BAA Directory
Does it sign a BAA? A directory of 120 healthcare marketing tools
A HIPAA covered entity needs a business associate agreement (BAA) with any vendor that handles its patients' Protected Health Information. This directory answers one question for 120 common healthcare marketing and operations tools: does the vendor sign a BAA, and on which plans? Every answer quotes the vendor's own page, links to it and shows the date we checked.
Curve Compliance signs a BAA on every plan. Curve's team sets up HIPAA-compliant, server-side conversion tracking for you in about a week, so your ad platforms get the conversions they optimize on without a pixel carrying patient data. Book a call.
The directory
Curve Compliance first, then 120 tools in alphabetical order. Select a tool for the vendor's own words, the source link and what the answer means for your ad tracking.
Showing 120 of 120 tools, plus Curve Compliance.
| Tool | Category | Answer | Conditions | Last checked |
|---|---|---|---|---|
| Curve Compliance | HIPAA ad tracking | Signs a BAA on every plan | Every plan: Compliance, Growth and Enterprise | |
| ActiveCampaign | CRM and email | Signs a BAA on specific plans | Eligible plans; Enterprise named by ActiveCampaign | |
| Acuity Scheduling | Scheduling and intake | Signs a BAA on specific plans | Powerhouse and Premium plans; custom BAAs on Enterprise | |
| Adobe Acrobat Sign | Forms and landing pages | Signs a BAA on specific plans | Enterprise or business plans; eligibility confirmed by Adobe | |
| Adobe Marketo Engage | CRM and email | Signs a BAA on specific plans | HIPAA-Ready license and signed BAA | |
| Airtable | Automation and workspace | Signs a BAA on specific plans | Enterprise Scale plans | |
| Amazon SES | CRM and email | Signs a BAA | Under the AWS BAA; SES is a HIPAA Eligible Service | |
| Amazon Web Services (AWS) | Automation and workspace | Signs a BAA | Accepted in AWS Artifact; HIPAA-eligible services only | |
| Amplitude | Analytics and data | Signs a BAA | BAA through Amplitude; AI features covered | |
| Asana | Automation and workspace | Signs a BAA on specific plans | Enterprise+ tier; Legacy Enterprise only if already enabled | |
| Attentive | Video, reviews and SMS | Does not sign a BAA | Content Policy bars PHI | |
| Birdeye | Video, reviews and SMS | Signs a BAA | Birdeye For Local Business and Enterprise services | |
| Box | Automation and workspace | Signs a BAA on specific plans | Enterprise, Enterprise Plus or Enterprise Advanced accounts | |
| Braze | CRM and email | Signs a BAA on specific plans | HIPAA-eligible instance named on the Order Form | |
| Brevo | CRM and email | Does not sign a BAA | Terms of Use: not for HIPAA communications | |
| Calendly | Scheduling and intake | Does not sign a BAA | No BAA offered on any plan | |
| CallRail | Call tracking and phones | Signs a BAA on specific plans | Healthcare plans | |
| CallTrackingMetrics | Call tracking and phones | Signs a BAA on specific plans | Marketing Pro plan and above | |
| Canva | Automation and workspace | No public statement | No BAA statement found | |
| ChatGPT | AI assistants | Signs a BAA on specific plans | OpenAI API; sales-managed ChatGPT Enterprise or Edu | |
| Claude | AI assistants | Signs a BAA on specific plans | First-party API and HIPAA-ready Claude Enterprise | |
| Cognito Forms | Forms and landing pages | Signs a BAA on specific plans | Enterprise plan, not a trial | |
| Constant Contact | CRM and email | Signs a BAA | Standard BAA on request; contact details only | |
| Customer.io | CRM and email | Signs a BAA on specific plans | Premium and Enterprise plans | |
| Docusign | Forms and landing pages | Signs a BAA on specific plans | Enhanced plans, through sales | |
| Doxy.me | Video, reviews and SMS | Signs a BAA | All plans; Clinic BAA for groups | |
| Drift | Support and chat | Does not sign a BAA | Terms bar HIPAA-regulated data | |
| Dropbox | Automation and workspace | Signs a BAA on specific plans | Team plans such as Standard, Advanced, Business and Enterprise | |
| FaceTime | Video, reviews and SMS | Does not sign a BAA | License bars PHI and business associate use | |
| Formstack | Forms and landing pages | Signs a BAA on specific plans | Formstack Forms HIPAA plans | |
| FullStory | Analytics and data | Signs a BAA | BAA available; health data still prohibited | |
| Gemini | AI assistants | Signs a BAA on specific plans | Google Workspace accounts: Gemini app as a Workspace Core Service and Gemini in Workspace | |
| Gmail | Automation and workspace | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| GoHighLevel | CRM and email | Signs a BAA on specific plans | Paid HIPAA Compliance add-on, any agency plan | |
