Skip to main content
BAA Directory

Does Amazon SES sign a BAA?

The answer

Signs a BAA

Yes. Amazon SES is a HIPAA Eligible Service, covered once you accept the AWS Business Associate Addendum for your account.

CRM and email. Checked on the vendor's own pages on .

Using Amazon SES on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Amazon Web Services says

“Amazon SES is now a HIPAA Eligible Service. HIPAA eligibility applies to all AWS Regions where Amazon SES is available.”

Source: AWS What's New, Amazon SES Achieves HIPAA Eligibility (July 25, 2019), checked .

“Yes. AWS has a standard Business Associate Addendum (BAA) we present to customers for signature.”

Source: AWS HIPAA Compliance, FAQs, checked .

What the BAA covers and excludes

Excludes or limits, in Amazon Web Services's words:

  • "Customers may use any AWS service in an account designated as a HIPAA account, but they should only process, store, and transmit protected health information (PHI) in the HIPAA-eligible services defined in the Business Associate Addendum (BAA)."

What this means for ad tracking

Transactional email services like Amazon SES send booking confirmations, reminders and receipts, so they sit right where a lead becomes a patient. Click tracking rewrites the links in those emails and open tracking adds a tracking image, and both record activity tied to a person.

A BAA with AWS covers the email Amazon SES handles for you. It does not cover an ad platform, so a booking confirmed by email should reach Meta or Google as a neutral event, with no appointment details.

Curve Compliance closes that gap: it tracks the booking itself and sends the conversion server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without patient data in an email or a pixel. Book a call to see it on your own funnel.

How Curve helps

  • Keep Amazon SES for what it does well. Curve Compliance carries the conversion signal to your ad platforms separately, under its own BAA.
  • Attribution is kept through booking tools, so a booked appointment is credited to the ad that brought the patient in, even when it is made days later.
  • Server-side conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, sent from Curve's servers with neutral event names and SHA-256 hashed identifiers.
  • PHI-like pattern detection flags condition names, form answers and emails in URLs before data reaches an ad platform, so they can be stopped at the source.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Amazon SES sign a BAA?

Yes. Amazon SES is a HIPAA Eligible Service, covered once you accept the AWS Business Associate Addendum for your account. In AWS's words: “Yes. AWS has a standard Business Associate Addendum (BAA) we present to customers for signature.” We checked AWS's own pages on October 1, 2026.

How do I get a BAA for Amazon SES?

Accept the AWS Business Associate Addendum for your account in AWS Artifact. AWS says Amazon SES is a HIPAA Eligible Service in every AWS Region where it is available, and that PHI should only go through the HIPAA-eligible services the BAA defines.

Does a BAA with Amazon SES cover my ad pixels?

No. A BAA covers the data AWS handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with AWS.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Amazon Web Services before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call