligible services and that securing your application is still your job. There is also no official HIPAA certification. HHS doesn't run one, so treat any "HIPAA certified" badge with caution.

What does a HIPAA-friendly Shopify architecture look like?

The common pattern splits the business in two: Shopify handles non-PHI commerce, and a BAA-covered system handles everything clinical.

1. Shopify storefront: product pages, education content, cart, checkout for non-prescription items, subscriptions and marketing. No health questions anywhere in Shopify.
2. Handoff: when a customer starts a consultation or intake, they move to the secure app via a redirect, typically on a subdomain such as care.yourbrand.com. A short-lived signed token or an order reference can link the two without passing health data.
3. HIPAA-eligible backend: intake forms, provider review, telehealth, prescriptions and patient messaging live here, on infrastructure under a BAA, with encryption, access controls and audit logs.
4. Return trip: the backend sends Shopify only what commerce needs, such as "approved, create order for product X", never the reason why.
5. Tracking discipline: no ad pixels or session replay on the secure app, and Shopify events kept free of health details.

How do we handle HIPAA projects with our engineering partner?

We split the work along the same line as the architecture. The Silver Arc designs and builds the Shopify storefront: product pages, content, subscriptions, checkout and the handoff points. Our engineering partner PrioritySoft, a product development studio in Niš, Serbia, builds the custom, separately hosted backend or app that handles protected health information when a project needs one, using stacks like React, Next.js and Node.js.

Neither studio is "HIPAA certified", because no such certification exists. Compliance depends on the architecture, the hosting provider's BAA and your own policies, training and risk analysis. We recommend involving your compliance or legal advisor from the first scoping call. This article is general information, not legal advice.

What should you check before launch?

Run through this list with your developer and compliance advisor before going live.

1. Confirm whether you are a covered entity, a business associate, or neither.
2. Map every place a customer can type or upload information, including apps.
3. Remove health questions from Shopify forms, checkout fields, order notes and metafields.
4. Get a signed BAA from every vendor that touches PHI, and check which of their services it covers.
5. Audit pixels and tags on any page that collects or reveals health information.
6. Document your risk analysis, access controls and breach response plan.

How we can help

If you're planning a health or telehealth brand on Shopify, we'll design the storefront so PHI never touches it, and bring in PrioritySoft when you need a custom backend. See our Shopify development service or get in touch to talk through your setup.