Month: September 2026

TL;DR: For multi-location providers and health systems that need the same reminder to land on encrypted push, the patient portal, email, SMS or an AI voice call, all of it under a single Business Associate Agreement, indigitall. For health systems already running Salesforce, where the patient record has to sit in the same clinical data model as the campaign, Salesforce Marketing Cloud with Health Cloud. For marketing operations teams running demand generation with analysts of their own, Adobe Marketo Engage. For digital health products whose next message is triggered by what the patient just did inside their own app, Braze and Iterable. For multichannel health brands running acquisition and retention from one team, Insider One. For scheduling-led journeys and new patient acquisition, Luma Health and PatientPop, now Tebra. For growing clinics and mid-sized practices that want the CRM and the marketing in the same place, HubSpot Marketing Hub and ActiveCampaign. For front-desk communication, recall and reputation, Weave, Solutionreach and Birdeye. For med spas and aesthetic practices, PatientNow.

The real difference is not the feature list. It is which of them will sign a Business Associate Agreement covering every channel you actually send on, and which ones only cover some of them.

How we compared them

Five criteria, declared before the list so the order is a method and not an opinion:

• Native channel coverage. How many channels the vendor operates as the sender of record, rather than brokering through a third party.

• BAA scope. Whether the vendor signs a Business Associate Agreement, which channels it covers, and whether any of that is documented publicly.

• Integration. Whether it connects to EHR, EMR and practice-management systems, and whether that sync is real time or batch.

• Fit by size and type of organization. Enterprise health system, mid-sized practice group, single-specialty clinic, digital health app.

• What it costs to run. How each one charges, and whether the price is public.

What counts as a channel here. For this list, a channel is one the vendor operates as the sender of record: email, SMS and RCS, push, in-app messaging, on-site web messaging, voice, and WhatsApp. Seven possible. Paid ads, forms, listings and review requests are not counted, because in those the vendor is not the one sending to the patient. Every count in the table uses that same list, so you can reproduce it yourself against each vendor's own documentation.

Sender of record means the vendor is the party you contract with for that channel and the party the message comes from, whatever infrastructure carries it underneath. Almost every platform here rents some of its plumbing, and that is not what this column measures. What it does not count is a channel you reach only by buying a second product from a second company and signing a second agreement: there the other vendor is the sender, and your compliance question follows it.

The list is ordered by criterion 1, from the widest native channel coverage to the narrowest, with ties broken alphabetically. That criterion is first because every channel a platform hands to a third party is a channel your compliance question has to follow somewhere else, and it is the thing buyers in this category most often discover late.

It is deliberately not ordered by criterion 2. All fourteen publish a BAA or a compliance page, but only one publishes which channels the agreement covers, so ordering by it would mean ordering by how far each vendor happens to go on its website. It gets its own column instead, and the column says exactly that: how far each one goes.

And the order is not a quality score. A platform with three native channels is not worse than one with seven; it is built for a different job, and the Built for column says which. Read the table by the row that matches your organization, not by the number in front of it.

Key takeaways

• A platform can be HIPAA-aware without signing a BAA that covers the channel you care about. Ask channel by channel, not product by product (HHS guidance on business associates).

• EHR and EMR integration is where most of these differ in practice. Real-time two-way sync and a nightly export are not the same product.

• The platforms built for large hospital systems and the ones built for single-specialty practices barely overlap. Buying up or down a tier is the most common expensive mistake.

• Channel coverage decides more than feature depth. A platform that sends email natively but brokers SMS through a third party moves your compliance question to that third party.

• Almost none of these publish healthcare pricing. Where a price is not public, this piece says so instead of guessing.

What is a healthcare marketing automation platform?

A healthcare marketing automation platform is software that plans, sends and measures patient communication across channels, under the privacy rules that apply to protected health information. In practice it does four things: it holds a patient profile, it decides who gets what and when, it sends on one or more channels, and it records what happened for audit.

What separates it from general marketing software is that the vendor is willing to be a business associate, sign the agreement, and be accountable for the data it touches. HHS publishes the sample contract provisions that a BAA has to contain.

Quick comparison

A note on that last column. It describes what each vendor publishes, not what each vendor does. All fourteen publish either the agreement itself or a compliance page saying one is available, so on the basic question the category is in good shape. What only one of them puts in writing is which channels the agreement covers, and that is the gap this column exists to show. It is also the question to ask on the first call, in the form that gets a usable answer: name your channels, one by one, and ask for each to be covered in writing.

One more thing about the channel count. That column counts the channels each vendor operates, in every market it sells to. In the US, under a Business Associate Agreement, the set that can carry protected health information is narrower for all fourteen, because the companies behind WhatsApp and RCS do not sign one. indigitall states this on its own healthcare page and runs the US version of the same journey on encrypted push. So read the count as reach, and the BAA column as what you can actually put inside the message.

1. indigitall

The option to look at when the reminder has to reach the patient on whichever channel they actually read, and the same agreement has to cover all of them.

Best for: multi-location providers and health systems that need appointment reminders on encrypted push, the patient portal, email, SMS and AI voice calls, covered by a single Business Associate Agreement, with live two-way EHR sync.

What it does well: it sends on every channel itself rather than brokering them, it signs a BAA covering the channels it operates, and it keeps a live two-way sync with EHR and practice-management systems so a cancellation is reflected before the next message goes out. It also chains the channels by cost: the journey starts on the cheapest one and only escalates to a call for the patients who did not answer the earlier step. And when the AI agent cannot resolve a conversation it hands it to a person with the patient history attached, on text from its own console and on voice by transferring into the PBX you already run.

Key features: end-to-end encrypted push, secure patient portal, email, SMS, web and in-app messaging, AI voice calls in English and Spanish, multi-language AI agents, real-time EHR APIs, and a unified patient profile that the journey builder reads from. WhatsApp and RCS are in the platform and are used in the markets where they can be, but not for protected health information in the US, which is what its own healthcare page states.

Two things worth separating from the feature list, because they change who operates the platform rather than what it can send. DataTalk lets someone ask campaign and audience questions in plain language instead of building a report, which matters in a clinic where the person who wants the number is not the person who knows the dashboard. And its MCP integration exposes that same data to an AI assistant, so the analytics can be read from the tool the team already has open. Neither sends a message to a patient, which is why neither counts as a channel above, but both change how much of the platform gets used after month three.

Worth knowing: its healthcare reference customers are European health systems rather than US ones. The deployments are large and the numbers are production numbers, but a US buyer who wants a US reference to phone should ask for one before signing.

Pricing: quote based. Healthcare pricing is not published.

Not a fit if: what you need is to replace the sales CRM. indigitall states on its own CDP page that it complements the CRM rather than replacing it, so accounts, opportunities and pipeline stay where they are. It is also not the tool if the program has to buy and manage paid media, or build and host landing pages, inside the same platform: neither is documented as a product capability.

🖼️ Visual suggestion — screenshot: indigitall healthcare page. Insert the screenshot here.
Design brief: file already in Drive, indigitall-healthcare.png (Images > indigitall), captured 18 September 2026. Source: https://indigitall.com/en/industry/healthcare/
Alt: indigitall healthcare page showing its channel list, the HIPAA, ISO 27001, GDPR and ENS compliance badges, and the logos of the providers that use it: Proclinic Group, Quironprevencion, HM Hospitales, Quironsalud, Santalucia and Vithas.
Pie: the page leads with BAA coverage per channel and with US data residency, which is the claim the rest of this entry rests on. Captured 18 September 2026.

