Skip to main content
BAA Directory

Is Cal.com HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes. Cal.com includes a BAA with its Enterprise plan and Organizations plans of 15 or more users, and offers one as an add-on on lower plans.

Scheduling and intake. Checked on the vendor's own pages on .

Using Cal.com on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Cal.com says

“We sign BAAs with covered entities and business associates, formalizing Cal.com’s responsibility for protecting PHI.”

Source: Cal.com HIPAA compliance, Signed business associate agreement (BAA), checked .

“A BAA is included in the Organizations plan for 15 users or more, as well as in the Enterprise plan.”

Source: Cal.com HIPAA FAQ, What plan do I need to be HIPAA-compliant using Cal.com?, checked .

“To be HIPAA-compliant with Cal.com, you'll need to sign a Business Associate Agreement (BAA).”

Source: Cal.com HIPAA FAQ, What plan do I need to be HIPAA-compliant using Cal.com?, checked .

What the BAA covers and excludes

Excludes or limits, in Cal.com's words:

  • "However, it’s your responsibility to ensure that any third-party tools or integrations you use are also HIPAA-compliant when handling PHI."

What this means for ad tracking

Online booking is where many ad clicks turn into patients. A booking page can show the service, the provider and the time a person picked, and the ad tags on that page can pass it on.

Cal.com says its BAA formalizes its responsibility for protecting PHI in Cal.com. It also says it is your responsibility to make sure the third-party tools and integrations you use with it are HIPAA-compliant when handling PHI (Cal.com).

A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing one, so booking conversions sent to them need to leave PHI behind. See how Curve handles booked appointment attribution.

Curve Compliance helps with that part: it receives outcomes from booking systems through incoming webhooks, credits each to the original ad click, and sends the conversion server-side under a BAA it signs on every plan, with only a fixed list of fields per platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare schedulers, see our guide to HIPAA compliant scheduling software.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Cal.com for what it does well.
  • Curve receives outcomes from booking systems through incoming webhooks and credits each to the original ad click.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Cal.com HIPAA compliant?

Yes. Cal.com includes a BAA with its Enterprise plan and Organizations plans of 15 or more users, and offers one as an add-on on lower plans. With a signed BAA, Cal.com can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Cal.com sign a BAA?

Yes, on qualifying plans. In Cal.com's words: “We sign BAAs with covered entities and business associates, formalizing Cal.com’s responsibility for protecting PHI.” A BAA is included with its Enterprise plan and Organizations plans of 15 or more users (Cal.com). We checked Cal.com's own page on October 26, 2026.

Which Cal.com plans include a BAA?

Cal.com says “A BAA is included in the Organizations plan for 15 users or more, as well as in the Enterprise plan.” On lower plans, such as Teams or an Organizations plan with fewer than 15 users, Cal.com offers a BAA as an add-on (Cal.com).

Can Cal.com run on pages where patients book?

With a signed BAA, Cal.com can hold booking details for you. Cal.com says you are responsible for making sure the third-party tools and integrations you use with it are HIPAA-compliant when handling PHI (Cal.com), so keep booking details out of the ad tags on those pages.

What does Curve Compliance do for ad tracking?

Curve receives outcomes from booking systems through incoming webhooks, credits each to the original ad click, and sends the conversion to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn server-side. It detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Cal.com before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call