BAA Directory
Does it sign a BAA? A directory of 192 healthcare marketing tools
A HIPAA covered entity needs a business associate agreement (BAA) with any vendor that handles its patients' Protected Health Information. This directory answers one question for 192 common healthcare marketing and operations tools: does the vendor sign a BAA, and on which plans? Every answer quotes the vendor's own page, links to it and shows the date we checked.
Curve Compliance signs a BAA on every plan. Curve's team sets up HIPAA-compliant, server-side conversion tracking for you in about a week, so your ad platforms get the conversions they optimize on without a pixel carrying patient data. Book a call.
The directory
Curve Compliance first, then 192 tools in alphabetical order. Select a tool for the vendor's own words, the source link and what the answer means for your ad tracking. For the numbers, read the BAA Directory report; to check several tools at once, use the BAA stack checker; for a tool that isn't listed, ask the vendor for a BAA.
Showing 192 of 192 tools, plus Curve Compliance.
| Tool | Category | Answer | Conditions | Last checked |
|---|---|---|---|---|
| Curve Compliance | HIPAA ad tracking | Signs a BAA on every plan | Every plan: Compliance, Growth and Enterprise | |
| Abridge | AI assistants | Signs a BAA | Healthcare customers such as hospitals and health systems, under their customer agreements | |
| ActiveCampaign | CRM and email | Signs a BAA on specific plans | Eligible plans; Enterprise named by ActiveCampaign | |
| Acuity Scheduling | Scheduling and intake | Signs a BAA on specific plans | Powerhouse and Premium plans; custom BAAs on Enterprise | |
| Adobe Acrobat Sign | Forms and landing pages | Signs a BAA on specific plans | Enterprise or business plans; eligibility confirmed by Adobe | |
| Adobe Marketo Engage | CRM and email | Signs a BAA on specific plans | HIPAA-Ready license and signed BAA | |
| Airtable | Automation and workspace | Signs a BAA on specific plans | Enterprise Scale plans | |
| Amazon SES | CRM and email | Signs a BAA | Under the AWS BAA; SES is a HIPAA Eligible Service | |
| Amazon Web Services (AWS) | Automation and workspace | Signs a BAA | Accepted in AWS Artifact; HIPAA-eligible services only | |
| Amplitude | Analytics and data | Signs a BAA | BAA through Amplitude; AI features covered | |
| Asana | Automation and workspace | Signs a BAA on specific plans | Enterprise+ tier; Legacy Enterprise only if already enabled | |
| Attentive | Video, reviews and SMS | Does not sign a BAA | Content Policy bars PHI | |
| Birdeye | Video, reviews and SMS | Signs a BAA | Birdeye For Local Business and Enterprise services | |
| Boulevard | Scheduling and intake | Signs a BAA on specific plans | HIPAA Coverage add-on, also included in the Medspa Add-on | |
| Box | Automation and workspace | Signs a BAA on specific plans | Enterprise, Enterprise Plus or Enterprise Advanced accounts | |
| Braze | CRM and email | Signs a BAA on specific plans | HIPAA-eligible instance named on the Order Form | |
| Brevo | CRM and email | Does not sign a BAA | Terms of Use: not for HIPAA communications | |
| Cal.com | Scheduling and intake | Signs a BAA on specific plans | Enterprise and Organizations (15+ users); add-on on lower plans | |
| Calendly | Scheduling and intake | Does not sign a BAA | No BAA offered on any plan | |
| CallRail | Call tracking and phones | Signs a BAA on specific plans | Healthcare plans | |
| CallTrackingMetrics | Call tracking and phones | Signs a BAA on specific plans | Marketing Pro plan and above | |
| Canva | Automation and workspace | No public statement | No BAA statement found | |
| Carepatron | Scheduling and intake | Signs a BAA | Every account; the BAA takes effect when the account is created | |
| ChatGPT | AI assistants | Signs a BAA on specific plans | ChatGPT for Healthcare, Enterprise with Regulated Workspace, FedRAMP or Clinicians; API with Modified Retention | |
| Claude | AI assistants | Signs a BAA on specific plans | First-party API, Claude in Microsoft Foundry and HIPAA-ready Claude Enterprise | |
| ClickUp | Automation and workspace | Signs a BAA on specific plans | Enterprise plan | |
| Cloudflare | Automation and workspace | Signs a BAA on specific plans | Enterprise customers | |
| Cloudflare Zaraz | HIPAA ad tracking | Signs a BAA on specific plans | Enterprise customers | |
| Cognito Forms | Forms and landing pages | Signs a BAA on specific plans | Enterprise plan, not a trial | |