The numbers it publishes. indigitall reports a combined production figure of 60% fewer no-shows and 50% more confirmed appointments across Vithas, QuirónSalud and Sanitas, credited on its own page as indigitall production data, 2026. Broken out by customer, the same page reports 40% fewer no-shows and 50% fewer inbound calls at QuirónSalud, and at Vithas 30% fewer no-shows, 75% lower SMS cost, a 35% higher engagement rate against an SMS-first stack and a 30% higher patient NPS. All of it sits on indigitall's healthcare page and in its success stories.

What its users say. indigitall holds 4.8 out of 5 across 460 reviews, checked on 18 September 2026, on G2. Two reviews that speak to the two claims above:

"What we value most about indigitall is that it provides a single platform for managing multiple customer communication channels."

Pablo H., Program Tech Lead at a mid-market company, 3 July 2026, on the point that matters here: whether the channels are native to the platform or brokered out.

"I like the integration of logical flows in push notifications and segmentation because it ensures that the message reaches each user through the most effective channel."

Andrés Felipe P., mid-market reviewer, 22 January 2026, describing the mechanism behind reminder timing rather than the reminder itself.

2. Braze

Built for products that talk to their users inside an app, which in healthcare means digital health and telehealth.

Best for: digital health and telehealth products that instrument their own app and want the next message triggered by what the patient just did inside it.

What it does well: event-driven messaging that reacts in the moment, strong in-app and push, and a canvas that marketers can operate without engineering for every change.

Key features: Canvas journeys, in-app messages, push, email, SMS, real-time event ingestion.

Worth knowing: it expects an app and a stream of events. Without both, most of what you are paying for stays unused.

Pricing: quote based, driven by monthly active users and volume.

Not a fit if: your patients never touch an app and your program is phone, SMS and letters.

🖼️ Visual suggestion — screenshot: Braze home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-braze.png (Images > Competitors > homepage), captured 20 August 2026. Source: https://www.braze.com/
Alt: Braze home page with its headline and customer logos.
Pie: it positions around customer engagement for products with apps, not around clinical workflows. Captured 18 September 2026.

3. Insider One

The multichannel option for health brands that behave more like consumer brands.

Best for: mid-sized to large multichannel health brands running acquisition and retention together.

What it does well: web and app personalization alongside messaging, and segmentation that uses on-site behavior.

Key features: cross-channel campaigns, AI segmentation, web personalization, app messaging, WhatsApp.

Worth knowing: the breadth is real but it takes setup. The personalization features are the ones most often bought and least often switched on.

Pricing: quote based.

Not a fit if: your patient relationship happens almost entirely offline.

🖼️ Visual suggestion — screenshot: Insider One home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-insider-one.png (Images > Competitors > homepage), captured 20 August 2026. Source: https://useinsider.com/
Alt: Insider home page with its headline and product areas.
Pie: the emphasis on web and app personalization shows the kind of health brand it is built for. Captured 18 September 2026.

4. Iterable

The same territory as Braze, approached from a builder that a marketing team can run without an engineering ticket per campaign.

Best for: the same digital health and telehealth products, when the team wants to build those in-product lifecycles without an engineering ticket per campaign.

What it does well: lifecycle journeys, experimentation, and a data model that is comfortable for teams coming from email.

Key features: Studio journeys, experiments, catalog-based personalization, email, push, in-app, SMS.

Worth knowing: it is a cross-industry marketing platform rather than a healthcare product, so the compliance conversation starts from a general posture and narrows from there.

Pricing: quote based.

Not a fit if: your patients never touch an app or a digital product surface, because its lifecycle model assumes one.

🖼️ Visual suggestion — screenshot: Iterable home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-iterable.png (Images > Competitors > homepage), captured 20 August 2026. Source: https://iterable.com/
Alt: Iterable home page with its headline and product navigation.
Pie: it presents itself as a cross-channel marketing platform rather than a healthcare one, which is worth knowing before the compliance conversation. Captured 18 September 2026.

5. Salesforce Marketing Cloud + Health Cloud

The enterprise default when the health system already runs Salesforce and the patient record has to travel with the campaign.

Best for: health systems and payer networks already running Salesforce, where the patient record has to sit in the same clinical data model as the campaign.

What it does well: journey orchestration across a very large contact base, a clinical data model that maps to how health systems already store records, and reporting that survives an audit.

Key features: Journey Builder, Health Cloud data model, consent and preference management, multi-channel send, analytics.

Worth knowing: it is an implementation, not a purchase. Budget for a partner and for months, not weeks.

Pricing: quote based. Healthcare pricing is not published.

Not a fit if: you are a single practice or a clinic group without an in-house Salesforce team.

🖼️ Visual suggestion — screenshot: Salesforce home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-salesforce-marketing-cloud.png (Images > Competitors > homepage), captured 20 August 2026. Source: https://www.salesforce.com/health-cloud/
Alt: Salesforce Health Cloud home page with its headline and product blocks.
Pie: it leads with the clinical data model rather than with campaigns, which is the tell of who it is built for. Captured 18 September 2026.

6. HubSpot Marketing Hub

The one most practices already have, which is both the argument for it and the thing to check.

Best for: clinics, provider groups and health-tech companies that want one unified CRM behind their marketing.

What it does well: email, forms and landing pages that a small team can run without help, and reporting that ties a campaign to a contact record.

Key features: email campaigns, lead scoring, CRM integration, forms, landing pages, workflows.

Worth knowing: HubSpot states that its privacy and security protections enable customers to operate its products in compliance with HIPAA. Which subscription tier that takes, and with which controls switched on, is not something to take from a comparison table. Confirm it in writing before you build on it.

Pricing: public tiered pricing.

Not a fit if: your program depends on SMS or push at volume.

🖼️ Visual suggestion — screenshot: HubSpot home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-hubspot.png (Images > Competitors > homepage), captured 20 August 2026. Source: https://www.hubspot.com/products/marketing
Alt: HubSpot Marketing Hub product page with pricing tiers visible.
Pie: the pricing is public, which is unusual in this list, and the tier structure is what the compliance question hangs on. Captured 18 September 2026.

7. Luma Health

Scheduling is the spine, and the messaging hangs off it.

Best for: organizations whose patient journey problem starts at booking and ends at recall.

What it does well: it ties the message to the appointment, so waitlists, fills and reminders share one state.

Key features: self-scheduling, waitlist and fill, reminders, intake, referrals, broadcast messaging.

Worth knowing: the value depends on how deeply it integrates with your scheduling system. A shallow integration turns it into an expensive reminder tool.

Pricing: quote based.

Not a fit if: your scheduling stays in a system it does not integrate with.

🖼️ Visual suggestion — screenshot: Luma Health home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-luma-health.png (Images > Competitors > homepage), captured 18 September 2026. Source: https://www.lumahealth.io/
Alt: Luma Health home page leading with operational AI and a workflow gallery of appointment management, targeted rescheduling and no-show reactivation.
Pie: the page sells workflows tied to the schedule rather than campaigns, which is the honest summary of where its value sits. Captured 18 September 2026.

8. Adobe Marketo Engage

The enterprise option that shows up when the marketing team is bigger than the IT team.

