{"name":"Curve Compliance BAA Directory","description":"Which healthcare marketing tools sign a HIPAA business associate agreement (BAA), from each vendor's own page, with the quote, the source link and the date checked.","url":"https://www.curvecompliance.com/baa-registry","report":"https://www.curvecompliance.com/baa-registry/report","firstChecked":"2026-09-29","lastChecked":"2026-10-26","count":181,"columns":["tool","vendor","category","answer","conditions","quote","source_url","entry_url","last_checked"],"rows":[{"tool":"ActiveCampaign","vendor":"ActiveCampaign","category":"CRM and email","answer":"Signs a BAA on specific plans","conditions":"Eligible plans; Enterprise named by ActiveCampaign","quote":"Business Associate Agreement (BAA): Available on eligible plans to cover the use and disclosure of PHI.","source_url":"https://www.activecampaign.com/blog/hipaa-compliant-marketing","entry_url":"https://www.curvecompliance.com/baa-registry/activecampaign","last_checked":"2026-09-29"},{"tool":"Acuity Scheduling","vendor":"Squarespace","category":"Scheduling and intake","answer":"Signs a BAA on specific plans","conditions":"Powerhouse and Premium plans; custom BAAs on Enterprise","quote":"You can make your Acuity account HIPAA-enabled on the Powerhouse or Premium plans.","source_url":"https://support.squarespace.com/hc/en-us/articles/360028867231-Acuity-Scheduling-and-HIPAA","entry_url":"https://www.curvecompliance.com/baa-registry/acuity-scheduling","last_checked":"2026-09-29"},{"tool":"Adobe Acrobat Sign","vendor":"Adobe","category":"Forms and landing pages","answer":"Signs a BAA on specific plans","conditions":"Enterprise or business plans; eligibility confirmed by Adobe","quote":"The HIPAA readiness capability is only available through an Adobe Acrobat Sign for enterprise or business subscription plan.","source_url":"https://helpx.adobe.com/sign/web/guidance-for-regulatory-demands/overview.html","entry_url":"https://www.curvecompliance.com/baa-registry/adobe-acrobat-sign","last_checked":"2026-10-05"},{"tool":"Adobe Marketo Engage","vendor":"Adobe","category":"CRM and email","answer":"Signs a BAA on specific plans","conditions":"HIPAA-Ready license and signed BAA","quote":"Customers that license any Adobe HIPAA-Ready Service to process PHI must have the correct license and a signed BAA with Adobe.","source_url":"https://www.adobe.com/trust/compliance/hipaa-ready.html","entry_url":"https://www.curvecompliance.com/baa-registry/adobe-marketo-engage","last_checked":"2026-10-01"},{"tool":"Airtable","vendor":"Airtable","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Enterprise Scale plans","quote":"Contact your Airtable account executive to begin the BAA process.","source_url":"https://support.airtable.com/docs/understanding-hipaa-at-airtable","entry_url":"https://www.curvecompliance.com/baa-registry/airtable","last_checked":"2026-09-29"},{"tool":"Amazon SES","vendor":"Amazon Web Services","category":"CRM and email","answer":"Signs a BAA","conditions":"Under the AWS BAA; SES is a HIPAA Eligible Service","quote":"Amazon SES is now a HIPAA Eligible Service. HIPAA eligibility applies to all AWS Regions where Amazon SES is available.","source_url":"https://aws.amazon.com/about-aws/whats-new/2019/07/amazon-ses-achieves-hipaa-eligibility/","entry_url":"https://www.curvecompliance.com/baa-registry/amazon-ses","last_checked":"2026-10-01"},{"tool":"Amazon Web Services (AWS)","vendor":"Amazon Web Services","category":"Automation and workspace","answer":"Signs a BAA","conditions":"Accepted in AWS Artifact; HIPAA-eligible services only","quote":"Yes. AWS has a standard Business Associate Addendum (BAA) we present to customers for signature.","source_url":"https://aws.amazon.com/compliance/hipaa-compliance/","entry_url":"https://www.curvecompliance.com/baa-registry/amazon-web-services","last_checked":"2026-10-05"},{"tool":"Amplitude","vendor":"Amplitude","category":"Analytics and data","answer":"Signs a BAA","conditions":"BAA through Amplitude; AI features covered","quote":"Amplitude can enter a Business Associates Agreement to help you maintain your HIPAA compliance.","source_url":"https://amplitude.com/security-and-privacy","entry_url":"https://www.curvecompliance.com/baa-registry/amplitude","last_checked":"2026-09-29"},{"tool":"Asana","vendor":"Asana","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Enterprise+ tier; Legacy Enterprise only if already enabled","quote":"Available on the Asana Enterprise+ tier, as well as legacy tier Legacy Enterprise for existing customers who have already enabled the