| Cometly | Analytics and data | No public statement | Terms bar PHI in Events and every other feature | |
| Constant Contact | CRM and email | Signs a BAA | Standard BAA on request; contact details only | |
| Crazy Egg | Analytics and data | No public statement | HIPAA compliance and a DPA listed; no BAA statement found | |
| Customer.io | CRM and email | Signs a BAA on specific plans | Premium and Enterprise plans | |
| CustomerLabs | HIPAA ad tracking | Signs a BAA | Annex F of its DPA, when customer data includes PHI | |
| Dialpad | Call tracking and phones | Signs a BAA on specific plans | All paid accounts; signed by a Company Admin | |
| Documo (mFax) | Messaging and payments | Signs a BAA | Every plan; one BAA covers all Documo products | |
| Docusign | Forms and landing pages | Signs a BAA on specific plans | Enhanced plans, through sales | |
| Doximity | Video, reviews and SMS | Signs a BAA | BAA incorporated into its Terms of Service; tools Doximity identifies as secure | |
| Doxy.me | Video, reviews and SMS | Signs a BAA | All plans; Clinic BAA for groups | |
| Drift | Support and chat | Does not sign a BAA | Terms bar HIPAA-regulated data | |
| Dropbox | Automation and workspace | Signs a BAA on specific plans | Team plans such as Standard, Advanced, Business and Enterprise | |
| eFax | Messaging and payments | Signs a BAA on specific plans | eFax Business, eFax Corporate and eFax Unite | |
| Elevar (now Audiense Online) | Analytics and data | No public statement | Terms bar customers from providing PHI | |
| FaceTime | Video, reviews and SMS | Does not sign a BAA | License bars PHI and business associate use | |
| Fax.Plus | Messaging and payments | Signs a BAA on specific plans | Enterprise plan, with Advanced Security Controls | |
| Feathery | Forms and landing pages | No public statement | No BAA statement found | |
| Fireflies.ai | AI assistants | Signs a BAA on specific plans | Enterprise plan with Private Storage | |
| FormDr | Forms and landing pages | Signs a BAA | Every plan | |
| Formsort | Forms and landing pages | Signs a BAA on specific plans | Enterprise clients; HIPAA compliance listed on the Enterprise plan | |
| Formstack | Forms and landing pages | Signs a BAA on specific plans | Formstack Forms HIPAA plans | |
| Freed | AI assistants | Signs a BAA | Included in the platform Terms of Use; signed copy on request | |
| Freshpaint | HIPAA ad tracking | Signs a BAA | BAA in place before any PHI | |
| FullStory | Analytics and data | Signs a BAA | BAA available; health data still prohibited | |
| Gemini | AI assistants | Signs a BAA on specific plans | Google Workspace accounts: Gemini app as a Workspace Core Service and Gemini in Workspace | |
| Gmail | Automation and workspace | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| GoDaddy | Site builders | Signs a BAA on specific plans | Microsoft 365 email from GoDaddy, with HIPAA compliant email | |
| GoHighLevel | CRM and email | Signs a BAA on specific plans | Paid HIPAA Compliance add-on, any agency plan | |
| Google Ads | Ad platforms | Does not sign a BAA | Google Ads call terms disclaim HIPAA | |
| Google Analytics 4 | Analytics and data | Does not sign a BAA | No BAA for Google Analytics | |
| Google Calendar | Scheduling and intake | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Cloud | Automation and workspace | Signs a BAA | Google Cloud BAA; listed supported products | |
| Google Docs | Automation and workspace | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Drive | Automation and workspace | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Forms | Forms and landing pages | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Meet | Video, reviews and SMS | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Sheets | Automation and workspace | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Tag Manager | Analytics and data | No public statement | Use Policy bars personally identifying data | |
| Google Voice | Call tracking and phones | Signs a BAA on specific plans | Licensed users managed in Google Workspace | |
| Google Workspace | Automation and workspace | Signs a BAA | Covered services such as Gmail, Drive and Meet | |
| Grammarly | Automation and workspace | Signs a BAA on specific plans | Grammarly for Business Enterprise plans | |
| Grasshopper | Call tracking and phones | Does not sign a BAA | Says it is not HIPAA compliant; BAA requests go to Contact Support | |
