Skip to main content
BAA Directory

Is Crazy Egg HIPAA compliant? Does it sign a BAA?

The answer

No public statement

No public statement about a BAA. Crazy Egg says it is HIPAA compliant and offers a DPA, but none of the pages we checked mention a BAA.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Crazy Egg says

“Crazy Egg is compliant with the various pieces of privacy legislation across the globe including GDPR, CCPA, HIPAA, and PIPEDA.”

Source: Crazy Egg Support, Crazy Egg Privacy, checked .

“Yes, Crazy Egg is HIPAA compliant.”

Source: Crazy Egg FAQ, Is Crazy Egg HIPAA compliant?, checked .

“Customers can sign our Data Processing Agreement (DPA) to support GDPR, CCPA, or HIPAA obligations.”

Source: Crazy Egg Pricing, Compliance, checked .

What this means for ad tracking

Heatmaps and session recordings run on every page you track, including pages about a condition, a treatment or a booking. Recordings follow the clicks, scrolling and pages a visitor moves through, which can connect a person to the care they were looking for.

Crazy Egg says “Yes, Crazy Egg is HIPAA compliant” (Crazy Egg) and that “Customers can sign our Data Processing Agreement (DPA) to support GDPR, CCPA, or HIPAA obligations” (Crazy Egg). Neither page names a business associate agreement. Ask Crazy Egg whether its DPA includes BAA terms, and get a signed BAA before patient information reaches it.

Crazy Egg's privacy page says “When visitors type in an input field, we mask the typed characters” (Crazy Egg). Until a BAA is in place, keep recordings off booking and intake pages.

Your ad platforms need conversions too, and this directory lists Meta and Google Ads as not signing a BAA. Curve Compliance sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve includes session replay and heatmaps under the same BAA as its ad tracking.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Crazy Egg HIPAA compliant?

Crazy Egg's FAQ says “Yes, Crazy Egg is HIPAA compliant” (Crazy Egg), and its pricing page offers a DPA to support HIPAA obligations. A HIPAA covered entity still needs a signed BAA from any vendor that handles its patients' information, and we found no statement about a BAA on Crazy Egg's own pages.

Does Crazy Egg sign a BAA?

No public statement. Crazy Egg offers a Data Processing Agreement that it says supports GDPR, CCPA or HIPAA obligations, but none of its pages we checked mention a business associate agreement. We checked them on October 26, 2026. Ask Crazy Egg directly.

Can I use Crazy Egg on pages where patients book?

Not with patient information until Crazy Egg signs a BAA with you. Its recordings mask what visitors type in input fields, but the pages a visitor views can still connect them to their care, so keep Crazy Egg off booking and intake pages until a BAA is in place.

What should I use for ad conversions on pages where Crazy Egg runs?

Send conversions server-side, without health details. Curve Compliance replaces browser ad pixels with one script and sends conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from its servers, with a fixed list of fields and neutral event names, under a BAA it signs on every plan. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Crazy Egg before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call