feature.","source_url":"https://help.asana.com/s/article/hipaa-compliance?language=en_US","entry_url":"https://www.curvecompliance.com/baa-registry/asana","last_checked":"2026-10-05"},{"tool":"Attentive","vendor":"Attentive","category":"Video, reviews and SMS","answer":"Does not sign a BAA","conditions":"Content Policy bars PHI","quote":"The messaging, creatives, calls-to-action, and all other content of any Attentive program, as well as website of an Attentive prospect or client may not contain or promote the following content:","source_url":"https://www.attentive.com/legal/content-policy","entry_url":"https://www.curvecompliance.com/baa-registry/attentive","last_checked":"2026-09-29"},{"tool":"Birdeye","vendor":"Birdeye","category":"Video, reviews and SMS","answer":"Signs a BAA","conditions":"Birdeye For Local Business and Enterprise services","quote":"These Standard HIPAA Business Associate Agreement Terms and Conditions (“HIPAA Addendum”) shall be incorporated into the Master Service Agreement for Customers that are Covered Entities (as defined below) that provide Protected Health Information (“PHI”)(as defined below) to Birdeye in connection with the Birdeye For Local Business and Enterprise services they have purchased.","source_url":"https://birdeye.com/hipaa/","entry_url":"https://www.curvecompliance.com/baa-registry/birdeye","last_checked":"2026-09-29"},{"tool":"Boulevard","vendor":"Boulevard","category":"Scheduling and intake","answer":"Signs a BAA on specific plans","conditions":"HIPAA Coverage add-on, also included in the Medspa Add-on","quote":"Signing a Business Associate Agreement (BAA) in your Boulevard Dashboard to align with HIPAA requirements","source_url":"https://support.boulevard.io/en/articles/9084775-medspa-add-on","entry_url":"https://www.curvecompliance.com/baa-registry/boulevard","last_checked":"2026-10-26"},{"tool":"Box","vendor":"Box","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Enterprise, Enterprise Plus or Enterprise Advanced accounts","quote":"customers who are required by law to comply with HIPAA, such as HIPAA Covered Entities and HIPAA Business Associates, must have an Enterprise, Enterprise Plus, or Enterprise Advanced account with Box and sign a HIPAA Business Associate Agreement (BAA).","source_url":"https://support.box.com/hc/en-us/articles/360044194833-Box-HIPAA-and-HITECH-Overview-and-FAQ","entry_url":"https://www.curvecompliance.com/baa-registry/box","last_checked":"2026-10-05"},{"tool":"Braze","vendor":"Braze","category":"CRM and email","answer":"Signs a BAA on specific plans","conditions":"HIPAA-eligible instance named on the Order Form","quote":"This BAA shall apply only to PHI stored in a designated HIPAA Account. For purposes of this BAA, a “HIPAA Account” means that Customer has purchased an instance of the Services designated as HIPAA-eligible on the applicable Order Form, and Braze has provisioned on its HIPAA cluster.","source_url":"https://www.braze.com/company/legal/baa","entry_url":"https://www.curvecompliance.com/baa-registry/braze","last_checked":"2026-09-29"},{"tool":"Brevo","vendor":"Brevo","category":"CRM and email","answer":"Does not sign a BAA","conditions":"Terms of Use: not for HIPAA communications","quote":"You should not use the Services where your communications would be subject to industry-specific regulations such as the Health Insurance Portability and Accountability Act (HIPAA) or the Federal Information Security Management Act (FISMA).","source_url":"https://www.brevo.com/legal/termsofuse/","entry_url":"https://www.curvecompliance.com/baa-registry/brevo","last_checked":"2026-10-01"},{"tool":"Cal.com","vendor":"Cal.com","category":"Scheduling and intake","answer":"Signs a BAA on specific plans","conditions":"Enterprise and Organizations (15+ users); add-on on lower plans","quote":"We sign BAAs with covered entities and business associates, formalizing Cal.com’s responsibility for protecting PHI.","source_url":"https://cal.com/compliance/hipaa","entry_url":"https://www.curvecompliance.com/baa-registry/cal-com","last_checked":"2026-10-26"},{"tool":"Calendly","vendor":"Calendly","category":"Scheduling and intake","answer":"Does not sign a BAA","conditions":"No BAA offered on any plan","quote":"as it stands today it isn't intended for collecting Protected Health Information, and we don't currently offer a BAA.","source_url":"https://community.calendly.com/how-do-i-40/baa-hipaa-compliance-5892","entry_url":"https://www.curvecompliance.com/baa-registry/calendly","last_checked":"2026-09-29"},{"tool":"CallRail","vendor":"CallRail","category":"Call tracking and phones","answer":"Signs a BAA on specific plans","conditions":"Healthcare