BAA Directory
Does it sign a BAA? A directory of 58 healthcare marketing tools
A HIPAA covered entity needs a Business Associate Agreement (BAA) with any vendor that handles its patients' Protected Health Information. This directory answers one question for 58 common healthcare marketing and operations tools: does the vendor sign a BAA, and on which plans? Every answer quotes the vendor's own page, links to it and shows the date we checked.
Curve Compliance signs a BAA on every plan. Curve's team sets up HIPAA-compliant, server-side conversion tracking for you in about a week, so your ad platforms get the conversions they optimize on without a pixel carrying patient data. Book a call.
The directory
Curve Compliance first, then 58 tools in alphabetical order. Select a tool for the vendor's own words, the source link and what the answer means for your ad tracking.
Showing 58 of 58 tools, plus Curve Compliance.
| Tool | Category | Answer | Conditions | Last checked |
|---|---|---|---|---|
| Curve Compliance | HIPAA ad tracking | Signs a BAA on every plan | Every plan: Compliance, Growth and Enterprise | |
| ActiveCampaign | CRM and email | Signs a BAA on specific plans | Eligible plans; Enterprise named by ActiveCampaign | |
| Acuity Scheduling | Scheduling and intake | Signs a BAA on specific plans | Powerhouse and Premium plans; custom BAAs on Enterprise | |
| Airtable | Automation and workspace | Signs a BAA on specific plans | Enterprise Scale plans | |
| Amplitude | Analytics and data | Signs a BAA | BAA through Amplitude; AI features covered | |
| Attentive | Video, reviews and SMS | Does not sign a BAA | Content Policy bars PHI | |
| Birdeye | Video, reviews and SMS | Signs a BAA | Birdeye For Local Business and Enterprise services | |
| Braze | CRM and email | Signs a BAA on specific plans | HIPAA-eligible instance named on the Order Form | |
| Calendly | Scheduling and intake | Does not sign a BAA | No BAA offered on any plan | |
| CallRail | Call tracking and phones | Signs a BAA on specific plans | Healthcare plans | |
| ChatGPT | AI assistants | Signs a BAA on specific plans | OpenAI API; sales-managed ChatGPT Enterprise or Edu | |
| Claude | AI assistants | Signs a BAA on specific plans | First-party API and HIPAA-ready Claude Enterprise | |
| Customer.io | CRM and email | Signs a BAA on specific plans | Premium and Enterprise plans | |
| Doxy.me | Video, reviews and SMS | Signs a BAA | All plans; Clinic BAA for groups | |
| Drift | Support and chat | Does not sign a BAA | Terms bar HIPAA-regulated data | |
| FullStory | Analytics and data | Signs a BAA | BAA available; health data still prohibited | |
| GoHighLevel | CRM and email | Signs a BAA on specific plans | Paid HIPAA Compliance add-on, any agency plan | |
| Google Ads | Ad platforms | Does not sign a BAA | Google Ads call terms disclaim HIPAA | |
| Google Analytics 4 | Analytics and data | Does not sign a BAA | No BAA for Google Analytics | |
| Google Tag Manager | Analytics and data | No public statement | Use Policy bars personally identifying data | |
| Google Workspace | Automation and workspace | Signs a BAA | Covered services such as Gmail, Drive and Meet | |
| Gravity Forms | Forms and landing pages | Does not sign a BAA | Will not sign; your host holds the data | |
| Heap | Analytics and data | Signs a BAA | BAA through Heap | |
| Hotjar | Analytics and data | No public statement | No BAA statement found | |
| HubSpot | CRM and email | Signs a BAA on specific plans | Enterprise subscriptions with Sensitive Data enabled | |
| IntakeQ | Scheduling and intake | Signs a BAA | Signed in the account by the admin | |
| Intercom | Support and chat | Signs a BAA on specific plans | Expert plan | |
| Invoca | Call tracking and phones | Signs a BAA | Standard BAA, or the customer's own on review | |
| Jane App | Scheduling and intake | Signs a BAA | BAA arranged with Jane | |
| Jotform | Forms and landing pages | Signs a BAA on specific plans | Gold and Enterprise, with HIPAA features enabled | |
| Klaviyo | CRM and email | Does not sign a BAA | Acceptable Use Policy bars PHI | |
| Looker Studio | Analytics and data | Signs a BAA | Under the Google Cloud Platform BAA | |
| Mailchimp | CRM and email | Does not sign a BAA | Data Processing Addendum bars health information | |
| Make.com | Automation and workspace | No public statement | No BAA statement found | |
| Meta | Ad platforms | Does not sign a BAA | Business Tools Terms bar health information | |
| Microsoft 365 | Automation and workspace | Signs a BAA | By default through Microsoft's Data Protection Addendum; in-scope services | |
| Microsoft Clarity | Analytics and data | Does not sign a BAA | Terms bar health care content | |
| Mixpanel | Analytics and data | Signs a BAA on specific plans | Enterprise Plan | |
| Podium | Video, reviews and SMS | Signs a BAA | Covered entities and business associates, under Podium's terms | |
| PostHog | Analytics and data | Signs a BAA on specific plans | PostHog Cloud on Boost, Scale or Enterprise | |
| RingCentral | Call tracking and phones | Signs a BAA | Paying customers; listed services such as RingEX and RingCX | |
| Salesforce | CRM and email | Signs a BAA on specific plans | HIPAA Covered Services only, such as Sales Cloud and Marketing Cloud Engagement | |
| Shopify | Site builders | Does not sign a BAA | Acceptable Use Policy: PHI not supported | |
| Slack | Automation and workspace | Signs a BAA on specific plans | Enterprise-level plan plus the Slack HIPAA Enabled SKU | |
| Squarespace | Site builders | Does not sign a BAA | BAA covers Acuity only, not website features | |