| Google Ads | Ad platforms | Does not sign a BAA | Google Ads call terms disclaim HIPAA | |
| Google Analytics 4 | Analytics and data | Does not sign a BAA | No BAA for Google Analytics | |
| Google Cloud | Automation and workspace | Signs a BAA | Google Cloud BAA; listed supported products | |
| Google Drive | Automation and workspace | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Forms | Forms and landing pages | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Meet | Video, reviews and SMS | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Tag Manager | Analytics and data | No public statement | Use Policy bars personally identifying data | |
| Google Voice | Call tracking and phones | Signs a BAA on specific plans | Licensed users managed in Google Workspace | |
| Google Workspace | Automation and workspace | Signs a BAA | Covered services such as Gmail, Drive and Meet | |
| Grammarly | Automation and workspace | Signs a BAA on specific plans | Grammarly for Business Enterprise plans | |
| Gravity Forms | Forms and landing pages | Does not sign a BAA | Will not sign; your host holds the data | |
| Healthie | Scheduling and intake | Signs a BAA | Entered into when your account is created | |
| Heap | Analytics and data | Signs a BAA | BAA through Heap | |
| Hotjar | Analytics and data | No public statement | No BAA statement found | |
| HubSpot | CRM and email | Signs a BAA on specific plans | Enterprise subscriptions with Sensitive Data enabled | |
| iCloud | Automation and workspace | Does not sign a BAA | Terms bar PHI and business associate use | |
| iMessage | Messaging and payments | Does not sign a BAA | License bars PHI and business associate use | |
| IntakeQ | Scheduling and intake | Signs a BAA | Signed in the account by the admin | |
| Intercom | Support and chat | Signs a BAA on specific plans | Expert plan | |
| Invoca | Call tracking and phones | Signs a BAA | Standard BAA, or the customer's own on review | |
| Iterable | CRM and email | No public statement | HIPAA compliance listed; no BAA statement found | |
| Jane App | Scheduling and intake | Signs a BAA | BAA arranged with Jane | |
| Jotform | Forms and landing pages | Signs a BAA on specific plans | Gold and Enterprise, with HIPAA features enabled | |
| Keap | CRM and email | Signs a BAA | Standard BAA after enabling HIPAA controls | |
| Klaviyo | CRM and email | Does not sign a BAA | Acceptable Use Policy bars PHI | |
| LinkedIn Ads | Ad platforms | Does not sign a BAA | Ads Agreement bars Sensitive Data, including medical | |
| Looker Studio | Analytics and data | Signs a BAA | Under the Google Cloud Platform BAA | |
| Mailchimp | CRM and email | Does not sign a BAA | Data Processing Addendum bars health information | |
| Mailgun | CRM and email | Signs a BAA | HIPAA Addendum to the Mailgun Terms of Service | |
| Make.com | Automation and workspace | No public statement | No BAA statement found | |
| Meta | Ad platforms | Does not sign a BAA | Business Tools Terms bar health information | |
| Microsoft 365 | Automation and workspace | Signs a BAA | By default through Microsoft's Data Protection Addendum; in-scope services | |
| Microsoft Advertising | Ad platforms | Does not sign a BAA | No BAA for UET; keep UET off HIPAA pages | |
| Microsoft Azure | Automation and workspace | Signs a BAA | By default through the Microsoft Product Terms; in-scope Azure services | |
| Microsoft Clarity | Analytics and data | Does not sign a BAA | Terms bar health care content | |
| Microsoft Copilot | AI assistants | Signs a BAA on specific plans | Work or school (Microsoft Entra) accounts on Office 365 Commercial or GCC; web search queries excluded | |
| Microsoft Forms | Forms and landing pages | Signs a BAA on specific plans | Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum | |
| Microsoft Teams | Video, reviews and SMS | Signs a BAA on specific plans | Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum | |
| Mixpanel | Analytics and data | Signs a BAA on specific plans | Enterprise Plan | |
| monday.com | Automation and workspace | Signs a BAA on specific plans | Enterprise plan with the HIPAA compliance feature enabled | |
| Notion | Automation and workspace | Signs a BAA on specific plans | Enterprise Plan; Beta Services excluded | |
| Otter.ai | AI assistants | Signs a BAA on specific plans | Enterprise plan | |
| Outlook | Automation and workspace | Signs a BAA on specific plans | Exchange Online on Office 365 Commercial or GCC subscriptions | |
| PayPal | Messaging and payments | No public statement | No BAA statement found; PHI barred in Invoicing | |