plans","quote":"We take HIPAA compliance seriously; that's why we've not only created an end-to-end solution for health care providers, but we also sign a business associate agreement (BAA) with each of our Healthcare clients.","source_url":"https://www.callrail.com/pricing","entry_url":"https://www.curvecompliance.com/baa-registry/callrail","last_checked":"2026-09-29"},{"tool":"CallTrackingMetrics","vendor":"CTM","category":"Call tracking and phones","answer":"Signs a BAA on specific plans","conditions":"Marketing Pro plan and above","quote":"As part of our HIPAA Compliance Program, CTM will put in place Business Associate Agreements (BAAs) with customers to document the requirements of the relationship as it relates to HIPAA","source_url":"https://www.ctm.com/security/","entry_url":"https://www.curvecompliance.com/baa-registry/calltrackingmetrics","last_checked":"2026-10-01"},{"tool":"Canva","vendor":"Canva","category":"Automation and workspace","answer":"No public statement","conditions":"No BAA statement found","quote":"","source_url":"https://www.canva.com/policies/terms-of-use/","entry_url":"https://www.curvecompliance.com/baa-registry/canva","last_checked":"2026-10-05"},{"tool":"Carepatron","vendor":"Carepatron","category":"Scheduling and intake","answer":"Signs a BAA","conditions":"Every account; the BAA takes effect when the account is created","quote":"End-to-end encryption, SOC 2 certification, GDPR compliance and a BAA included, all active from day one with zero configuration required.","source_url":"https://www.carepatron.com/features/compliance-and-security","entry_url":"https://www.curvecompliance.com/baa-registry/carepatron","last_checked":"2026-10-26"},{"tool":"ChatGPT","vendor":"OpenAI","category":"AI assistants","answer":"Signs a BAA on specific plans","conditions":"ChatGPT for Healthcare, Enterprise with Regulated Workspace, FedRAMP or Clinicians; API with Modified Retention","quote":"To use the OpenAI API with protected health information (PHI), your organization must first enter into a Business Associate Agreement (BAA) with OpenAI.","source_url":"https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai","entry_url":"https://www.curvecompliance.com/baa-registry/chatgpt","last_checked":"2026-10-11"},{"tool":"Claude","vendor":"Anthropic","category":"AI assistants","answer":"Signs a BAA on specific plans","conditions":"First-party API, Claude in Microsoft Foundry and HIPAA-ready Claude Enterprise","quote":"Anthropic provides a BAA covering our HIPAA-ready services, such as use of our first-party API, Claude in Microsoft Foundry, or Enterprise plans.","source_url":"https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers","entry_url":"https://www.curvecompliance.com/baa-registry/claude","last_checked":"2026-10-11"},{"tool":"ClickUp","vendor":"ClickUp","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Enterprise plan","quote":"ClickUp can support HIPAA compliance for Enterprise customers by agreeing to a BAA (Business Associate Agreement).","source_url":"https://help.clickup.com/hc/en-us/articles/6327673904663-Compliance-and-General-Protection-Data-Regulation-GDPR","entry_url":"https://www.curvecompliance.com/baa-registry/clickup","last_checked":"2026-10-26"},{"tool":"Cloudflare","vendor":"Cloudflare","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Enterprise customers","quote":"Yes. Cloudflare enters into a BAA with Enterprise-level customers whose use of our services involves PHI. The BAA must be formally executed by both parties before any PHI is processed through the Cloudflare network.","source_url":"https://www.cloudflare.com/trust-hub/compliance-resources/hipaa/","entry_url":"https://www.curvecompliance.com/baa-registry/cloudflare","last_checked":"2026-10-26"},{"tool":"Cloudflare Zaraz","vendor":"Cloudflare","category":"HIPAA ad tracking","answer":"Signs a BAA on specific plans","conditions":"Enterprise customers","quote":"Yes. Cloudflare enters into a BAA with Enterprise-level customers whose use of our services involves PHI. The BAA must be formally executed by both parties before any PHI is processed through the Cloudflare network.","source_url":"https://www.cloudflare.com/trust-hub/compliance-resources/hipaa/","entry_url":"https://www.curvecompliance.com/baa-registry/cloudflare-zaraz","last_checked":"2026-10-26"},{"tool":"Cognito Forms","vendor":"Cognito Forms","category":"Forms and landing pages","answer":"Signs a BAA on specific plans","conditions":"Enterprise plan, not a trial","quote":"Your organization must be on the Cognito Forms Enterprise plan (and not a trial) in order to enter into a