Skip to main content
BAA Directory

Does Braze sign a BAA?

The answer

Signs a BAA on specific plans

Yes, for a Braze instance bought as HIPAA-eligible and provisioned on its HIPAA cluster.

CRM and email. Checked on the vendor's own pages on .

On this page

What Braze says

“This BAA shall apply only to PHI stored in a designated HIPAA Account. For purposes of this BAA, a “HIPAA Account” means that Customer has purchased an instance of the Services designated as HIPAA-eligible on the applicable Order Form, and Braze has provisioned on its HIPAA cluster.”

Source: Braze HIPAA Business Associate Addendum, checked .

What the BAA covers and excludes

Excludes or limits, in Braze's words:

  • "Customer shall not send any Messages through the Services that contain diagnoses, test results or similar sensitive medical information"
  • Third-party providers: "such Third-Party Providers may not be HIPAA compliant, and Braze is not liable for data breaches, violations of law, or damages that arise as a result of Customer's use of any such Third-Party Providers"

What this means for ad tracking

Braze holds leads and patients, and teams often sync its lead stages, email clicks or purchases back to ad platforms as conversions or audiences. Each sync sends data from Braze to Meta, Google or TikTok.

A BAA with Braze covers the data inside Braze. It does not extend to the ad platform receiving a conversion or an audience from it. What reaches the ad platform should be a neutral event with hashed identifiers, not a lead stage or list name that names a treatment.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

How Curve helps

  • Keep Braze for what it does well. Curve carries the conversion signal to your ad platforms separately, under its own BAA.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • Identifiers are hashed with SHA-256 to each platform's requirements.
  • Attribution is kept through booking tools, so a booked appointment is credited to the ad that brought the patient in.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Braze and patient data, read Is Braze HIPAA Compliant? Engagement Platform Risks.

Frequently asked questions

Does Braze sign a BAA?

Yes, for a Braze instance bought as HIPAA-eligible and provisioned on its HIPAA cluster. In Braze's words: “This BAA shall apply only to PHI stored in a designated HIPAA Account. For purposes of this BAA, a “HIPAA Account” means that Customer has purchased an instance of the Services designated as HIPAA-eligible on the applicable Order Form, and Braze has provisioned on its HIPAA cluster.” We checked Braze's own pages on September 29, 2026.

Which Braze plans include a BAA?

Braze's BAA applies only to a HIPAA Account: an instance bought as HIPAA-eligible on your Order Form and provisioned on Braze's HIPAA cluster.

Does a BAA with Braze cover my ad pixels?

No. A BAA covers the data Braze handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with Braze.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Braze before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call