Skip to main content
BAA Directory

Is Curve Compliance HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes. Curve Compliance signs a Business Associate Agreement on every plan, before live tracking begins, and Curve's team does the setup in about a week.

HIPAA ad tracking. Checked on the vendor's own pages on .

Running ads for a healthcare brand? Curve Compliance replaces your browser ad pixels with one script and sends conversions server-side to Meta, Google, TikTok, Microsoft and LinkedIn, under a BAA on every plan. Book a call

On this page

What Curve Compliance says

“Yes, Curve Compliance signs a Business Associate Agreement on every plan … before live tracking begins.”

Source: Curve Compliance, About: FAQ, checked .

“Every Curve plan includes a signed Business Associate Agreement covering the PHI that passes through Curve … Enterprise plans can execute custom BAA terms if your legal team requires specific language.”

Source: Curve Compliance, Pricing: What's included in the BAA?, checked .

What the BAA covers and excludes

Covers, in Curve Compliance's words:

  • The PHI that passes through Curve, on every plan.

What this means for ad tracking

Curve Compliance publishes this directory, and its own entry follows the same format as every other: the answer, Curve's own words and the page they come from.

Meta and Google do not sign a BAA for ad tracking (Meta and Google Ads in this directory). Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta Conversions API, Google Ads, TikTok, Microsoft Advertising and LinkedIn.

Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve signs a BAA on every plan, before live tracking begins.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta Conversions API, Google Ads, TikTok, Microsoft Advertising and LinkedIn.
  • Curve flags PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, so they can be stopped at the source.
  • Curve keeps ad attribution when a visitor leaves your site to book, and bookings made days later still match the original ad click.
  • Curve does the setup for you with its own team, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a Business Associate Agreement on every plan, before live tracking begins. Enterprise plans can use custom BAA terms.

Is Curve Compliance HIPAA compliant?

Curve Compliance is HIPAA-compliant ad tracking for healthcare, with a BAA signed on every plan. It replaces browser ad pixels with one script, sends conversions server-side with a fixed list of fields for each platform, and flags PHI-like patterns before data reaches an ad platform.

How long does setup take?

About a week. Curve's team does the setup for you: it connects your ad accounts, installs the script and maps each conversion. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Curve Compliance before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call