Best for: large healthcare organizations running demand generation with a marketing operations team of their own.

What it does well: program-level automation, lead and patient scoring, and campaign governance across many business units.

Key features: engagement programs, scoring, account-level reporting, dynamic content, integrations catalog.

Worth knowing: its native channel set is narrower than its reputation suggests. SMS and push usually arrive through partners, which means the compliance question moves to those partners.

Pricing: quote based.

Not a fit if: your program is mostly appointment logistics rather than demand generation.

🖼️ Visual suggestion — screenshot: Adobe Marketo Engage home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-adobe-marketo-engage.png (Images > Competitors > homepage), captured 18 September 2026. Source: https://business.adobe.com/products/marketo/adobe-marketo.html
Alt: Adobe Marketo Engage product page with its marketing automation headline and the Marketo Sales Insight lead feed.
Pie: the page is organized around marketing programs and lead feeds, not around patients, which is exactly the distinction that decides fit here. Captured 18 September 2026.

9. ActiveCampaign

The email-led option for practices that want automation without a project.

Best for: mid-sized providers and smaller practices running an email-first program.

What it does well: automations that are easy to build, good deliverability, and a price you can see before you talk to anyone.

Key features: email automation, site messages, SMS add-on, segmentation, CRM.

Worth knowing: it is a general marketing tool with healthcare customers, not a healthcare product. Everything clinical stays your responsibility to keep out of it.

Pricing: public tiered pricing.

Not a fit if: you need protected health information inside the message itself.

🖼️ Visual suggestion — screenshot: ActiveCampaign home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-activecampaign.png (Images > Competitors > homepage), captured 20 August 2026. Source: https://www.activecampaign.com/
Alt: ActiveCampaign home page with its headline and pricing entry point.
Pie: it sells to every industry rather than to healthcare, which is the context for its compliance posture. Captured 18 September 2026.

10. Birdeye

Reputation first, messaging second, and for some practices that order is correct.

Best for: multi-location practices where reviews and local search drive new patients.

What it does well: review generation and monitoring across locations, plus the messaging that supports it.

Key features: review requests, reputation monitoring, SMS campaigns, listings management, webchat.

Worth knowing: if you buy it expecting a journey orchestration platform you will be disappointed. It is very good at a narrower job.

Pricing: quote based.

Not a fit if: your growth problem is retention rather than acquisition.

🖼️ Visual suggestion — screenshot: Birdeye healthcare page. Insert the screenshot here.
Design brief: file already in Drive, homepage-birdeye.png (Images > Competitors > homepage), captured 18 September 2026.
Alt: Birdeye healthcare page headlined turn patient feedback into better care, with Google and Capterra rating badges.
Pie: reputation is the product and patient feedback is the input, which is an accurate description of where it is strongest and of what it does not do. Captured 18 September 2026.

11. PatientNow

The specialty option, and the one currently doing the best job of documenting its own category.

Best for: med spas, aesthetic practices, weight-loss centers and plastic surgery.

What it does well: it fits the workflow of a cash-pay aesthetic practice, including inventory and consultation flows that general platforms do not model.

Key features: AI concierge, marketing suite, inventory management, patient records for aesthetics, before and after photo handling.

Worth knowing: its fit narrows fast outside aesthetics. It is not a general healthcare platform and does not claim to be.

Pricing: quote based.

Not a fit if: you are a general medical practice, a hospital or a digital health product.

🖼️ Visual suggestion — screenshot: PatientNow home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-patientnow.png (Images > Competitors > homepage), captured 18 September 2026. Source: https://patientnow.com/
Alt: PatientNow home page presenting all-in-one aesthetic practice management software with EMR, scheduling, payments, marketing and photo documentation.
Pie: the vertical focus is explicit on the home page, which is why it wins its segment and does not compete outside it. Captured 18 September 2026.

12. PatientPop, now Tebra

Acquisition first: the practice website, the listings and the reviews that feed it. It is also the entry on this list whose name is out of date everywhere except here.

Best for: multi-specialty and primary care practices whose priority is new patient acquisition.

What it does well: it treats the practice's online presence as one system, from the site to the listings to the review flow, and reports on where new patients came from.

Key features: practice website, online scheduling, listings management, reputation, patient communication.

Worth knowing: PatientPop stopped being a separate product on 2 April 2024, when Tebra retired the website and folded the services into tebra.com. Comparison pages across this category still list PatientPop as if you could buy it; you cannot, and patientpop.com redirects. What you are evaluating is Tebra, an all-in-one practice-operations suite, so what you buy and what you get billed for is broader than the marketing piece.

Pricing: quote based.

Not a fit if: your problem is retention and recall rather than filling the top of the funnel.

🖼️ Visual suggestion — screenshot: Tebra home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-tebra.png (Images > Competitors > homepage), captured 18 September 2026. Source: https://www.tebra.com/
Alt: Tebra home page headlined run your entire practice with one EHR plus platform, listing EHR, patient experience, practice marketing and billing.
Pie: marketing is one block among four on that page, which is the fastest way to see that what replaced PatientPop is a practice-operations suite and not a growth product. Captured 18 September 2026.

13. Solutionreach

Built around keeping existing patients coming back.

Best for: practices whose priority is retention, recall and routine patient communication.

What it does well: recall campaigns, reminders and two-way messaging with staff workflows that front-desk teams actually use.

Key features: appointment reminders, recall, two-way texting, surveys, newsletters.

Worth knowing: the marketing side is lighter than the communication side. Treat it as patient communication software with marketing attached.

Pricing: quote based.

Not a fit if: you need campaign orchestration across app and web as well as messaging.

🖼️ Visual suggestion — screenshot: Solutionreach home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-solutionreach.png (Images > Competitors > homepage), captured 18 September 2026. Source: https://www.solutionreach.com/
Alt: Solutionreach home page introducing Stella, an AI receptionist presented as a voicemail replacement for scheduling calls.
Pie: the page opens on the phone line rather than on campaigns, which tells you who operates it day to day. Captured 18 September 2026.

14. Weave

The phone system that grew into patient outreach, which is why front desks like it.

Best for: small and mid-sized clinics that run reminders and outreach from the front desk rather than from a marketing team.

What it does well: it joins the phone, the texts and the schedule in one place, so the person who answers the call is the person who sees the history.

Key features: VoIP phones, two-way texting, appointment reminders, payments, reviews.

Worth knowing: the phone system is part of the product, so switching to it is an operations change and not only a marketing one.

Pricing: quote based.

Not a fit if: you want marketing orchestration across app, web and push rather than front-desk communication.

🖼️ Visual suggestion — screenshot: Weave home page. Insert the screenshot here.
Design brief: file already in Drive, homepage-weave.png (Images > Competitors > homepage), captured 18 September 2026. Source: https://www.getweave.com/
Alt: Weave home page headlined supercharge your practice growth, with calls, texts and payments shown as one surface.
Pie: calls and texts sit at the center of the page, which explains both its strength and its switching cost. Captured 18 September 2026.

The three questions that actually decide this

Compliance: who signs a BAA, and for which channels?

A vendor can be HIPAA-aware, host on a compliant cloud, and still not sign a BAA that covers the channel you care about. The gap usually appears where the platform brokers a channel through a third party: the email is covered, the SMS belongs to somebody else.