| Gravity Forms | Forms and landing pages | Does not sign a BAA | Will not sign; your host holds the data | |
| Healthie | Scheduling and intake | Signs a BAA | Entered into when your account is created | |
| Heap | Analytics and data | Signs a BAA | BAA through Heap | |
| Heidi | AI assistants | Signs a BAA | Every covered entity Heidi works with | |
| Hightouch | Analytics and data | Signs a BAA on specific plans | Customer Data Platform and AI Decisioning plans | |
| HIPAAtizer | Forms and landing pages | Signs a BAA | BAA accepted in the product | |
| Hotjar | Analytics and data | No public statement | No BAA statement found | |
| HubSpot | CRM and email | Signs a BAA on specific plans | Enterprise subscriptions with Sensitive Data enabled | |
| Hushmail | CRM and email | Signs a BAA on specific plans | Hushmail for Healthcare plans (Basic, Essentials, Growth) and Hushmail for Professionals | |
| iCloud | Automation and workspace | Does not sign a BAA | Terms bar PHI and business associate use | |
| iMessage | Messaging and payments | Does not sign a BAA | License bars PHI and business associate use | |
| IntakeQ | Scheduling and intake | Signs a BAA | Signed in the account by the admin | |
| Intercom | Support and chat | Signs a BAA on specific plans | Expert plan | |
| Invoca | Call tracking and phones | Signs a BAA | Standard BAA, or the customer's own on review | |
| Iterable | CRM and email | No public statement | HIPAA compliance listed; no BAA statement found | |
| Jane App | Scheduling and intake | Signs a BAA | BAA arranged with Jane | |
| JENTIS | HIPAA ad tracking | No public statement | No BAA statement found | |
| Jira | Automation and workspace | Signs a BAA on specific plans | Standard, Premium and Enterprise plans; covers Jira, Jira Service Management and Confluence | |
| Jotform | Forms and landing pages | Signs a BAA on specific plans | Gold and Enterprise, with HIPAA features enabled | |
| Keap | CRM and email | Signs a BAA | Standard BAA after enabling HIPAA controls | |
| Klaviyo | CRM and email | Does not sign a BAA | Acceptable Use Policy bars PHI | |
| Liine | Call tracking and phones | Signs a BAA | BAA attached to its Terms of Service | |
| LinkedIn Ads | Ad platforms | Does not sign a BAA | Ads Agreement bars Sensitive Data, including medical | |
| Looker Studio | Analytics and data | Signs a BAA | Under the Google Cloud Platform BAA | |
| Loom | Video, reviews and SMS | Does not sign a BAA | Not able to sign BAAs; keep PHI out | |
| Lucky Orange | Analytics and data | No public statement | DPA bars sensitive data unless agreed in writing; no BAA statement found | |
| Mailchimp | CRM and email | Does not sign a BAA | Data Processing Addendum bars health information | |
| Mailgun | CRM and email | Signs a BAA | HIPAA Addendum to the Mailgun Terms of Service | |
| Make.com | Automation and workspace | No public statement | No BAA statement found | |
| Matomo | Analytics and data | Does not sign a BAA | Cloud not HIPAA compliant; no BAA for self-hosted | |
| Meta | Ad platforms | Does not sign a BAA | Business Tools Terms bar health information | |
| Microsoft 365 | Automation and workspace | Signs a BAA | By default through Microsoft's Data Protection Addendum; in-scope services | |
| Microsoft Advertising | Ad platforms | Does not sign a BAA | No BAA for UET; keep UET off HIPAA pages | |
| Microsoft Azure | Automation and workspace | Signs a BAA | By default through the Microsoft Product Terms; in-scope Azure services | |
| Microsoft Clarity | Analytics and data | Does not sign a BAA | Terms bar health care content | |
| Microsoft Copilot | AI assistants | Signs a BAA on specific plans | Work or school (Microsoft Entra) accounts on Office 365 Commercial or GCC; web search queries excluded | |
| Microsoft Forms | Forms and landing pages | Signs a BAA on specific plans | Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum | |
| Microsoft Teams | Video, reviews and SMS | Signs a BAA on specific plans | Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum | |
| Mindbody | Scheduling and intake | Signs a BAA | On request for US businesses subject to HIPAA; covers SOAP Notes and Progress Notes only | |
| Mixpanel | Analytics and data | Signs a BAA on specific plans | Enterprise Plan | |
| monday.com | Automation and workspace | Signs a BAA on specific plans | Enterprise plan with the HIPAA compliance feature enabled | |
