Is Shopify HIPAA Compliant?

• Is Shopify HIPAA compliant? No — Shopify does not sign a BAA, so PHI does not belong in it at all.
• Shopify routinely touches PHI in a healthcare context — the moment a covered entity uses it, patient data is in scope.
• The newest risk is AI over MCP: Shopify now exposes an official MCP server and AI features that can pull that data into an LLM with no BAA behind it.
• A signed BAA (where one exists) covers the app’s core workflow — not the AI/MCP layer, integrations, or data leaving its boundary.
• Strac keeps PHI safe either way — detecting and redacting it on the MCP path, in the browser, and on the endpoint, and finding PHI already stored at rest.

✨ Is Shopify HIPAA Compliant? The Direct Answer

No. Shopify will not sign a BAA, and its Acceptable Use Policy affirmatively prohibits uploading PHI. Storing patient or health-order data in Shopify violates HIPAA and Shopify’s own terms — and Agentic Storefronts now pipe order data to third-party LLMs by default. HIPAA compliance is never automatic — it depends on a signed Business Associate Agreement with the vendor plus how you configure and use the tool. Below is exactly where Shopify stands, where PHI ends up, the AI/MCP gap most teams miss, and how to close it. Verified August 2026.

Does Shopify Sign a BAA?

Shopify’s Acceptable Use Policy lists uploading “Protected Health Information subject to HIPAA” as an unsupported activity, and Shopify will not sign a BAA with U.S.-based covered entities. The prohibition applies across every plan from Basic to Plus — there is no compliant tier.

Source: Shopify Acceptable Use Policy. Vendor terms change — reconfirm your plan’s eligibility in writing before sending PHI.

Where PHI Ends Up in Shopify

Even teams that never intend to handle PHI accumulate it in Shopify. The common places it lands:

• Pharmacy, telehealth, or supplement orders where the product implies a health condition (a prescription, diabetic supplies, an HIV self-test)
• Order notes or intake fields collecting symptoms or prescriptions
• Customer accounts linking an identifiable person to health-product purchase history
• Checkout data tied to a clinic or provider storefront

✨ The New Risk: Shopify + AI Agents via MCP

Shopify ships official Storefront and Customer Accounts MCP servers, and its Agentic Storefronts went live by default for eligible U.S. merchants in 2026 — making millions of stores discoverable inside ChatGPT, Microsoft Copilot, Google AI Mode, and Gemini. Sidekick and Shopify Magic add generative AI across plans, exposing order and customer data to external agents.

PHI in Shopify is a contractual violation, not merely “unsupported” — and Agentic Storefronts are on by default, piping order and customer data to third-party LLMs with no BAA in the chain. This is the leak path traditional HIPAA controls were never designed to see: the data does not breach outward, it is pulled inward by an AI agent on a legitimate, authenticated tool call. Read more on MCP data loss prevention and MCP DLP.

🎥 Why a Signed BAA Still Leaves a Gap

A BAA is a contract — it makes the vendor liable for the data it holds. It does not inspect your data, and it does not follow PHI into the AI features, integrations, or exports that sit outside its scope. Whether or not Shopify signs one, three gaps remain: PHI a user pastes or uploads where it should not go; PHI an AI agent pulls out over MCP; and PHI already sitting in Shopify that no one has found. Closing them needs data-layer DLP, not just paperwork.

✨ How Strac Protects PHI in Shopify

Because PHI should never be in Shopify in the first place, Strac works on both ends — stopping PHI from being entered and finding any that is already there:

• MCP DLP: Strac inspects every MCP tool call to and from Shopify and redacts PHI before it reaches Claude, ChatGPT, or any agent — so an AI assistant with no BAA never sees a patient identifier.
• Browser / GenAI DLP: Strac’s browser extension detects PHI as it is typed, pasted, or uploaded into Shopify or a GenAI tool and blocks, warns, or redacts it in real time.
• Endpoint DLP: When PHI is exported, downloaded, or copied from Shopify to a device, Strac’s Mac and Windows agent enforces at the file, USB, print, and upload channels.
• DSPM: Strac scans Shopify and connected stores to find PHI already sitting at rest, classifies it, and flags oversharing so you can remediate it.

✨ Remediation in Action: Redact, Block, Warn, Revoke

Detection alone does not stop a HIPAA violation — remediation does. Strac does not just alert; it acts the moment PHI appears:

• Redact: strip PHI from the message, ticket, record, or MCP response and vault the original for authorized access.
• Block: stop a PHI-bearing prompt, upload, or export before it leaves — in the browser and on the endpoint.
• Warn & coach: tell the employee in the moment why an action was risky, turning policy into training.
• Revoke access: when PHI is found oversharing in a connected store, Strac removes public and external access so no agent or person can reach it.

✨ One Platform Across Every Surface Shopify Touches

PHI does not stay inside Shopify. It flows into email, chat, cloud storage, GenAI tools, and AI agents — so point fixes leave gaps. Strac is one agentless-plus-endpoint platform covering SaaS, cloud, browser, GenAI, endpoint, and MCP under a single policy and classifier, live in minutes.

A Practical Shopify HIPAA Deployment Checklist

1. Contract: Do not enter PHI into Shopify — Intuit/Shopify will not sign a BAA. Treat any PHI as an incident.
2. Scope the AI/MCP layer: inventory whether Shopify’s MCP server and AI features are enabled, and confirm they are excluded from — or explicitly added to — your coverage.
3. Deploy Strac MCP DLP: put redaction in front of every Shopify MCP tool call so no agent receives raw PHI.
4. Deploy Browser + Endpoint DLP: block and redact PHI at entry and export across the web app and devices.
5. Run DSPM: scan Shopify for PHI already stored, classify it, and remediate oversharing.
6. Prove it: keep the audit log of every detection and remediation as HIPAA evidence.

Shopify HIPAA Compliance: Quick Reference

🌶️ Spicy FAQs for Is Shopify HIPAA Compliant

Is Shopify HIPAA compliant out of the box?

No tool is. Here it is worse — there is no BAA to sign, so PHI should never be entered.

Does Shopify’s BAA cover its AI and MCP features?

No. That is the single most common misread — the AI/MCP layer sits outside the core BAA and is the most likely place PHI leaks to a model.

Can an AI agent pull PHI out of Shopify?

Yes. Shopify’s official MCP server lets an agent read data on an authenticated tool call. Strac redacts PHI on that path before the agent sees it.

Is a BAA enough for HIPAA?

No. A BAA assigns liability; it does not inspect your data or follow PHI into AI, integrations, or exports. You still need data-layer DLP.

How does Strac help if we already use Shopify?

Strac layers on without slowing Shopify down — redacting PHI at the MCP layer, blocking it in the browser and on the endpoint, and finding PHI already stored via DSPM.

The Bottom Line

Shopify will not sign a BAA, so PHI does not belong in it — but PHI still ends up there, and its MCP server and AI agents can pull it into an LLM. Strac closes the gap on every surface — redacting PHI at the MCP layer, blocking it in the browser and on the endpoint, and finding what is already stored. Book a demo to see it on Shopify.