Is ClickUp HIPAA compliant? Does it sign a BAA?
The answer
Signs a BAA on specific plans
Yes, for Enterprise customers. ClickUp says it can support HIPAA compliance for Enterprise customers by agreeing to a BAA.
Automation and workspace. Checked on the vendor's own pages on .
Using ClickUp on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What ClickUp says
“ClickUp can support HIPAA compliance for Enterprise customers by agreeing to a BAA (Business Associate Agreement).”
“Take a look at the Healthcare use section of ClickUp AI Additional Terms for our PHI (Protected Health Information) policies.”
What this means for ad tracking
Teams use ClickUp for campaign tasks, content calendars and sometimes lead follow-ups, and a task can carry a patient's name next to the service they asked about.
With a ClickUp Enterprise BAA, that data is covered inside ClickUp, and ClickUp points to the Healthcare use section of its AI Additional Terms for its PHI policies (ClickUp Help). On other plans, keep patient details out of ClickUp.
A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing a BAA, so a lead or booking you count as a conversion should reach them with no health details. Our HIPAA compliant software list covers other workspace tools.
Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.
A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.
How Curve helps
- Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep ClickUp for what it does well.
- Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
- Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
- Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
- Event Logs show what Curve sent to each platform and what the platform accepted.
- Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Is ClickUp HIPAA compliant?
Yes, for Enterprise customers. ClickUp says it can support HIPAA compliance for Enterprise customers by agreeing to a BAA. With a signed BAA, ClickUp can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.
Does ClickUp sign a BAA?
Yes, for Enterprise customers. In ClickUp's words: “ClickUp can support HIPAA compliance for Enterprise customers by agreeing to a BAA (Business Associate Agreement)” (ClickUp Help). We checked ClickUp's own page on October 26, 2026.
Which ClickUp plan includes a BAA?
ClickUp names its Enterprise customers (ClickUp Help). The ClickUp page we checked names no BAA for other plans, so keep patient details out of those workspaces.
Can I use ClickUp AI with PHI?
ClickUp says its PHI policies for AI are in the Healthcare use section of its ClickUp AI Additional Terms (ClickUp Help). Read that section before you turn on AI features in a workspace that holds PHI.
What does Curve Compliance do for ad tracking?
Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with ClickUp before you send it patient data.
Related tools
- Does Asana sign a BAA?Signs a BAA on specific plans. Enterprise+ tier; Legacy Enterprise only if already enabled.
- Does monday.com sign a BAA?Signs a BAA on specific plans. Enterprise plan with the HIPAA compliance feature enabled.
- Does Trello sign a BAA?No public statement. Not on Atlassian's BAA product list; PHI barred without a BAA.
- Does Notion sign a BAA?Signs a BAA on specific plans. Enterprise Plan; Beta Services excluded.
- Does Smartsheet sign a BAA?Signs a BAA on specific plans. Enterprise plan, excluding Legacy Enterprise.
- Does Airtable sign a BAA?Signs a BAA on specific plans. Enterprise Scale plans.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
- Does Curve Compliance sign a BAA?Signs a BAA. Every plan: Compliance, Growth and Enterprise.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call