Skip to main content
BAA Directory

Is Boulevard HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, with Boulevard's HIPAA Coverage add-on, which is also part of its Medspa Add-on. Covered entities sign the BAA in the Boulevard dashboard.

Scheduling and intake. Checked on the vendor's own pages on .

Taking bookings in Boulevard? Curve Compliance credits each booking to the ad click that started it, even when patients book days later, and sends the conversion server-side to Meta, Google and TikTok under a BAA on every plan. Book a call

On this page

What Boulevard says

“Signing a Business Associate Agreement (BAA) in your Boulevard Dashboard to align with HIPAA requirements”

Source: Boulevard Support Center, Medspa Add-On (what HIPAA Coverage includes), checked .

“If you are a Covered Entity under HIPAA, ensure you have subscribed to Boulevard’s HIPAA Coverage Add-on”

Source: Boulevard Support Center, Protected Health Information (PHI) Security Requirements, checked .

“Complete the Business Associate Addendum if you are a Covered Entity under HIPAA”

Source: Boulevard Support Center, PHI Security Requirements (Security tab of Manage Business settings), checked .

“If you already have HIPAA Coverage, upgrading to the Medspa Add-on will unlock unlimited photo markup and supervisor sign-off.”

Source: Boulevard Support Center, Medspa Add-On, checked .

“These restrictions apply to all Customers offering Healthcare Services and/or processing Protected Health Information (PHI) in connection with Boulevard Services, regardless of their Covered Entity status or whether they've entered a Business Associate Agreement (BAA) with Boulevard.”

Source: Boulevard Support Center, Your Essential Guide to Healthcare Services, checked .

What the BAA covers and excludes

Excludes or limits, in Boulevard's words:

  • Where PHI may go, whether or not you have signed a BAA: “Keep all PHI in areas of the platform designed to store PHI, like forms and client profiles”.
  • Messages to clients: “Keep PHI out of non-encrypted areas of the Boulevard Services, including all emails and text messages to Clients.”
  • Healthcare services, whether or not you have a BAA: “Customers may not exclusively provide Healthcare Services online or over the phone.”

What this means for ad tracking

The booking is the conversion most med spas optimize their ads for, so Boulevard usually sits right where the ad tracking happens. A pixel on a booking or confirmation page can send the page address, the service booked and the visitor's identifiers to Meta, Google or TikTok.

Boulevard's PHI Security Requirements tell you to keep PHI in the parts of Boulevard built to store it, such as forms and client profiles, and out of emails and text messages to clients. A BAA with Boulevard covers the patient data Boulevard handles for you. It does not cover what an ad pixel on a booking or confirmation page sends to an ad platform, because the ad platform is a separate recipient that has not signed your BAA. Meta's Business Tools Terms bar health information, so the booking has to reach Meta without it. See which ad platforms sign a BAA.

Curve Compliance helps with that part. When a visitor leaves your site to book in Boulevard, Curve keeps the ad attribution: plain booking links are handled automatically, and a booking made days later still matches the visit that started it. Curve credits the booking to the ad and sends the conversion server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

For med spas, see Curve for med spas, Does HIPAA apply to med spas? and Best HIPAA-compliant conversion tracking for med spas.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare schedulers, see our guide to HIPAA compliant scheduling software.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Boulevard for what it does well.
  • Curve keeps ad attribution when a visitor leaves your site to book in Boulevard. Plain booking links are handled automatically, and bookings made days later still match.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Boulevard HIPAA compliant?

Boulevard offers a HIPAA Coverage add-on, and with it a covered entity signs Boulevard's BAA in the Boulevard dashboard. Boulevard's PHI Security Requirements apply whether or not you have signed a BAA, and include keeping PHI out of emails and text messages to clients. The BAA does not cover ad pixels or tags on your booking pages, because they send data to other companies.

Does Boulevard sign a BAA?

Yes, with its HIPAA Coverage add-on, which is also part of the Medspa Add-on. Boulevard lists “Signing a Business Associate Agreement (BAA) in your Boulevard Dashboard to align with HIPAA requirements” among what HIPAA Coverage includes. We checked Boulevard's own pages on October 26, 2026.

Where do I sign the BAA in Boulevard?

Boulevard's PHI Security Requirements tell covered entities to subscribe to the HIPAA Coverage add-on, then, on the Security tab of Manage Business settings, to “Complete the Business Associate Addendum if you are a Covered Entity under HIPAA.” Boulevard says business administrators can add the Medspa Add-on by chatting with its Customer Experience team.

Can I track Boulevard bookings in Meta and Google Ads?

Yes, with Curve Compliance. When a visitor clicks a plain booking link from your site to Boulevard, Curve keeps the ad attribution automatically, and bookings made days later still match. Curve sends the conversion to Meta, Google Ads and your other ad platforms server-side, and Event Logs show what each platform accepted. More in our guide to HIPAA compliant scheduling software.

Does a BAA with Boulevard cover my ad pixels?

No. A BAA covers the data Boulevard handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with Boulevard.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Boulevard before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call