| Mouseflow | Analytics and data | Signs a BAA on specific plans | Enterprise plans, on negotiated terms | |
| n8n | Automation and workspace | No public statement | No BAA statement found | |
| Nextiva | Call tracking and phones | Signs a BAA | Covered services | |
| Northbeam | Analytics and data | Does not sign a BAA | Terms bar Personal Health Information | |
| Notion | Automation and workspace | Signs a BAA on specific plans | Enterprise Plan; Beta Services excluded | |
| OnceHub | Scheduling and intake | Signs a BAA on specific plans | Security and Compliance Add-On on a paid plan; included on Enterprise | |
| OneDrive | Automation and workspace | Signs a BAA on specific plans | OneDrive for Business on Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum | |
| OpenEvidence | AI assistants | Signs a BAA | Healthcare providers that are covered entities; BAA is part of the Terms of Use | |
| Optimizely | Analytics and data | Signs a BAA on specific plans | Enterprise customers; HIPAA-ready CMS and Web and Feature Experimentation | |
| Otter.ai | AI assistants | Signs a BAA on specific plans | Enterprise plan | |
| Outlook | Automation and workspace | Signs a BAA on specific plans | Exchange Online on Office 365 Commercial or GCC subscriptions | |
| PandaDoc | Forms and landing pages | Signs a BAA on specific plans | Annual Enterprise plans; request through PandaDoc support or sales | |
| Paubox | CRM and email | Signs a BAA | All accounts | |
| PayPal | Messaging and payments | No public statement | No BAA statement found; PHI barred in Invoicing | |
| Pendo | Analytics and data | Signs a BAA | HIPAA customers | |
| Pinterest Ads | Ad platforms | Does not sign a BAA | Ad Data Terms bar sensitive categories | |
| Pipedrive | CRM and email | Does not sign a BAA | Terms: not designed for HIPAA; sensitive information barred | |
| Piwik PRO | Analytics and data | Signs a BAA on specific plans | Enterprise plan: Trusted Insights and Secure Intelligence tiers | |
| Plaud | AI assistants | Signs a BAA | On request, through Plaud's privacy team | |
| Podium | Video, reviews and SMS | Signs a BAA | Covered entities and business associates, under Podium's terms | |
| PostHog | Analytics and data | Signs a BAA on specific plans | PostHog Cloud on Boost, Scale or Enterprise | |
| Postmark | CRM and email | Does not sign a BAA | Not HIPAA-compliant; cannot sign BAAs | |
| Profound | Analytics and data | No public statement | No BAA statement found | |
| Proton Mail | CRM and email | Signs a BAA | Signed on request; contact Proton | |
| Qualtrics | Forms and landing pages | Signs a BAA | On request, for customers who are covered entities | |
| QuickBooks | Messaging and payments | Does not sign a BAA | QuickBooks Online: not HIPAA compliant; health information not recommended | |
| Quo (OpenPhone) | Call tracking and phones | Signs a BAA on specific plans | Business and Scale plans; texting and integrations excluded | |
| REDCap | Forms and landing pages | Does not sign a BAA | Self-hosted software; the BAA is with your hosting provider | |
| Reddit Ads | Ad platforms | Does not sign a BAA | Business Tool Terms bar health information | |
| RingCentral | Call tracking and phones | Signs a BAA | Paying customers; listed services such as RingEX and RingCX | |
| RudderStack | Analytics and data | Signs a BAA on specific plans | Enterprise plan | |
| Salesforce | CRM and email | Signs a BAA on specific plans | HIPAA Covered Services only, such as Sales Cloud and Marketing Cloud Engagement | |
| SendGrid | CRM and email | Does not sign a BAA | Not HIPAA eligible; no BAA for SendGrid | |
| ShareFile | Automation and workspace | Signs a BAA on specific plans | Premium, Enterprise and Virtual Data Room plans, with a signed BAA | |
| SharePoint | Automation and workspace | Signs a BAA on specific plans | SharePoint Online on Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum | |
| Shopify | Site builders | Does not sign a BAA | Acceptable Use Policy: PHI not supported | |
| Signal | Messaging and payments | No public statement | No BAA statement found | |
| SimplePractice | Scheduling and intake | Signs a BAA | Agreed at signup; carries over to paid plans | |
| Slack | Automation and workspace | Signs a BAA on specific plans | Enterprise-level plan plus the Slack HIPAA Enabled SKU | |
| Smartsheet | Automation and workspace | Signs a BAA on specific plans | Enterprise plan, excluding Legacy Enterprise | |
