Skip to main content
BAA Directory

Is Cloudflare Zaraz HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, for Enterprise customers. Cloudflare signs a BAA with Enterprise-level customers whose use involves PHI, and lists Zaraz in its HIPAA scope.

HIPAA ad tracking. Checked on the vendor's own pages on .

Using Cloudflare Zaraz on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Cloudflare says

“Yes. Cloudflare enters into a BAA with Enterprise-level customers whose use of our services involves PHI. The BAA must be formally executed by both parties before any PHI is processed through the Cloudflare network.”

Source: Cloudflare Trust Hub, HIPAA (Does Cloudflare sign a Business Associate Agreement?), checked .

“Use of Cloudflare services for PHI without a signed BAA may result in non-compliance for your organization.”

Source: Cloudflare Trust Hub, HIPAA (Does Cloudflare sign a Business Associate Agreement?), checked .

“Application Performance: Argo Smart Routing, Cache/CDN, DNS, Load Balancing, Speed, Waiting Room, Zaraz”

Source: Cloudflare Trust Hub, HIPAA (Which Cloudflare services are in-scope for HIPAA AoC?), checked .

What the BAA covers and excludes

Excludes or limits, in Cloudflare's words:

  • "Note: While services like Zaraz are in-scope, customers are responsible for ensuring that any third-party scripts configured within Zaraz comply with HIPAA disclosure rules."

What this means for ad tracking

Zaraz loads third-party tools for your website from Cloudflare. In Cloudflare's words, “With Cloudflare Zaraz you can load tools such as analytics tools, advertising pixels and scripts, chatbots, marketing automation tools, and more, in the most optimized way” (Cloudflare Zaraz docs).

Cloudflare lists Zaraz among the services in scope for its HIPAA Attestation of Compliance, and it signs a BAA with Enterprise-level customers whose use involves PHI. It also says customers are responsible for making sure “any third-party scripts configured within Zaraz comply with HIPAA disclosure rules” (Cloudflare).

A BAA binds only the vendor that signs it. The ad tools you load through Zaraz send data to their own companies, and this directory lists Meta, Google Ads and TikTok as not signing one, so the events those tools send need to leave PHI behind. Our guide to HIPAA-compliant server-side tracking tools compares the options.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Cloudflare for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Cloudflare Zaraz sign a BAA?

Yes, for Enterprise customers. In Cloudflare's words: “Cloudflare enters into a BAA with Enterprise-level customers whose use of our services involves PHI.” Cloudflare lists Zaraz among the services in scope for its HIPAA Attestation of Compliance (Cloudflare). We checked Cloudflare's own page on October 26, 2026.

Is Cloudflare Zaraz HIPAA compliant?

Cloudflare lists Zaraz among the services in scope for its HIPAA Attestation of Compliance, which it says comes from an annual audit. It also says the BAA “must be formally executed by both parties before any PHI is processed through the Cloudflare network,” and that customers are responsible for the third-party scripts they configure in Zaraz (Cloudflare).

Does Cloudflare's BAA cover the tools Zaraz loads?

No. Cloudflare says “customers are responsible for ensuring that any third-party scripts configured within Zaraz comply with HIPAA disclosure rules” (Cloudflare). The ad tools Zaraz loads send data to their own companies, and Meta and Google Ads are listed in this directory as not signing a BAA.

Which Cloudflare plans include a BAA?

Cloudflare's HIPAA page says it enters into a BAA with Enterprise-level customers whose use of its services involves PHI, and it names no other plan (Cloudflare). Ask your Cloudflare account executive which services your BAA covers.

How does Curve Compliance help with HIPAA ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Cloudflare before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call