Ask it as a list, not as a question. Name each channel you will send on, and ask for the BAA to cover it in writing. HHS sets out what the agreement has to contain, and a vendor that cannot answer channel by channel has told you something useful. Ask for the security documentation too: SOC 2 Type II and ISO 27001 are the two that come up most often, and vendors that hold them usually publish them, as indigitall does in its security policy.

There is a related trap, and it shows up every time a practice manager asks a buyer forum which CRM or automation tool is HIPAA compliant. The answers come back as product names. Compliance describes an agreement plus a configuration, and it does not travel with a product into your account. Under the HIPAA Rules a vendor that handles protected health information on your behalf is a business associate because of what it does with the data, whatever the marketing page calls it.

So turn the label into three checks you can run in an afternoon. Confirm the BAA is available on the plan you can actually afford, because several platforms reserve it for a higher tier and a small practice priced into a lower one is covered by nothing. Find out who at your organization accepted it and on what date, since an agreement clicked through during setup was probably never read by your counsel. And confirm it names the vendor's own subcontractors, which HHS requires the contract to address, because the analytics tool or the SMS carrier sitting behind your platform is handling the same data you are answerable for.

Integration: EHR, EMR and practice management

This is the criterion that separates the list most sharply, and the one buyers underestimate. Two vendors can both say "EHR integration" and mean a live two-way sync in one case and a nightly file in the other.

The question that ends the conversation: if a patient cancels at 9:04, what does your platform know at 9:05, and what does it do about the reminder scheduled for 9:30?

Fit by size and type of organization

The platforms built for large hospital systems and the ones built for a single-specialty practice are not competing for the same buyer, even though they appear on the same lists. Buying above your tier means paying for an implementation you will not finish. Buying below it means outgrowing the platform in a year.

Match the tier before comparing features. If you are still deciding whether you need orchestration at all, this breakdown of omnichannel marketing automation is the shorter version of that question. The Built for column in the table above is there for exactly this, and it is the column to read first if your tier is obvious to you.

What we would choose, by situation

• A hospital network with everything already in Salesforce. Salesforce Marketing Cloud with Health Cloud. The integration cost is real but it is lower than moving the record.

• A telehealth product where the app is the relationship. Braze or Iterable. Event-driven messaging is the whole job here and both do it natively.

• A twelve-location provider group that sends reminders on four channels. indigitall, because one agreement covering encrypted push, the patient portal, email and SMS is the specific thing it is built for. If the reminders only go out by text and phone from the front desk, Weave or Solutionreach will do it for less.

• A primary care group whose problem is empty slots, not repeat patients. PatientPop, now Tebra, or Luma Health if the scheduling system is where the fix has to land.

• A single med spa. PatientNow. A general platform will not model the workflow and you will end up running it on spreadsheets anyway.

• A two-doctor practice with an email list. ActiveCampaign or HubSpot, and keep protected health information out of the message.

FAQs: healthcare marketing automation platforms

Do healthcare marketing automation platforms have to be HIPAA compliant?

If the platform touches protected health information, the vendor is a business associate and has to sign a BAA. If the program is strictly non-clinical, the requirement changes, but so does what you are allowed to put in the message. Decide which of the two you are running before you shortlist.

Is a platform HIPAA compliant just because it says so?

No, and it is the most repeated question from small practices shopping for one. The operative artifact is the signed agreement, and HHS sets out what it has to contain: permitted uses and disclosures, appropriate safeguards, reporting of any use or disclosure the contract does not provide for, availability of the vendor's records to HHS, return or destruction of the data at termination, and the same restrictions applied to subcontractors. Check three things before you shortlist. Whether the BAA is offered on the plan you can afford, who at your organization accepted it, and whether it names the channels you will actually send on.

What is the difference between a healthcare platform and general marketing software?

Accountability, mostly. General software can be configured carefully and used safely; a healthcare platform signs the agreement that makes the vendor answerable for the data. The feature lists overlap far more than the contracts do. The wider shift behind all of this is covered in this guide to omnichannel excellence in healthcare marketing.

Which platform is best for reducing no-shows?

Four of these attack it from different angles, and which one fits depends on where your process breaks. Weave and Solutionreach work from the front desk, Luma Health from the scheduling system, and indigitall from channel coverage, sending the reminder on encrypted push, the portal, email or SMS under one agreement and escalating to a voice call only for the patients who did not answer the cheaper step. If your reminders already go out reliably and patients still miss appointments, the problem is timing and channel, not volume.

Can one platform replace a marketing agency?

It can replace the execution, not the judgment. Every platform here still needs somebody to decide what to say and to whom.

How much does healthcare marketing automation cost?

Most vendors in this category do not publish healthcare pricing, which is why this piece says so instead of estimating. HubSpot is the exception with public tiers. ActiveCampaign moved its pricing behind a configurator that asks for contact volume before it shows a figure, checked on 18 September 2026.

What should I ask on the first vendor call?

Three things: which channels the BAA covers, whether the EHR sync is real time or batch, and which comparable organization you can phone as a reference.

About the Authors

TL;DR: There is no single best customer data platform for healthcare, and any page that crowns one is answering a question you did not ask. Every platform in this category unifies profiles, resolves identity and builds segments, because that is what the category means. What separates them in a healthcare organization is narrower: whether the vendor signs a business associate agreement and for which products, which of your systems it reads without a custom project, and what it is allowed to send once the segment exists. indigitall is the option that covers most of that path on its own, a unified patient profile whose whole point is the message that goes out next, on channels that can legally carry it in the United States. Adobe with Healthcare Shield, Microsoft Customer Insights and Salesforce Data Cloud cover the same ground but only inside an estate you already have to be running. Hightouch, Tealium and Treasure AI stop at the data and hand the sending to somebody else, which for a health system standing on a warehouse is exactly the right answer. The decision is not which platform stores best. It is what your data can activate the day after go-live.

This piece is for the people who sign for patient data in a US healthcare organization: marketing and digital directors at provider groups and health systems, heads of patient experience, CRM and MarTech leads, and the compliance officer who will read the contract after you do. You get the criteria this category actually splits on, a card for each option with the same fields, the integration questions to ask before signing, and the part most shortlists skip, which is what happens to the segment once it exists.

🖼️ Visual suggestion — chart: The category split by what each platform is built to be good at. Insert the chart here.
Design brief: a two-axis map. Horizontal axis, where the data lives, from "your warehouse" on the left to "the vendor's platform" on the right. Vertical axis, what the platform is built to do with it, from "store, model and govern" at the bottom to "activate on regulated channels" at the top. Place the seven options as labeled dots. No scores, no bubble sizes, no leader quadrant, no quadrant names.
Alt: Map of seven customer data platforms placed by where patient data lives and whether the platform is built to store it or to activate it, with no ranking.
Pie: The options spread across the map rather than clustering, which is why one ordered list cannot answer this question for every organization.

Why does a general CDP shortlist fall apart in healthcare?

Because the criteria that separate CDPs in retail stop separating anything once protected health information enters the picture.

Every platform in this category does identity resolution, real time profiles, behavioral segmentation and audience export. Those are properties of the category, not of a vendor. A comparison built on them returns eight platforms that look identical, and the buyer picks on price or on whoever answered the phone first.

What actually changes the answer is three questions that a general shortlist never asks. Will this vendor sign a business associate agreement, and does that agreement cover the specific product you are buying rather than the parent company's cloud. Can it read the systems where your patient data already lives without a twelve month integration project. And once you have built the segment, what is it allowed to send, and through which channel.