| Pinterest Ads | Ad platforms | Does not sign a BAA | Ad Data Terms bar sensitive categories | |
| Pipedrive | CRM and email | Does not sign a BAA | Terms: not designed for HIPAA; sensitive information barred | |
| Podium | Video, reviews and SMS | Signs a BAA | Covered entities and business associates, under Podium's terms | |
| PostHog | Analytics and data | Signs a BAA on specific plans | PostHog Cloud on Boost, Scale or Enterprise | |
| Postmark | CRM and email | Does not sign a BAA | Not HIPAA-compliant; cannot sign BAAs | |
| QuickBooks | Messaging and payments | Does not sign a BAA | QuickBooks Online: not HIPAA compliant; health information not recommended | |
| Reddit Ads | Ad platforms | Does not sign a BAA | Business Tool Terms bar health information | |
| RingCentral | Call tracking and phones | Signs a BAA | Paying customers; listed services such as RingEX and RingCX | |
| Salesforce | CRM and email | Signs a BAA on specific plans | HIPAA Covered Services only, such as Sales Cloud and Marketing Cloud Engagement | |
| SendGrid | CRM and email | Does not sign a BAA | Not HIPAA eligible; no BAA for SendGrid | |
| Shopify | Site builders | Does not sign a BAA | Acceptable Use Policy: PHI not supported | |
| Signal | Messaging and payments | No public statement | No BAA statement found | |
| SimplePractice | Scheduling and intake | Signs a BAA | Agreed at signup; carries over to paid plans | |
| Slack | Automation and workspace | Signs a BAA on specific plans | Enterprise-level plan plus the Slack HIPAA Enabled SKU | |
| Smartsheet | Automation and workspace | Signs a BAA on specific plans | Enterprise plan, excluding Legacy Enterprise | |
| Snapchat Ads | Ad platforms | Does not sign a BAA | Personal Data Terms bar health information | |
| Square | Scheduling and intake | Signs a BAA | Square Appointments, Invoices and other features Square identifies as HIPAA-enabled | |
| Squarespace | Site builders | Does not sign a BAA | BAA covers Acuity only, not website features | |
| Stripe | Messaging and payments | No public statement | No BAA statement found; PHI barred in Third Party Data | |
| Tableau | Analytics and data | Signs a BAA on specific plans | Tableau Cloud and Tableau Next | |
| Tebra | Scheduling and intake | Signs a BAA | Part of the Terms of Service for covered entities | |
| Telegram | Messaging and payments | No public statement | No BAA statement found | |
| TikTok | Ad platforms | Does not sign a BAA | Business terms bar health information | |
| Trello | Automation and workspace | No public statement | Not on Atlassian's BAA product list; PHI barred without a BAA | |
| Twilio | Messaging and payments | Signs a BAA on specific plans | Security or Enterprise Edition; HIPAA-eligible products | |
| Twilio Segment | Analytics and data | Signs a BAA on specific plans | Business Tier plan | |
| Typeform | Forms and landing pages | Signs a BAA on specific plans | Enterprise and Growth Custom plans | |
| Unbounce | Forms and landing pages | No public statement | No BAA statement found | |
| Venmo | Messaging and payments | No public statement | No BAA statement found | |
| Vimeo | Video, reviews and SMS | Signs a BAA on specific plans | Eligible Vimeo Enterprise plans | |
| Weave | Call tracking and phones | Signs a BAA | Business Associate Addendum with every client | |
| Webflow | Site builders | Does not sign a BAA | Terms: no HIPAA compliant services | |
| WhatConverts | Call tracking and phones | Signs a BAA on specific plans | Pro and Elite plans | |
| Messaging and payments | Does not sign a BAA | Business Platform terms: not HIPAA compliant | ||
| Wistia | Video, reviews and SMS | Does not sign a BAA | Not HIPAA compliant; does not sign BAAs | |
| Wix | Site builders | Signs a BAA on specific plans | Business, Plus, Elite, Business Elite and Enterprise plans | |
| WordPress.com | Site builders | No public statement | No BAA statement found | |
| Wufoo | Forms and landing pages | No public statement | No Wufoo BAA statement found; PHI barred without a separate BAA | |
| Zapier | Automation and workspace | Does not sign a BAA | Can't sign BAAs; PHI not supported | |
| Zendesk | Support and chat | Signs a BAA on specific plans | Advanced Compliance: Suite Professional, Enterprise or Enterprise Plus | |
| Zocdoc | Scheduling and intake | No public statement | Ask Zocdoc directly | |
| Zoho CRM | CRM and email | Signs a BAA | BAA on request; HIPAA settings on paid editions, not Free | |
| Zoom | Video, reviews and SMS | Signs a BAA on specific plans | Paid plans such as Pro, Business, Business Plus and Enterprise |
On this page
What each answer means
- Signs a BAA. The vendor's own page says it signs a BAA with healthcare customers.