BAA.","source_url":"https://www.cognitoforms.com/support/78/entries/hipaa-compliance","entry_url":"https://www.curvecompliance.com/baa-registry/cognito-forms","last_checked":"2026-10-01"},{"tool":"Cometly","vendor":"Cometly","category":"Analytics and data","answer":"No public statement","conditions":"Terms bar PHI in Events and every other feature","quote":"You agree not to use the Service to collect, store, or process any data that is subject to heightened legal or regulatory protections (e.g., health information governed by HIPAA, payment card data governed by PCI-DSS) unless you have obtained our prior written consent and implemented any additional required safeguards.","source_url":"https://www.cometly.com/terms","entry_url":"https://www.curvecompliance.com/baa-registry/cometly","last_checked":"2026-10-26"},{"tool":"Constant Contact","vendor":"Constant Contact","category":"CRM and email","answer":"Signs a BAA","conditions":"Standard BAA on request; contact details only","quote":"If you are a covered entity, and require a business associate agreement, please contact us at legal@constantcontact.com to request a business associate agreement prior to using our services with your email subscribers.","source_url":"https://knowledgebase.constantcontact.com/email-digital-marketing/articles/KnowledgeBase/6240-Business-Associate-Agreements-BAAs?lang=en_US","entry_url":"https://www.curvecompliance.com/baa-registry/constant-contact","last_checked":"2026-10-01"},{"tool":"Crazy Egg","vendor":"Crazy Egg","category":"Analytics and data","answer":"No public statement","conditions":"HIPAA compliance and a DPA listed; no BAA statement found","quote":"Crazy Egg is compliant with the various pieces of privacy legislation across the globe including GDPR, CCPA, HIPAA, and PIPEDA.","source_url":"https://support.crazyegg.com/knowledge-base/crazy-egg-privacy/","entry_url":"https://www.curvecompliance.com/baa-registry/crazy-egg","last_checked":"2026-10-26"},{"tool":"Customer.io","vendor":"Customer.io","category":"CRM and email","answer":"Signs a BAA on specific plans","conditions":"Premium and Enterprise plans","quote":"Execute a Business Associate Agreement (BAA): You can request to execute a BAA with Customer.io outlining your adherence to HIPAA's privacy and security standards.","source_url":"https://docs.customer.io/journeys/hipaa-standards/","entry_url":"https://www.curvecompliance.com/baa-registry/customer-io","last_checked":"2026-09-29"},{"tool":"CustomerLabs","vendor":"CustomerLabs","category":"HIPAA ad tracking","answer":"Signs a BAA","conditions":"Annex F of its DPA, when customer data includes PHI","quote":"The terms in Annex F apply automatically to the extent Customer is a Covered Entity or Business Associate and Customer Data includes PHI.","source_url":"https://app.customerlabs.com/dpa/","entry_url":"https://www.curvecompliance.com/baa-registry/customerlabs","last_checked":"2026-10-26"},{"tool":"Dialpad","vendor":"Dialpad","category":"Call tracking and phones","answer":"Signs a BAA on specific plans","conditions":"All paid accounts; signed by a Company Admin","quote":"Online BAA signing is available on all paid Dialpad accounts.","source_url":"https://help.dialpad.com/hc/en-us/articles/53072884560283-Sign-a-Business-Associate-Agreement-BAA","entry_url":"https://www.curvecompliance.com/baa-registry/dialpad","last_checked":"2026-10-26"},{"tool":"Documo (mFax)","vendor":"Documo","category":"Messaging and payments","answer":"Signs a BAA","conditions":"Every plan; one BAA covers all Documo products","quote":"Every plan includes a signed BAA, so providers, clinics, and hospitals can handle PHI compliantly from the first login.","source_url":"https://www.documo.com/cloud-fax/","entry_url":"https://www.curvecompliance.com/baa-registry/mfax","last_checked":"2026-10-26"},{"tool":"Docusign","vendor":"Docusign","category":"Forms and landing pages","answer":"Signs a BAA on specific plans","conditions":"Enhanced plans, through sales","quote":"Docusign may enter into a Business Associate Agreement (BAA) with a HIPAA Covered Entity and in these scenarios Docusign agrees to meet HIPAA Business Associate obligations.","source_url":"https://www.docusign.com/solutions/industries/healthcare","entry_url":"https://www.curvecompliance.com/baa-registry/docusign","last_checked":"2026-10-05"},{"tool":"Doximity","vendor":"Doximity","category":"Video, reviews and SMS","answer":"Signs a BAA","conditions":"BAA incorporated into its Terms of Service; tools Doximity identifies as secure","quote":"If you are a “covered entity” under the Health Insurance Portability and Accountability Act (HIPAA) and choose to transmit protected health information using a Doximity tool that we identify as appropriately secure for that purpose, such as our communication tools, AI tools, member messaging, or electronic fax service, such information will be handled in accordance with the Doximity Business Associate Agreement, which is incorporated into the Doximity Terms of Service by reference, or our Business Associate Agreement with the relevant covered entity, as applicable.","source_url":"https://www.doximity.com/clinicians/privacy","entry_url":"https://www.curvecompliance.com/baa-registry/doximity","last_checked":"2026-10-26"},{"tool":"Doxy.me","vendor":"Doxy.me","category":"Video, reviews and SMS","answer":"Signs a BAA","conditions":"All plans; Clinic BAA for groups","quote":"All doxy.me users get a free Business Associate Agreement (BAA). The BAA found on our Free and Professional accounts is meant for individual providers only. If you have more than one provider from your company using doxy.me, chat with us about how to get covered under a Clinic BAA.","source_url":"https://help.doxy.me/en/articles/95880-baa-how-do-i-get-a-baa-with-doxy-me","entry_url":"https://www.curvecompliance.com/baa-registry/doxy-me","last_checked":"2026-09-29"},{"tool":"Drift","vendor":"Salesloft","category":"Support and chat","answer":"Does not sign a BAA","conditions":"Terms bar HIPAA-regulated data","quote":"\"Sensitive Personal Information\" means Personal Data subject to specialized security regimes, including without limitation the Health Insurance Portability and Accountability Act (\"HIPAA\"), and the standards promulgated by the PCI Security Standards Council (\"PCI\").","source_url":"https://www.salesloft.com/legal/drift/terms-of-service","entry_url":"https://www.curvecompliance.com/baa-registry/drift","last_checked":"2026-09-29"},{"tool":"Dropbox","vendor":"Dropbox","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Team plans such as Standard, Advanced, Business and Enterprise","quote":"If you're currently an admin of a Dropbox team account, you can sign a BAA electronically from the Account page in the admin console.","source_url":"https://help.dropbox.com/security/hipaa-hitech-overview","entry_url":"https://www.curvecompliance.com/baa-registry/dropbox","last_checked":"2026-10-05"},{"tool":"eFax","vendor":"eFax","category":"Messaging and payments","answer":"Signs a BAA on specific plans","conditions":"eFax Business, eFax Corporate and eFax Unite","quote":"Products with BAA coverage: eFax® Business, eFax® Corporate, and eFax® Unite.","source_url":"https://www.efax.com/hipaa-compliance","entry_url":"https://www.curvecompliance.com/baa-registry/efax","last_checked":"2026-10-26"},{"tool":"Elevar (now Audiense Online)","vendor":"Audiense","category":"Analytics and data","answer":"No public statement","conditions":"Terms bar customers from providing PHI","quote":"Audiense Online is powered by Elevar","source_url":"https://www.audiense.com/products/audiense-online/","entry_url":"https://www.curvecompliance.com/baa-registry/elevar","last_checked":"2026-10-26"},{"tool":"FaceTime","vendor":"Apple","category":"Video, reviews and SMS","answer":"Does not sign a BAA","conditions":"License bars PHI and business associate use","quote":"If you are a HIPAA covered entity or business associate, you will not use the Apple Software, Apple Services, or any component or function thereof, to create, receive, maintain or transmit any sensitive, individually-identifiable health information, including protected health information, or use the Apple Software or Apple Services in any manner that would make Apple (or any Apple Subsidiary) your or any third party’s business associate.","source_url":"https://www.apple.com/legal/sla/docs/iOS27_iPadOS27.pdf","entry_url":"https://www.curvecompliance.com/baa-registry/facetime","last_checked":"2026-10-05"},{"tool":"Fax.Plus","vendor":"Fax.Plus","category":"Messaging and payments","answer":"Signs a BAA on specific plans","conditions":"Enterprise plan, with Advanced Security Controls","quote":"Enterprise only. Fax.Plus signs BAAs with Enterprise customers, and Advanced Security Controls (ASC) is enabled alongside the BAA for HIPAA compliance.","source_url":"https://www.fax.plus/hipaa-compliant-fax","entry_url":"https://www.curvecompliance.com/baa-registry/fax-plus","last_checked":"2026-10-26"},{"tool":"Feathery","vendor":"Feathery","category":"Forms and landing pages","answer":"No public statement","conditions":"No BAA statement found","quote":"","source_url":"https://www.feathery.io/product/security","entry_url":"https://www.curvecompliance.com/baa-registry/feathery","last_checked":"2026-10-26"},{"tool":"Formsort","vendor":"Formsort","category":"Forms