Most of the pages ranking CDPs for healthcare today answer the first question with a logo and skip the other two entirely. If you want the general version of the category first, we wrote it separately: the types of CDP and how they differ covers packaged, composable and unified engagement platforms without the sector lens.

What does a CDP actually have to resolve in a healthcare organization?

One thing, and it has nothing to do with marketing: the same human being exists five times in your systems and none of those records know about each other.

There is a patient record in the EHR. A member record if you also run a plan. A caregiver who books on someone else's behalf and whose phone number is the one that answers. A digital health app user with a device identifier and no name attached. And a marketing contact from a form filled in three years ago with a typo in the email.

A CDP in healthcare earns its keep when those five collapse into one profile, and when the platform knows which of the five identities a given message is allowed to speak to. That is different from retail, where the worst case of a bad merge is a wrong product recommendation.

The unglamorous half of that work is data quality, and it is where most projects lose their first six months. Phone numbers arrive from the CRM with country codes missing, with extensions glued on, with characters no dialer accepts, and every one of those creates a duplicate that is far more expensive to unpick later than to prevent now. It is worth noticing which vendors name this problem at all: indigitall's own CDP page lists unresolved customer identities and poor CRM data quality as two of the four problems the product exists to solve, which is at least an admission that the work is real.

🖼️ Visual suggestion — diagram: The five identities that have to collapse into one patient profile. Insert the diagram here.
Design brief: five labeled source boxes on the left (EHR patient record, member record, caregiver contact, digital health app user, marketing contact) feeding into one unified profile in the center. On the right, three outputs marked with whether they may carry health information: clinical message, non-clinical message, suppressed. Mark the merge point with the identity signals used (email, normalized phone, device id, member id).
Alt: Diagram showing five separate healthcare records merging into one patient profile, then splitting into clinical, non-clinical and suppressed message paths.
Pie: The merge is only half the work. The profile is only useful when it also records which identity a message is allowed to address.

Where is the line between unified data and activatable PHI?

This is the question that decides your architecture, and it is not the same as "is this vendor HIPAA compliant".

Unifying data and activating it are two different permissions. A platform can lawfully hold a profile that includes clinical detail and still be the wrong place to trigger a message from, because the sending channel cannot carry that detail. Teams discover this in reverse order, usually in week six, after the segments are built.

The regulatory ground here also moved recently, and most vendor pages have not caught up. In December 2022 the Office for Civil Rights published guidance on online tracking technologies that treated a wide range of website analytics as regulated. On 20 June 2024 the US District Court for the Northern District of Texas vacated part of it. The HHS guidance page, last reviewed on 26 June 2024, now states that the Court vacated the guidance to the extent it provides that HIPAA obligations are triggered in circumstances where an online technology connects an individual's IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers. OCR later withdrew its appeal.

That does not make web tracking on health pages a solved problem, and your own counsel will have a view. What it does mean is that a vendor still selling you a product on the strength of that specific 2022 interpretation is selling you a position that a federal court has partly struck down. Ask what their guidance is dated.

🖼️ Visual suggestion — table: What the platform may hold, versus what each channel may carry. Insert the graphic here.
Design brief: a two-column comparison. Left column, data the CDP holds under a signed business associate agreement. Right column, what each outbound channel may carry in the United States, with encrypted push, secure portal, email under agreement and voice under agreement marked as able to carry health information, and SMS, RCS and WhatsApp marked as non-clinical only. Keep it text, no icons of medical symbols.
Alt: Comparison of what a customer data platform may store under a business associate agreement versus which outbound channels may carry health information in the United States.
Pie: Holding the data and being allowed to send it are two separate permissions, and the second one is narrower.

How were these options evaluated?

Six criteria, declared before the list so the selection reads as a method rather than an opinion. Each one is something you can verify yourself from public documentation or from a contract, not something we scored.

1. Business associate agreement, and its scope. Whether the vendor signs one, and whether it covers the specific product rather than the wider cloud.
2. Where the data sits. In your warehouse, in the vendor's platform, or split between both.
3. What it reads without a project. EHR, EMR, CRM, portal, app, scheduling, warehouse, and whether those are native connectors or integration work.
4. Identity resolution. How duplicates are collapsed, and what happens when the signal is a caregiver's phone rather than the patient's.
5. Activation. What the platform can send by itself, versus what it has to hand to another system to send.
6. Documented limits. Whether the vendor publishes what its product does not cover. This one is rarer than it should be, and it is the most useful.

The order is declared, and it is not a score. The entries run by how much of the path from patient data to sent message each platform covers by itself, without depending on another vendor. First, the option that owns the profile and the regulated channels without requiring you to already run its estate. Then the ones that own both, but only inside an estate you already have. Then the ones that own the data and hand the sending to somebody else. Within each group, alphabetical.

You can reproduce that ordering yourself from the seven public product pages, which is the point of declaring it. Be clear about what it is, though: it is a model of operating dependency, not proof that any given channel may carry protected health information under your agreement. No public page settles that, and the contractual check stays a prerequisite for all seven regardless of which group a platform sits in.

And the order says nothing about quality. For a health system with a mature warehouse, the third group is the correct answer and the position does not change that. What the order does is put the question this piece is about, what happens after the segment exists, in front of the question every other shortlist leads with.

One honest note on coverage. This covers the operating models most often seen in US healthcare programs. It does not claim to list every vendor in the category, and a selection by fit never can.

Key takeaways

• Every option here unifies profiles and resolves identity. That is the category, not the differentiator, so do not buy on it.
• A signed business associate agreement is necessary and not sufficient. Ask which product it covers, in writing.
• The integration question decides more than the feature question. Ask what it reads on day one, not what it could read.
• Activation is where healthcare shortlists break. A segment you cannot legally message is a report.
• The 2022 tracking guidance everyone quotes was partly vacated in June 2024. Check the date on any compliance claim built on it.
• Budget the identity and data quality work before the campaign work. Malformed phone numbers create duplicates that cost more to unpick than to prevent.

How do the options compare?

Read the row that matches the estate you already run, not the row with the most ticks. The last column is the one to take into the call.

The uncomfortable column is the last one, and it is the one every vendor page leaves out.

indigitall

The option for organizations whose real problem is the message, not the database.

🖼️ Visual suggestion — screenshot: indigitall healthcare landing page. Insert the screenshot here.
Design brief: archivo en Drive, indigitall-healthcare.png (Images > indigitall), capturada el 18 de septiembre de 2026. Fuente: https://indigitall.com/en/industry/healthcare/
Alt: indigitall healthcare page headlined "Orchestrate Every Patient Journey on One Platform. One Platform. Every Channel. One BAA.", with the logos of healthcare and insurance organizations that use indigitall along the bottom: Proclinic Group, Quironprevencion, HM Hospitales, Quironsalud, Santalucia and Vithas.
Pie: The page commits to a single business associate agreement covering every channel, which is the claim to take into the contract conversation. Captured 18 September 2026.

Best for: healthcare providers and clinic groups that want a unified patient profile whose purpose is the next outbound message, on channels that can carry health information in the United States.