| Snapchat Ads | Ad platforms | Does not sign a BAA | Personal Data Terms bar health information | |
| Snowflake | Analytics and data | Signs a BAA on specific plans | Business Critical Edition and Virtual Private Snowflake | |
| Square | Scheduling and intake | Signs a BAA | Square Appointments, Invoices and other features Square identifies as HIPAA-enabled | |
| Squarespace | Site builders | Does not sign a BAA | BAA covers Acuity only, not website features | |
| Stape | HIPAA ad tracking | Signs a BAA on specific plans | Custom plan | |
| Stripe | Messaging and payments | No public statement | No BAA statement found; PHI barred in Third Party Data | |
| Supabase | Automation and workspace | Signs a BAA on specific plans | Team and Enterprise plans with the HIPAA add-on; hosted platform | |
| SurveyMonkey | Forms and landing pages | Signs a BAA on specific plans | Enterprise customers, on a HIPAA-enabled account | |
| Tableau | Analytics and data | Signs a BAA on specific plans | Tableau Cloud and Tableau Next | |
| Tealium | HIPAA ad tracking | Signs a BAA | HIPAA customers in Healthcare and Pharma | |
| Tebra | Scheduling and intake | Signs a BAA | Part of the Terms of Service for covered entities | |
| Telegram | Messaging and payments | No public statement | No BAA statement found | |
| TherapyNotes | Scheduling and intake | Signs a BAA | Built into the Terms of Service for covered entities | |
| TikTok | Ad platforms | Does not sign a BAA | Business terms bar health information | |
| Trello | Automation and workspace | No public statement | Not on Atlassian's BAA product list; PHI barred without a BAA | |
| Triple Whale | Analytics and data | No public statement | DPA: not intended for health information | |
| Twilio | Messaging and payments | Signs a BAA on specific plans | Security or Enterprise Edition; HIPAA-eligible products | |
| Twilio Segment | Analytics and data | Signs a BAA on specific plans | Business Tier plan | |
| Typeform | Forms and landing pages | Signs a BAA on specific plans | Enterprise and Growth Custom plans | |
| Unbounce | Forms and landing pages | No public statement | No BAA statement found | |
| Vagaro | Scheduling and intake | Signs a BAA | US businesses; signed in Vagaro when you turn on HIPAA Compliant Notifications | |
| Venmo | Messaging and payments | No public statement | No BAA statement found | |
| Vercel | Site builders | Signs a BAA on specific plans | Enterprise and Pro (HIPAA add-on) | |
| Vimeo | Video, reviews and SMS | Signs a BAA on specific plans | Eligible Vimeo Enterprise plans | |
| Virtru | CRM and email | Signs a BAA | All packages: Starter lists a signed BAA, and higher packages include Starter | |
| VSee | Video, reviews and SMS | Signs a BAA | All VSee plans except Free VSee Messenger | |
| VWO | Analytics and data | Does not sign a BAA | BAA not applicable by default; no PHI stored | |
| Weave | Call tracking and phones | Signs a BAA | Business Associate Addendum with every client | |
| Webflow | Site builders | Does not sign a BAA | Terms: no HIPAA compliant services | |
| WhatConverts | Call tracking and phones | Signs a BAA on specific plans | Pro and Elite plans | |
| Messaging and payments | Does not sign a BAA | Business Platform terms: not HIPAA compliant | ||
| Wistia | Video, reviews and SMS | Does not sign a BAA | Not HIPAA compliant; does not sign BAAs | |
| Wix | Site builders | Signs a BAA on specific plans | Business, Plus, Elite, Business Elite and Enterprise plans | |
| WordPress.com | Site builders | No public statement | No BAA statement found | |
| Wufoo | Forms and landing pages | No public statement | No Wufoo BAA statement found; PHI barred without a separate BAA | |
| YouTube | Video, reviews and SMS | No public statement | Not on Google's Workspace BAA list; no separate BAA found | |
| Zapier | Automation and workspace | Does not sign a BAA | Can't sign BAAs; PHI not supported | |
| Zendesk | Support and chat | Signs a BAA on specific plans | Advanced Compliance: Suite Professional, Enterprise or Enterprise Plus | |
| Zocdoc | Scheduling and intake | No public statement | Ask Zocdoc directly | |
| Zoho CRM | CRM and email | Signs a BAA | BAA on request; HIPAA settings on paid editions, not Free | |
| Zoom | Video, reviews and SMS | Signs a BAA on specific plans | Paid plans such as Pro, Business, Business Plus and Enterprise |
On this page
What each answer means
- Signs a BAA. The vendor's own page says it signs a BAA with healthcare customers.
