Which automation and workspace tools sign a BAA?
The answer
Of the 30 automation and workspace tools in Curve Compliance's BAA Directory, 5 sign a BAA outright, 20 sign one only on specific plans, 2 don't sign one and 3 make no public statement, as of October 2026. A BAA with any of them covers that tool, not the ad pixels on your pages.
Checked on each vendor's own page between and .
Curve Compliance keeps your ad tracking HIPAA-compliant around these tools, under a BAA on every plan. Book a call
On this page
The list
| Tool | Answer | Conditions | Checked |
|---|---|---|---|
| Amazon Web Services (AWS) | Signs a BAA | Accepted in AWS Artifact; HIPAA-eligible services only | |
| Google Cloud | Signs a BAA | Google Cloud BAA; listed supported products | |
| Google Workspace | Signs a BAA | Covered services such as Gmail, Drive and Meet | |
| Microsoft 365 | Signs a BAA | By default through Microsoft's Data Protection Addendum; in-scope services | |
| Microsoft Azure | Signs a BAA | By default through the Microsoft Product Terms; in-scope Azure services | |
| Airtable | Signs a BAA on specific plans | Enterprise Scale plans | |
| Asana | Signs a BAA on specific plans | Enterprise+ tier; Legacy Enterprise only if already enabled | |
| Box | Signs a BAA on specific plans | Enterprise, Enterprise Plus or Enterprise Advanced accounts | |
| ClickUp | Signs a BAA on specific plans | Enterprise plan | |
| Cloudflare | Signs a BAA on specific plans | Enterprise customers | |
| Dropbox | Signs a BAA on specific plans | Team plans such as Standard, Advanced, Business and Enterprise | |
| Gmail | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Docs | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Drive | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Google Sheets | Signs a BAA on specific plans | Google Workspace accounts, after an administrator accepts Google's BAA | |
| Grammarly | Signs a BAA on specific plans | Grammarly for Business Enterprise plans | |
| monday.com | Signs a BAA on specific plans | Enterprise plan with the HIPAA compliance feature enabled | |
| Notion | Signs a BAA on specific plans | Enterprise Plan; Beta Services excluded | |
| OneDrive | Signs a BAA on specific plans | OneDrive for Business on Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum | |
| Outlook | Signs a BAA on specific plans | Exchange Online on Office 365 Commercial or GCC subscriptions | |
| ShareFile | Signs a BAA on specific plans | Premium, Enterprise and Virtual Data Room plans, with a signed BAA | |
| SharePoint | Signs a BAA on specific plans | SharePoint Online on Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum | |
| Slack | Signs a BAA on specific plans | Enterprise-level plan plus the Slack HIPAA Enabled SKU | |
| Smartsheet | Signs a BAA on specific plans | Enterprise plan, excluding Legacy Enterprise | |
| Supabase | Signs a BAA on specific plans | Team and Enterprise plans with the HIPAA add-on; hosted platform | |
| iCloud | Does not sign a BAA | Terms bar PHI and business associate use | |
| Zapier | Does not sign a BAA | Can't sign BAAs; PHI not supported | |
| Canva | No public statement | No BAA statement found | |
| Make.com | No public statement | No BAA statement found | |
| Trello | No public statement | Not on Atlassian's BAA product list; PHI barred without a BAA |
Select a tool for the vendor's own words, the source link and what the answer means for your ad tracking. The BAA Directory report has the counts for every category.
What to check before you pick one
- The plan, edition or add-on the BAA needs, when the answer is specific plans, and whether yours includes it.
- What the BAA covers and leaves out. Each entry lists it where the vendor says so.
- Who signs it and how: some vendors have an admin accept the BAA inside the account, others send it through sales.
- The date we checked. Vendors change their plans and terms, so confirm the current terms with the vendor before you send it patient data.
Picking several tools at once? The BAA stack checker shows the answer for each tool you use.
The ad tracking gap these tools leave
A BAA with an automation and workspace tool covers the data that tool handles for you. A pixel on the same page sends data to a different company, and this directory lists Meta, Google Ads and TikTok as not signing a BAA. The conversion your campaigns learn from has to reach them without health information.
How Curve helps
- Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep the tools you use for what they do well.
- Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
- Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
- Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
- Event Logs show what Curve sent to each platform and what the platform accepted.
- Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Which automation and workspace tools sign a BAA?
In Curve Compliance's BAA Directory, Amazon Web Services (AWS), Google Cloud, Google Workspace, Microsoft 365 and Microsoft Azure sign a BAA outright, and Airtable, Asana, Box, ClickUp, Cloudflare, Dropbox, Gmail, Google Docs, Google Drive, Google Sheets, Grammarly, monday.com, Notion, OneDrive, Outlook, ShareFile, SharePoint, Slack, Smartsheet and Supabase sign one only on specific plans. Each entry quotes the vendor and gives the date we checked.
Is an automation and workspace tool HIPAA compliant without a BAA?
Not for patient information. A HIPAA covered entity needs a business associate agreement with any vendor that handles its patients' Protected Health Information. A vendor page that calls a tool HIPAA compliant is not the same as a signed BAA, so keep patient information out of the tool until the vendor signs one with you.
Do I need a BAA with an automation and workspace tool?
A HIPAA covered entity needs one with any vendor that handles its patients' Protected Health Information, for example in bookings, intake answers or messages. Each entry in this list says whether the vendor signs a BAA and on which plans.
Does a BAA with an automation and workspace tool cover my ads?
No. A BAA covers the data one vendor handles for you. A pixel sends data from the visitor's browser to Meta, Google or TikTok, and none of them is a party to that BAA. Curve Compliance sends your conversions to them server-side, with a fixed list of fields, under the BAA it signs on every plan.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call