and landing pages","answer":"Signs a BAA on specific plans","conditions":"Enterprise clients; HIPAA compliance listed on the Enterprise plan","quote":"Yes, Formsort is HIPAA compliant and will sign a BAA with enterprise clients.","source_url":"https://formsort.com/pricing/","entry_url":"https://www.curvecompliance.com/baa-registry/formsort","last_checked":"2026-10-26"},{"tool":"Formstack","vendor":"Formstack","category":"Forms and landing pages","answer":"Signs a BAA on specific plans","conditions":"Formstack Forms HIPAA plans","quote":"Business Associate Agreement (BAA): HIPAA compliance regulations require a written contract for every business associate. Obtain consent with Formstack’s Standard BAA, or let us evaluate your custom BAA requests.","source_url":"https://www.formstack.com/features/hipaa-friendly-forms","entry_url":"https://www.curvecompliance.com/baa-registry/formstack","last_checked":"2026-10-01"},{"tool":"Freshpaint","vendor":"Freshpaint","category":"HIPAA ad tracking","answer":"Signs a BAA","conditions":"BAA in place before any PHI","quote":"Freshpaint is built specifically for HIPAA-regulated environments and offers a Business Associate Agreement (BAA).","source_url":"https://www.freshpaint.io/faq","entry_url":"https://www.curvecompliance.com/baa-registry/freshpaint","last_checked":"2026-10-26"},{"tool":"FullStory","vendor":"Fullstory","category":"Analytics and data","answer":"Signs a BAA","conditions":"BAA available; health data still prohibited","quote":"Yes, Fullstory provides our BAA to support our Customer's respective HIPAA obligations when using our services.","source_url":"https://help.fullstory.com/hc/en-us/articles/17635706856599-Business-Associate-Agreement-BAA","entry_url":"https://www.curvecompliance.com/baa-registry/fullstory","last_checked":"2026-09-29"},{"tool":"Gemini","vendor":"Google","category":"AI assistants","answer":"Signs a BAA on specific plans","conditions":"Google Workspace accounts: Gemini app as a Workspace Core Service and Gemini in Workspace","quote":"When using the Gemini app as a Google Workspace Core Service via gemini.google.com or mobile application with PHI within the applicable HIPAA Included Functionality, the same recommendations provided in this guide will apply.","source_url":"https://services.google.com/fh/files/misc/gsuite_cloud_identity_hipaa_implementation_guide.pdf","entry_url":"https://www.curvecompliance.com/baa-registry/gemini","last_checked":"2026-10-05"},{"tool":"Gmail","vendor":"Google","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Google Workspace accounts, after an administrator accepts Google's BAA","quote":"Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.","source_url":"https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity","entry_url":"https://www.curvecompliance.com/baa-registry/gmail","last_checked":"2026-10-05"},{"tool":"GoDaddy","vendor":"GoDaddy","category":"Site builders","answer":"Signs a BAA on specific plans","conditions":"Microsoft 365 email from GoDaddy, with HIPAA compliant email","quote":"No, by offering a BAA, GoDaddy and Microsoft help support your HIPAA compliance, but using this service doesn't achieve compliance on its own.","source_url":"https://www.godaddy.com/help/what-is-hipaa-and-hipaa-compliant-email-20150","entry_url":"https://www.curvecompliance.com/baa-registry/godaddy","last_checked":"2026-10-26"},{"tool":"GoHighLevel","vendor":"HighLevel","category":"CRM and email","answer":"Signs a BAA on specific plans","conditions":"Paid HIPAA Compliance add-on, any agency plan","quote":"HighLevel offers an optional, account-wide HIPAA add-on that enables encryption of ePHI, Business-Associate Agreements (BAAs), audit logging, and MFA enforcement.","source_url":"https://help.gohighlevel.com/support/solutions/articles/48000983084-hipaa-compliance-with-highlevel","entry_url":"https://www.curvecompliance.com/baa-registry/gohighlevel","last_checked":"2026-09-29"},{"tool":"Google Ads","vendor":"Google","category":"Ad platforms","answer":"Does not sign a BAA","conditions":"Google Ads call terms disclaim HIPAA","quote":"Unless otherwise specified in writing by Google, Google does not intend use of the Communication Features to create obligations under the Health Insurance Portability and Accountability Act, as amended (“HIPAA”), and makes no representations that the Communication Features satisfy HIPAA requirements.","source_url":"https://support.google.com/google-ads/answer/16914745","entry_url":"https://www.curvecompliance.com/baa-registry/google-ads","last_checked":"2026-09-29"},{"tool":"Google