- Signs a BAA on specific plans. The vendor signs a BAA only on the plans, editions or products it names, and those are listed with the answer.
- Does not sign a BAA. The vendor's own page says it does not sign a BAA, or that its service is not for health information.
- No public statement. We could not find a statement about a BAA on the vendor's own pages that we could quote.
Curve Compliance signs a BAA on every plan. Its own page says: “A signed BAA on every plan” (source).
A BAA covers the vendor, not your ad pixels
A BAA is a contract between you and one vendor. It covers the Protected Health Information that vendor handles for you. When a scheduling tool, form builder or CRM signs a BAA, the data inside that tool is covered. A Meta, Google Ads or TikTok pixel on the same page sends data to a different company, and that company is not a party to the BAA.
The ad platforms are clear about health data. Meta's Business Tools Terms say you will not share data that includes or is based on health information. TikTok says it does not allow advertisers to share health information. Google says it does not offer Business Associate Agreements for Google Analytics, and that it does not intend its Google Ads call features to create HIPAA obligations.
That leaves the conversion itself: the booking, the form fill or the purchase your campaigns learn from. It has to reach the ad platform without health information, from a service that is covered by a BAA with you.
How to read an entry
- The answer comes first, in one sentence, with the plans or products it depends on.
- The vendor's own words follow, quoted exactly, with a link to the page and the date we checked it.
- Where the vendor says what its BAA covers or leaves out, that is listed next.
- Each entry then explains what the answer means for your ad tracking and conversion data, and how Curve helps.
- Vendors change their plans and terms. Confirm the current terms with the vendor before you send it patient data.
How Curve helps
- Curve tracks conversions server-side in place of pixels, so they reach Meta, Google Ads, TikTok and your other ad platforms from Curve's server, not from the patient's browser.
- Curve checks every event for PHI-like patterns before it goes out, and its neutral event names keep conditions and treatments out of what the platforms see.
- Curve hashes identifiers with SHA-256 to each platform's requirements.
- Curve keeps attribution through booking tools, so a booked appointment is credited to the ad that brought the patient in.
- Curve adds consent management to your site, alongside the tracking.
- Curve signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you in about a week.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Which marketing tools sign a BAA?
Of the 192 tools in this directory, 50 sign a BAA and 81 sign one only on specific plans, editions or products, such as HubSpot on Enterprise subscriptions, Intercom on its Expert plan and Twilio on Security or Enterprise Edition. 36 do not sign one, and for 25 we could not find a statement to quote. Curve Compliance signs a BAA on every plan.
Do Meta, Google and TikTok sign a BAA?
No. Meta's Business Tools Terms say you will not share data that includes or is based on health information. TikTok says it does not allow advertisers to share health information. Google says it does not offer Business Associate Agreements for Google Analytics and does not intend its Google Ads call features to create HIPAA obligations. Curve sends conversions to these platforms server-side, with neutral event names and SHA-256 hashed identifiers.
Does a BAA with my scheduling or form tool cover my ad pixels?
No. A BAA covers the data one vendor handles for you. A pixel sends data from the visitor's browser to Meta, Google or TikTok, and none of them is a party to that BAA.
What does No public statement mean?
It means we could not find a statement about a BAA on the vendor's own pages that we could quote. It is not a yes. Until a vendor signs a BAA with you, keep Protected Health Information out of it.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.
Last checked .
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call