| Stripe | Messaging and payments | No public statement | No BAA statement found; PHI barred in Third Party Data | |
| TikTok | Ad platforms | Does not sign a BAA | Business terms bar health information | |
| Twilio | Messaging and payments | Signs a BAA on specific plans | Security or Enterprise Edition; HIPAA-eligible products | |
| Twilio Segment | Analytics and data | Signs a BAA on specific plans | Business Tier plan | |
| Typeform | Forms and landing pages | Signs a BAA on specific plans | Enterprise and Growth Custom plans | |
| Unbounce | Forms and landing pages | No public statement | No BAA statement found | |
| Weave | Call tracking and phones | Signs a BAA | Business Associate Addendum with every client | |
| Webflow | Site builders | Does not sign a BAA | Terms: no HIPAA compliant services | |
| Wix | Site builders | Signs a BAA on specific plans | Business, Plus, Elite, Business Elite and Enterprise plans | |
| WordPress.com | Site builders | No public statement | No BAA statement found | |
| Zapier | Automation and workspace | Does not sign a BAA | Can't sign BAAs; PHI not supported | |
| Zendesk | Support and chat | Signs a BAA on specific plans | Advanced Compliance: Suite Professional, Enterprise or Enterprise Plus | |
| Zocdoc | Scheduling and intake | No public statement | Ask Zocdoc directly | |
| Zoom | Video, reviews and SMS | Signs a BAA on specific plans | Paid plans such as Pro, Business, Business Plus and Enterprise |
On this page
What each answer means
- Signs a BAA. The vendor's own page says it signs a BAA with healthcare customers.
- Signs a BAA on specific plans. The vendor signs a BAA only on the plans, editions or products it names, and those are listed with the answer.
- Does not sign a BAA. The vendor's own page says it does not sign a BAA, or that its service is not for health information.
- No public statement. We could not find a statement about a BAA on the vendor's own pages that we could quote.
Curve Compliance signs a BAA on every plan. Its own page says: “A signed BAA on every plan” (source).
A BAA covers the vendor, not your ad pixels
A BAA is a contract between you and one vendor. It covers the Protected Health Information that vendor handles for you. When a scheduling tool, form builder or CRM signs a BAA, the data inside that tool is covered. A Meta, Google Ads or TikTok pixel on the same page sends data to a different company, and that company is not a party to the BAA.
The ad platforms are clear about health data. Meta's Business Tools Terms say you will not share data that includes or is based on health information. TikTok says it does not allow advertisers to share health information. Google says it does not offer Business Associate Agreements for Google Analytics, and that it does not intend its Google Ads call features to create HIPAA obligations.
That leaves the conversion itself: the booking, the form fill or the purchase your campaigns learn from. It has to reach the ad platform without health information, from a service that is covered by a BAA with you.
How to read an entry
- The answer comes first, in one sentence, with the plans or products it depends on.
- The vendor's own words follow, quoted exactly, with a link to the page and the date we checked it.
- Where the vendor says what its BAA covers or leaves out, that is listed next.
- Each entry then explains what the answer means for your ad tracking and conversion data, and how Curve helps.
- Vendors change their plans and terms. Confirm the current terms with the vendor before you send it patient data.
How Curve helps
- Server-side conversion tracking in place of pixels: conversions reach Meta, Google Ads, TikTok and your other ad platforms from Curve's server, not from the patient's browser.
- PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
- Identifiers are hashed with SHA-256 to each platform's requirements.
- Attribution is kept through booking tools, so a booked appointment is credited to the ad that brought the patient in.
- Consent management for your site, alongside the tracking.
- A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Which marketing tools sign a BAA?
Of the 58 tools in this directory, 14 sign a BAA and 22 sign one only on specific plans, editions or products, such as HubSpot on Enterprise subscriptions, Intercom on its Expert plan and Twilio on Security or Enterprise Edition. 15 do not sign one, and for 7 we could not find a statement to quote. Curve Compliance signs a BAA on every plan.
Do Meta, Google and TikTok sign a BAA?
No. Meta's Business Tools Terms say you will not share data that includes or is based on health information. TikTok says it does not allow advertisers to share health information. Google says it does not offer Business Associate Agreements for Google Analytics and does not intend its Google Ads call features to create HIPAA obligations. Curve sends conversions to these platforms server-side, with neutral event names and SHA-256 hashed identifiers.
Does a BAA with my scheduling or form tool cover my ad pixels?
No. A BAA covers the data one vendor handles for you. A pixel sends data from the visitor's browser to Meta, Google or TikTok, and none of them is a party to that BAA.
What does No public statement mean?
It means we could not find a statement about a BAA on the vendor's own pages that we could quote. It is not a yes. Until a vendor signs a BAA with you, keep Protected Health Information out of it.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.
Last checked .
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call