Analytics 4","vendor":"Google","category":"Analytics and data","answer":"Does not sign a BAA","conditions":"No BAA for Google Analytics","quote":"Google makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service.","source_url":"https://support.google.com/analytics/answer/13297105","entry_url":"https://www.curvecompliance.com/baa-registry/google-analytics-4","last_checked":"2026-09-29"},{"tool":"Google Calendar","vendor":"Google","category":"Scheduling and intake","answer":"Signs a BAA on specific plans","conditions":"Google Workspace accounts, after an administrator accepts Google's BAA","quote":"Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.","source_url":"https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity","entry_url":"https://www.curvecompliance.com/baa-registry/google-calendar","last_checked":"2026-10-26"},{"tool":"Google Cloud","vendor":"Google","category":"Automation and workspace","answer":"Signs a BAA","conditions":"Google Cloud BAA; listed supported products","quote":"Google enters into Business Associate Agreements as necessary under HIPAA.","source_url":"https://docs.cloud.google.com/docs/security/compliance/hipaa","entry_url":"https://www.curvecompliance.com/baa-registry/google-cloud","last_checked":"2026-10-05"},{"tool":"Google Docs","vendor":"Google","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Google Workspace accounts, after an administrator accepts Google's BAA","quote":"Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.","source_url":"https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity","entry_url":"https://www.curvecompliance.com/baa-registry/google-docs","last_checked":"2026-10-26"},{"tool":"Google Drive","vendor":"Google","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Google Workspace accounts, after an administrator accepts Google's BAA","quote":"Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.","source_url":"https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity","entry_url":"https://www.curvecompliance.com/baa-registry/google-drive","last_checked":"2026-10-05"},{"tool":"Google Forms","vendor":"Google","category":"Forms and landing pages","answer":"Signs a BAA on specific plans","conditions":"Google Workspace accounts, after an administrator accepts Google's BAA","quote":"Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.","source_url":"https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity","entry_url":"https://www.curvecompliance.com/baa-registry/google-forms","last_checked":"2026-10-05"},{"tool":"Google Meet","vendor":"Google","category":"Video, reviews and SMS","answer":"Signs a BAA on specific plans","conditions":"Google Workspace accounts, after an administrator accepts Google's BAA","quote":"Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.","source_url":"https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity","entry_url":"https://www.curvecompliance.com/baa-registry/google-meet","last_checked":"2026-10-05"},{"tool":"Google Sheets","vendor":"Google","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Google Workspace accounts, after an administrator accepts Google's BAA","quote":"Google Workspace and Cloud Identity customers who are subject to HIPAA and wish to use certain Google Workspace or Cloud Identity services listed on the HIPAA Included Functionality list must enter a Business Associate Amendment (BAA) with Google.","source_url":"https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity","entry_url":"https://www.curvecompliance.com/baa-registry/google-sheets","last_checked":"2026-10-26"},{"tool":"Google Tag Manager","vendor":"Google","category":"Analytics and data","answer":"No public statement","conditions":"Use Policy bars personally identifying data","quote":"to upload any data to Google Tag Manager that personally identifies an individual (such as a name, email address or billing information), or other data which can be reasonably linked to such information by Google","source_url":"https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/","entry_url":"https://www.curvecompliance.com/baa-registry/google-tag-manager","last_checked":"2026-09-29"},{"tool":"Google Voice","vendor":"Google","category":"Call tracking and phones","answer":"Signs a BAA on specific plans","conditions":"Licensed users managed in Google Workspace","quote":"Licensed users of Google Voice are covered under the Google Workspace BAA. Administrators should obtain Google Voice licenses for users that handle