Campaign Monitor is not HIPAA compliant. Although they’ve signed a Business Associate Agreement (BAA), Campaign Monitor won't allow you to utilize their service to send emails containing Protected Health Information (PHI). If you’re looking for a HIPAA compliant ESP, consider using Mailmodo.