- Signs a BAA on specific plans. The vendor signs a BAA only on the plans, editions or products it names, and those are listed with the answer.
- Does not sign a BAA. The vendor's own page says it does not sign a BAA, or that its service is not for health information.
- No public statement. We could not find a statement about a BAA on the vendor's own pages that we could quote.
Curve Compliance signs a BAA on every plan. Its own page says: “A signed BAA on every plan” (source).
A BAA covers the vendor, not your ad pixels
A BAA is a contract between you and one vendor. It covers the Protected Health Information that vendor handles for you. When a scheduling tool, form builder or CRM signs a BAA, the data inside that tool is covered. A Meta, Google Ads or TikTok pixel on the same page sends data to a different company, and that company is not a party to the BAA.
The ad platforms are clear about health data. Meta's Business Tools Terms say you will not share data that includes or is based on health information. TikTok says it does not allow advertisers to share health information. Google says it does not offer Business Associate Agreements for Google Analytics, and that it does not intend its Google Ads call features to create HIPAA obligations.
That leaves the conversion itself: the booking, the form fill or the purchase your campaigns learn from. It has to reach the ad platform without health information, from a service that is covered by a BAA with you.
How to read an entry
- The answer comes first, in one sentence, with the plans or products it depends on.
- The vendor's own words follow, quoted exactly, with a link to the page and the date we checked it.
- Where the vendor says what its BAA covers or leaves out, that is listed next.
- Each entry then explains what the answer means for your ad tracking and conversion data, and how Curve helps.
- Vendors change their plans and terms. Confirm the current terms with the vendor before you send it patient data.
How Curve helps
- Curve tracks conversions server-side in place of pixels, so they reach Meta, Google Ads, TikTok and your other ad platforms from Curve's server, not from the patient's browser.
- Curve checks every event for PHI-like patterns before it goes out, and its neutral event names keep conditions and treatments out of what the platforms see.
- Curve hashes identifiers with SHA-256 to each platform's requirements.
- Curve keeps attribution through booking tools, so a booked appointment is credited to the ad that brought the patient in.
- Curve adds consent management to your site, alongside the tracking.
- Curve signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you in about a week.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Which marketing tools sign a BAA?
Of the 120 tools in this directory, 26 sign a BAA and 49 sign one only on specific plans, editions or products, such as HubSpot on Enterprise subscriptions, Intercom on its Expert plan and Twilio on Security or Enterprise Edition. 30 do not sign one, and for 15 we could not find a statement to quote. Curve Compliance signs a BAA on every plan.
Do Meta, Google and TikTok sign a BAA?
No. Meta's Business Tools Terms say you will not share data that includes or is based on health information. TikTok says it does not allow advertisers to share health information. Google says it does not offer Business Associate Agreements for Google Analytics and does not intend its Google Ads call features to create HIPAA obligations. Curve sends conversions to these platforms server-side, with neutral event names and SHA-256 hashed identifiers.
Does a BAA with my scheduling or form tool cover my ad pixels?
No. A BAA covers the data one vendor handles for you. A pixel sends data from the visitor's browser to Meta, Google or TikTok, and none of them is a party to that BAA.
What does No public statement mean?
It means we could not find a statement about a BAA on the vendor's own pages that we could quote. It is not a yes. Until a vendor signs a BAA with you, keep Protected Health Information out of it.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.
Last checked .
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call