What it does well: it connects the profile to the journey and to the channels in one platform, so the segment you build is the segment that sends. Its published documentation sets out a customer identification method that assigns your own customer id to a device or session, which is the mechanism that ties an anonymous visitor to a known record. Its CDP page also documents native modules that synchronize with a CRM or an ERP, which matters because that synchronization is where most of the duplicate records come from.

The journey layer is what the rest of this category hands to somebody else, and it is worth understanding as a mechanism rather than as a promise. Its journey documentation describes entering people by event, an abandoned cart or a purchase being the examples it gives, and branching the path with decision splits based on whether the person interacted with the previous message. That is the building block. What you do with it is design the ladder yourself: start on the cheapest channel that can legally carry the message, let the patient leave the journey the moment they complete the goal, and let the expensive step fire only down the branch of people who did not respond. The platform does not decide that for you. What it gives you is somewhere to express it without reaching for a second vendor.

When the automation cannot finish a conversation, it hands to a person without switching tools, with the history and the profile traveling with the conversation.

There is published evidence for the model in healthcare, and it is worth reading for what it does and does not claim. A provider serving over 7 million patients a year reports 40% less call center volume, 15% fewer missed appointments and 85% patient satisfaction after deploying AI chatbots for patient communication. Those figures are for conversational engagement, not for a CDP migration.

Key features: unified patient profile with documented customer identification, native CRM and ERP synchronization modules, encrypted push, email, secure portal, AI voice calls in English and Spanish, AI agents with handoff to a human, HIPAA under signed business associate agreement, SOC 2 and ISO 27001, patient data hosted in the United States.

Worth knowing: no integration with a named EHR or EMR is published. If your requirement is a certified connector into a specific clinical system rather than API level integration, ask for that in writing before you plan a timeline. Its published security documentation is the right place to start that conversation.

Pricing: not published. Demo and contract, no self-service sign-up.

Not a fit if: what you need is a warehouse, a modeling layer or a place to run analytics. This is built so the profile can send, and if nothing is going to send, a data platform costs less and does the job.

🖼️ Visual suggestion — screenshot: indigitall customer data platform page. Insert the screenshot here.
Design brief: archivo en Drive, indigitall-cdp.png (Images > indigitall), capturada el 18 de septiembre de 2026. Fuente: https://indigitall.com/en/cdp/
Alt: indigitall customer data platform page headlined "From fragmented data to one living profile", showing a unified customer profile with its channels and activity history.
Pie: The headline is the whole argument for this entry: the profile exists so the next message can be sent, not so the data can sit somewhere. Captured 18 September 2026.

What its users say. Two reviews speak to what this entry claims and to what it costs. The first is from a reviewer whose own headline names both halves of the trade:

"The interface is quite intuitive and allows us to launch campaigns quickly without constantly relying on technical support. We also greatly value the advanced segmentation, as it helps us target campaigns to specific users based on their behavior, which clearly improves results."

A verified reviewer on G2, in a review titled "comfortable integration for web and app, but a noticeable initial learning curve". The segmentation is the value and the ramp is the price, and both belong in your plan.

A second one points at reporting rather than sending, which is the gap worth budgeting for:

"I believe you can improve the visuals and give me more information on how the campaigns are going, especially regarding metrics."

Nicolas M., on G2. If measurement matters to your business case, assume you will do some of that reporting outside the platform, at least at first.

Adobe Real-Time CDP

The enterprise marketing platform, approached from a data estate you may already own.

Best for: large healthcare marketing organizations already running Adobe Experience Platform, where adding patient data to the existing profile is cheaper than standing up a second system.

What it does well: it keeps audience building, governance and campaign execution in one environment, which matters when the people running patient acquisition are the same people running everything else. Adobe publishes a healthcare specific add-on, Healthcare Shield, aimed at customers who need to handle protected health information inside Real-Time CDP.

Key features: real time profile, data governance and labeling, audience segmentation, connections to Adobe and third party destinations, Healthcare Shield as an add-on for regulated data.

Worth knowing: Healthcare Shield is an add-on with its own product terms, not a setting. Confirm which components of your Adobe estate it covers and what it changes about your existing implementation, because the answer is rarely "nothing".

Pricing: not published. Enterprise agreement.

Not a fit if: you are not already on Adobe. The value here compounds with an existing estate and is hard to justify without one.

🖼️ Visual suggestion — screenshot: Adobe Real-Time CDP customer data governance page. Insert the screenshot here.
Design brief: archivo en Drive, healthcare-adobe-realtime-cdp.png (Images > Competitors > healthcare), capturada el 18 de septiembre de 2026. Fuente: https://business.adobe.com/products/real-time-customer-data-platform/govern-customer-data.html
Alt: Adobe Real-Time CDP governance page headlined "Govern your customer data for responsible marketing", showing privacy settings that restrict third-party export, data sharing and online advertising.
Pie: Governance leads the page rather than segmentation, which tells you which half of the problem this product is built around. Captured 18 September 2026.

Microsoft Customer Insights

The option for estates that are already Microsoft, end to end.

Best for: healthcare organizations running Dynamics 365 and the wider Microsoft cloud, where the CDP is one more component rather than a new vendor relationship.

What it does well: it sits inside an estate your IT organization already administers, which means identity, access and vendor management are questions you have answered before rather than questions you open from scratch. Whether that shortens your own security review is worth asking your IT team rather than the vendor, because the answer depends on how your agreements are actually written. Microsoft publishes a healthcare industry layer, Microsoft Cloud for Healthcare, that sits alongside its data and engagement products.

Key features: unified customer profiles, segmentation and measures, connections to Dynamics 365 and the Microsoft data estate, healthcare industry solutions available separately.

Worth knowing: confirm whether your use case is served by Customer Insights alone or needs the healthcare industry layer as well, because those are different products with different commercial terms.

Pricing: published list pricing for the base product, enterprise agreements in practice.

Not a fit if: your marketing and patient engagement stack is not Microsoft. The argument for this one is estate coherence, and without the estate the argument goes away.

🖼️ Visual suggestion — screenshot: Microsoft healthcare industry overview on Microsoft Learn. Insert the screenshot here.
Design brief: archivo en Drive, healthcare-microsoft.png (Images > Competitors > healthcare), capturada el 18 de septiembre de 2026. Fuente: https://learn.microsoft.com/en-us/industry/healthcare/overview
Alt: Microsoft Learn documentation page titled "What is Microsoft for Healthcare?", with a sidebar listing healthcare scenarios such as patient engagement, care team collaboration and clinical insights.
Pie: The healthcare capability lives in documentation as a separate industry layer, which is exactly the scoping question to raise in the first call. Captured 18 September 2026.

Salesforce Data Cloud

The option for health systems whose clinical and service records already live in Salesforce.

Best for: organizations running Health Cloud, where the patient profile and the service record benefit from being in one estate.

What it does well: it puts the unified profile next to the clinical and service data model your teams already work in, so the profile and the record are not two copies in two systems. How much implementation time that actually saves depends on how much of your patient data is already in Salesforce today, which is the number to establish before anyone quotes you a timeline. Salesforce maintains a public compliance site documenting which of its products are covered for HIPAA regulated use.

Key features: unified profiles across Salesforce clouds, segmentation, activation into Marketing Cloud and connected destinations, Health Cloud data model, published compliance documentation.

Worth knowing: this is the one where scope of the business associate agreement matters most, because the estate is large and not every cloud and every feature is covered. Get the covered product list in writing and check it against what you actually plan to use.

