Constant Contact is HIPAA compliant because it will sign a BAA. However, the BAA does not allow you to transmit PHI.