- Short answer
- Shopify's AUP doesn't support PHI uploads, and no Shopify page we checked (Oct 2026) offers a BAA or claims HIPAA compliance.
- Who HIPAA binds
- Covered entities and their business associates; HHS says other businesses don't have to comply.
- If HIPAA binds you
- HHS treats a cloud provider handling ePHI on your behalf as your business associate.
- Selling health products
- A separate question: Shopify Payments' list, which varies by region, bars prescription drugs and medical devices for stores using it.
- Your role
- Yours to confirm with a lawyer; Shopify's AUP puts following the law on you.
What does Shopify say about HIPAA?
Of the Shopify policies we read in October 2026, the one that names HIPAA is the Acceptable Use Policy, and it frames PHI as a business activity the platform does not support — not as a product ban and not as a compliance certificate:
You must likewise respect that certain business activities are not supported by our platform, such as uploading Protected Health Information subject to HIPAA.
No Shopify page we checked in October 2026 offers a business associate agreement (BAA) or claims HIPAA compliance or certification — we read the AUP, the Terms of Service, the Privacy Policy, the Data Processing Addendum, the Security page, the compliance reports page and the Help Center's privacy, checkout, Forms, customer accounts and Shopify Payments pages.
The compliance reports page lists PCI and SOC 3 documents, none for HIPAA. Card-data security is a separate regime, covered in what Shopify's PCI certification covers.
The AUP also says “you’re responsible for following the rules of your platform, your partners, and the law.” Whether HIPAA is part of that law for you depends on your role.
Does HIPAA apply to your Shopify store?
HIPAA is U.S. federal law, and its Privacy Rule protects individually identifiable health information “held or transmitted by a covered entity or its business associate.” HHS lists three kinds of covered entity:
- Health care providers
- Health plans
- Health care clearinghouses
A provider, under 45 CFR 160.103, is anyone who “furnishes, bills, or is paid for health care in the normal course of business” — but it is a covered entity only if it transmits health information electronically in connection with a covered transaction. HHS adds that using email alone does not make a provider a covered entity.
Outside those roles, HHS states the boundary plainly:
If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules.
HHS also says the law does not give it authority to regulate other types of private businesses through this regulation. Whether your store is a provider, a plan, a clearinghouse or a business associate is a legal conclusion, so confirm your role with a lawyer.
What should you do with customer health data?
What the sources ask of you depends on which side of that test you are on:
- HHS treats a cloud provider that handles ePHI on your behalf as your business associate, and allows that service only with a BAA; no Shopify page we checked in October 2026 offers one.
- If an app sits in the flow, HHS publishes guidance on when an app developer may be acting as a business associate.
- If you are neither a covered entity nor a business associate, HHS says you do not have to comply with the HIPAA Rules.
- Even without HIPAA, where U.S. data protection laws apply and require it, and Shopify acts as your data processor or service provider, Appendix D of Shopify’s Data Processing Addendum has you warrant that you won’t share sensitive personal data with Shopify unless the person consented as applicable data protection laws require.
- Shopify’s Help Center says never to upload documents with sensitive information about your customers to Content > Files.
Can you sell health products on Shopify?
On products, the AUP bans those that “facilitate intentional self-harm” and says “You can’t use Shopify to do anything that’s illegal where you do business.” The rest is set by rulebooks that each govern a different part of the store; the mechanism is laid out in which Shopify rulebook applies to your product.
Shopify rules on health products
| Rulebook | What it names for health products | Who it binds |
|---|---|---|
| Acceptable Use Policy | Self-harm products; anything illegal where you do business; PHI uploads, as an unsupported activity | Every store |
| Shopify Payments | Prescription drugs, medical devices, pseudo pharmaceuticals | Shopify Payments stores; varies by region |
| Shop channel | Medication, medical devices and accessories | Products sold through Shop |
| Managed Markets | Ingestibles, FDA-classified medical devices and items with health, medical or wellness claims (restricted) | Managed Markets sales |
Read on Shopify's live pages, October 15, 2026.
Shopify Payments' prohibited list says it isn't exhaustive and varies by region. If you aren't eligible, you can add a third-party payment provider.
The Shop channel and Managed Markets lists apply only where you sell through them. Expect challenges from outside Shopify too: the AUP says most product eligibility or takedown disputes “originate from outside Shopify, including from regulators and third-party IP rights holders.”
This page was written by AI. Separate AI agents that did not write it check its figures and claims against official sources and test its links and interactive tools. A human editor sets the site's editorial direction, topics and rules and checks that pages are complete and display correctly, but does not check their facts or edit their text. Details may change — always confirm critical data at shopify.com.
Editorial Policy