Pricing: not published. Enterprise agreement.

Not a fit if: you are not on Salesforce. Adopting the estate to get the CDP is a much larger decision than the one you started with.

🖼️ Visual suggestion — screenshot: Salesforce compliance site, HIPAA category. Insert the screenshot here.
Design brief: archivo en Drive, healthcare-salesforce-hipaa.png (Images > Competitors > healthcare), capturada el 18 de septiembre de 2026. Fuente: https://compliance.salesforce.com/en/categories/hipaa
Alt: Salesforce compliance site, HIPAA category, listing related documents product by product with the infrastructure and services each one covers.
Pie: The page is a product by product list with dates on it, which is the reason to read it rather than accept a single yes. Captured 18 September 2026.

Hightouch

The composable option, for organizations whose data already sits where it should.

Best for: healthcare data teams with patient data modeled in a cloud warehouse, who want activation without copying that data into another vendor's platform.

What it does well: two things, and they are worth separating because they are supported by two different statements on its own healthcare page. The first is architectural: Hightouch states that it "never stores any of your data" and "operates directly in your data warehouse". The second is the regulated fit: it presents itself as "a HIPAA-compliant agentic marketing platform for healthcare" and describes activating patient and member data "without PHI ever leaving your infrastructure". For a compliance officer, that second sentence is a materially easier conversation than "we copy it to a second vendor".

Key features: warehouse native audiences, reverse ETL syncs to downstream tools, data contracts for approved and standardized fields, governance of access and usage rules across teams, published security documentation.

Worth knowing: the compliance question does not disappear, it moves. Once an audience syncs to a downstream tool, that tool now holds the data and needs its own agreement. Map the destinations before you map the sources.

Pricing: not published for regulated deployments.

Not a fit if: you do not have a warehouse, or you do not have a data team to model patient data in it. This assumes both.

🖼️ Visual suggestion — screenshot: Hightouch healthcare solutions page. Insert the screenshot here.
Design brief: archivo en Drive, healthcare-hightouch.png (Images > Competitors > healthcare), capturada el 18 de septiembre de 2026. Fuente: https://hightouch.com/solutions/healthcare
Alt: Hightouch healthcare page headlined "The marketing you have always wanted with the data security you need", above a diagram syncing audiences from warehouse data to advertising and email destinations.
Pie: The diagram is the operating model in one picture: the data stays put and only the audience travels. Captured 18 September 2026.

Tealium

The data and governance option, where collection comes before campaigns.

Best for: healthcare data and analytics teams whose first problem is controlling what gets collected and where it goes, before anyone builds an audience.

What it does well: it sits early in the stack, at collection, which is the right place to enforce rules about what leaves your properties in the first place. Tealium publishes a healthcare industry position and has announced HIPAA related milestones for its customer data platform, alongside a private cloud deployment option.

Key features: tag and data collection management, real time profiles and audiences, consent and governance controls, connectors to downstream tools, private cloud deployment option.

Worth knowing: ask early whether the private cloud option is required for your use case, because it changes both the architecture and the number.

Pricing: not published.

Not a fit if: what you need is the outbound patient journey. This feeds the tools that send, it is not the tool that sends.

🖼️ Visual suggestion — screenshot: Tealium healthcare industry page. Insert the screenshot here.
Design brief: archivo en Drive, healthcare-tealium.png (Images > Competitors > healthcare), capturada el 18 de septiembre de 2026. Fuente: https://tealium.com/industry-healthcare/
Alt: Tealium healthcare page offering a demo and a HIPAA compliance link, with a banner citing its recognition in the 2025 Everest Group Healthcare Backbone Report.
Pie: The page puts the HIPAA compliance link next to the demo button, which is a fair signal of which question its buyers ask first. Captured 18 September 2026.

Treasure AI

The packaged enterprise CDP, with a published HIPAA position and a new name.

Best for: large organizations that want a packaged platform to hold and model patient data centrally, with activation into whatever they already use to send.

What it does well: it is explicit in public about what its healthcare position is and is not. Its own healthcare page describes "governed, HIPAA-aligned profiles that unify PII and PHI from every source", states that the company undergoes annual external audits covering PHI and ePHI, and says plainly that the product is a cloud, multi-tenant solution running on AWS. Read that last sentence carefully if your security review has a view on multi-tenancy.

Key features: unified profiles combining personally identifiable and protected health information, data ingestion and modeling, segmentation, connected destinations, published HIPAA documentation and annual external audits.

Worth knowing: two things. The company now trades as Treasure AI, so if procurement pulls documentation under the old name, check you are reading the current version. And the wording on its own page is "HIPAA-aligned", not "HIPAA certified", which is the honest formulation and also the one to take to your counsel.

Pricing: not published.

Not a fit if: your organization is small enough that an enterprise data platform is more governance than you need.

🖼️ Visual suggestion — screenshot: Treasure AI healthcare industry page. Insert the screenshot here.
Design brief: archivo en Drive, healthcare-treasure-ai.png (Images > Competitors > healthcare), capturada el 18 de septiembre de 2026. Fuente: https://www.treasure.ai/industries/healthcare/
Alt: Treasure AI healthcare page headlined "From Fragmented Systems to Unified Intelligence", describing governed AI agents that work from a unified view of patient, provider and member data.
Pie: The Treasure AI name sits in the top left of its own page, which is the quickest way to confirm you are reading current documentation rather than an archived Treasure Data page. Captured 18 September 2026.

Which systems does it actually have to read?

Ask every vendor to walk you through all seven, and ask which are native connectors today rather than roadmap.

1. The EHR or EMR. The system of record for clinical data. Ask for a named integration and a named customer, not an API reference.
2. The scheduling system. Where appointments, cancellations and no-shows live. This is where most of the value in patient engagement sits.
3. The CRM. Where marketing and service contacts live, usually with the worst data quality of the three.
4. The patient portal and the app. Authenticated surfaces, where behavioral signal is richest and where consent is cleanest.
5. The warehouse. Whether the platform reads from it, writes to it, or ignores it.
6. Consent and preference storage. Per channel, not per person. Consent for SMS is not consent for anything else.
7. Analytics. Where you will prove the thing worked, and where you will discover the numbers do not reconcile.

The reason this list is long is that most of it is integration work, and integration work is the part of the plan that slips. The segment building is the fast part.

🖼️ Visual suggestion — diagram: The seven systems a healthcare CDP has to read, marked by who owns each connection. Insert the diagram here.
Design brief: a horizontal sequence of the seven systems, color coded into three groups: clinical systems, engagement systems and data systems. Mark each with whether the vendor ships a connector or the customer builds it. Add an elapsed time bar underneath showing that the clinical systems group is the longest stretch.
Alt: Seven systems a healthcare customer data platform must integrate with, grouped into clinical, engagement and data systems, with connection ownership marked.
Pie: The clinical systems group is the longest stretch and the one campaign calendars consistently underestimate.

Which channels can carry health information in the United States?

This is the part that turns a good shortlist into a working program, and it is not a CDP feature at all, but a constraint the CDP has to respect.

Under a signed business associate agreement, the channels that can carry protected health information in the United States are narrower than the channel list on any vendor's homepage. Encrypted push, a secure patient portal, email under agreement and voice under agreement are the usual set.

Two popular channels sit outside it, and the reason is contractual rather than technical. Google states it plainly in its own data security documentation for RCS for Business: "No, RBM is not compliant with HIPAA", and the channel "supports healthcare-related use cases, provided that Protected Health Information (PHI) is excluded from such messages". Meta, for its part, does not sign a business associate agreement for WhatsApp.

Both remain useful for non-clinical communication, appointment logistics without clinical detail being the obvious case, and neither belongs in a clinical journey in the United States. If a vendor puts either in a clinical use case on a slide, that is the moment to ask for the agreement in writing.

Which option fits which kind of organization?

• A provider or clinic group whose real problem is patient communication. indigitall, with the clinical system integration path confirmed in writing.
• A marketing organization already standing on Adobe. Adobe Real-Time CDP with Healthcare Shield, scoped in writing.
• An organization whose estate is Microsoft end to end. Microsoft Customer Insights, with the healthcare layer scoped separately.
• A provider group already running Health Cloud. Salesforce Data Cloud, with the covered product list checked line by line.
• A health system with a mature data team and a cloud warehouse. Hightouch, and spend the saved effort on mapping the destinations.
• A data and analytics function whose first problem is collection and governance. Tealium.
• A large enterprise that wants a packaged platform and published HIPAA documentation. Treasure AI, reading the current pages rather than the archived ones.
• An organization that only wants to store and analyze, with no messaging plan. None of these. A warehouse and a modeling layer cost less and do the job.

How do you pilot one without exposing the whole data estate?

You do not need to migrate patient data to find out whether a platform works. A bounded pilot answers the question in weeks and survives a security review.

Pick one journey with a measurable outcome, appointment reminders being the obvious one. Define the minimum field set that journey needs and refuse anything beyond it, which is usually an identifier, a phone or device token, an appointment time and a location. Write down the purpose of use and hold the vendor to it. Require audit logging you can read yourself, not a report they produce. Set success criteria and a date before you start. And define the exit: what gets deleted, on what timeline, and who confirms it.

The pilot that fails this test is the one where the field set grows quietly because someone wanted a nicer segment.

When should you not buy a CDP at all?

Five cases, and they are more common than the category admits.

When the problem is data quality. If your records are wrong, a CDP will unify wrong records faster. Fix the source first, or at minimum understand that the cleaning work is the project.

When you need one integration, not a platform. If the actual requirement is "get appointment data into the reminder tool", that is an integration. Buying a platform to solve it means operating a platform forever.

When the warehouse already does it. If patient data is modeled, governed and queryable in the warehouse and the only gap is getting audiences out, the composable route is smaller and cheaper than a packaged CDP.

When there is no repeatable activation case. A unified profile with nothing to send is a reporting project with a larger license. Write down the three journeys you will run in year one. If you cannot, the timing is wrong, not the vendor.

When nobody has agreed who operates it. This is the quietest of the five and the one that stalls projects after go-live rather than before it. A CDP sits between the team that holds the data and the team that wants the segment, and in a healthcare organization those are rarely the same team with the same access. Settle in writing who administers it, who approves a new field, and who answers when an auditor asks where a segment came from. That last question reaches further than it looks, because HHS requires the business associate agreement to apply the same restrictions to subcontractors, so every downstream tool the platform feeds belongs in the same answer.

So which one should you shortlist?

Answer three questions in this order and the list collapses on its own.

What do you already run? Adobe, Salesforce, Microsoft or a warehouse. That removes four of the seven before you take a single call.

Where does the protected data have to live? If the answer is "not in another vendor", you are looking at the composable route. If the estate already holds it, you are looking at the platform that holds it.

What is going to send? If nothing, you do not need a CDP yet. If something, check that the segment can reach it without a second integration project, and that the channel it reaches on is one that may carry the data.

And ask for the security documentation while you are at it. SOC 2 Type II and ISO 27001 are the two that come up, and vendors that hold them usually publish them.

If what you need first is the general shape of the category rather than the healthcare shortlist, the benefits and mechanics of a CDP covers that ground without the sector constraints. And if the gap you are really trying to close is outbound patient communication rather than data architecture, start from the channels and work backwards.

FAQs: customer data platform software for healthcare

What is the best customer data platform for healthcare in 2026?

There is not one, and that is the honest answer rather than an evasive one. The category splits by where your data already lives and by what you need to send. Health systems on a warehouse land on composable tools, organizations standing on Adobe, Salesforce or Microsoft land on the platform they already run, and providers whose real problem is patient communication land on a platform built to activate rather than to store. Decide which of those describes you before you compare features.

Is a business associate agreement enough to make a CDP HIPAA compliant?

No. A signed agreement is necessary and not sufficient. It has to cover the specific product and configuration you are buying, which is not always the whole estate, and compliance also depends on what you do with the data afterwards. Ask for the covered product list in writing and check it against your actual plan.

Who should own a customer data platform inside a healthcare organization?

Whoever can answer an audit question about it without asking somebody else. Marketing usually asks for the platform and the data team usually ends up operating it, and the implementations that stall after go-live are the ones where that was never settled in writing. Name three people before you sign: the administrator, the person who approves a new field, and the person who can trace a segment back to its source. That third role is the one that matters when the business associate agreement is tested, because HHS requires the contract to apply the same restrictions to subcontractors, which puts every downstream tool the platform feeds inside the same answer.

Can a customer data platform read data directly from an EHR?

Sometimes, and the honest answer per vendor varies more than the marketing suggests. Some ship named connectors to specific clinical systems, others integrate at API level and expect your team or an implementation partner to build it. Ask for a named integration with a named reference customer, because "we integrate with any system via API" is a description of effort, not of a connector.

Does HIPAA still apply to website tracking on healthcare pages?

The position changed in 2024 and the answer is narrower than it was. On 20 June 2024 a federal court vacated part of the Office for Civil Rights guidance on online tracking technologies, specifically the part treating an IP address combined with a visit to an unauthenticated public page about a health condition as triggering HIPAA obligations. OCR later withdrew its appeal. Authenticated pages and actual protected health information are a different matter, and your counsel should have the final word.

Can I send appointment reminders over WhatsApp or RCS in the United States?

Not with clinical detail. Google's RCS Business Messaging terms prohibit protected health information on RCS, and Meta does not sign a business associate agreement for WhatsApp. Both are usable for non-clinical communication. For anything containing health information, the usual channels are encrypted push, a secure portal, email under agreement and voice under agreement.

How long does a healthcare CDP implementation take?

Longer than the demo suggests, and the critical path is integration and review rather than segmentation. The clinical system connection and the security review are the two stretches that move, and both depend on work outside the vendor's control. A bounded pilot on one journey is the fastest way to get a real number for your own organization.

Do we need a CDP if we already have a data warehouse?

Often not in the packaged sense. If patient data is already modeled and governed in the warehouse, the remaining gap is usually activation, and a composable tool that syncs audiences out is smaller and cheaper than a second platform holding a second copy. The question to settle first is which downstream tools will end up holding the data, because each one needs its own agreement.

What does a customer data platform for healthcare cost?

Almost none of them publish a price for regulated deployments. What you can compare is the cost structure: the base platform, the healthcare or regulated add-on where one exists, any private or dedicated hosting requirement, implementation and integration work, and the internal data quality effort nobody quotes. Ask for those five lines in writing and quotes that are otherwise incomparable become comparable.

About the Authors