PHI.","source_url":"https://services.google.com/fh/files/misc/gsuite_cloud_identity_hipaa_implementation_guide.pdf","entry_url":"https://www.curvecompliance.com/baa-registry/google-voice","last_checked":"2026-10-05"},{"tool":"Google Workspace","vendor":"Google","category":"Automation and workspace","answer":"Signs a BAA","conditions":"Covered services such as Gmail, Drive and Meet","quote":"This HIPAA Business Associate Addendum (“BAA”) is entered into between Google and the customer agreeing to the terms below (\"Customer\"), and supplements, amends and is incorporated into the Services Agreement(s) (defined below) solely with respect to Covered Services (defined below).","source_url":"https://workspace.google.com/terms/2015/1/hipaa_baa/","entry_url":"https://www.curvecompliance.com/baa-registry/google-workspace","last_checked":"2026-09-29"},{"tool":"Grammarly","vendor":"Grammarly","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Grammarly for Business Enterprise plans","quote":"If you require a BAA (business associate agreement) in order to comply with HIPAA, please be aware that currently, we can enter into BAAs only for Grammarly for Business Enterprise plans.","source_url":"https://support.grammarly.com/hc/en-us/articles/4403227220237-Is-Grammarly-HIPAA-compliant","entry_url":"https://www.curvecompliance.com/baa-registry/grammarly","last_checked":"2026-10-05"},{"tool":"Grasshopper","vendor":"Grasshopper","category":"Call tracking and phones","answer":"Does not sign a BAA","conditions":"Says it is not HIPAA compliant; BAA requests go to Contact Support","quote":"At this time, Grasshopper is not HIPAA compliant.","source_url":"https://support.grasshopper.com/help/is-grasshopper-hipaa-compliant","entry_url":"https://www.curvecompliance.com/baa-registry/grasshopper","last_checked":"2026-10-26"},{"tool":"Gravity Forms","vendor":"Gravity Forms","category":"Forms and landing pages","answer":"Does not sign a BAA","conditions":"Will not sign; your host holds the data","quote":"As we do not host or store your collected form data on your behalf, we will not sign any such agreements. This is a conversation to be had with your website host or data services provider.","source_url":"https://docs.gravityforms.com/hipaa-and-gravity-forms/","entry_url":"https://www.curvecompliance.com/baa-registry/gravity-forms","last_checked":"2026-09-29"},{"tool":"Healthie","vendor":"Healthie","category":"Scheduling and intake","answer":"Signs a BAA","conditions":"Entered into when your account is created","quote":"This Agreement “Agreement” is made and entered into at the date and time your Healthie account is created as in between you (“Covered Entity”) and Healthie Inc (“Business Associate”), (individually a “Party,” and collectively the “Parties”), to define their respective rights and responsibilities with respect to the privacy and security of certain health information in connection with certain federal laws.","source_url":"https://www.gethealthie.com/baa","entry_url":"https://www.curvecompliance.com/baa-registry/healthie","last_checked":"2026-10-01"},{"tool":"Heap","vendor":"Heap","category":"Analytics and data","answer":"Signs a BAA","conditions":"BAA through Heap","quote":"Heap is not just HIPAA compliant but also signs BAAs with customers and requires all new hires to undergo HIPAA training as part of onboarding.","source_url":"https://www.heap.io/blog/why-ga4-isnt-best-for-hipaa","entry_url":"https://www.curvecompliance.com/baa-registry/heap","last_checked":"2026-09-29"},{"tool":"Hightouch","vendor":"Hightouch","category":"Analytics and data","answer":"Signs a BAA on specific plans","conditions":"Customer Data Platform and AI Decisioning plans","quote":"Custom Security Review (BAA, DPA, full SOC2 report)","source_url":"https://hightouch.com/pricing","entry_url":"https://www.curvecompliance.com/baa-registry/hightouch","last_checked":"2026-10-26"},{"tool":"Hotjar","vendor":"Hotjar","category":"Analytics and data","answer":"No public statement","conditions":"No BAA statement found","quote":"","source_url":"https://help.hotjar.com/hc/en-us/articles/36820004397713-Privacy-FAQs","entry_url":"https://www.curvecompliance.com/baa-registry/hotjar","last_checked":"2026-09-29"},{"tool":"HubSpot","vendor":"HubSpot","category":"CRM and email","answer":"Signs a BAA on specific plans","conditions":"Enterprise subscriptions with Sensitive Data enabled","quote":"To store HIPAA-covered data, you must select both the Health/Medical Data checkbox and the We are a HIPAA-covered entity or business associate checkbox.","source_url":"https://knowledge.hubspot.com/account-security/store-sensitive-data","entry_url":"https://www.curvecompliance.com/baa-registry/hubspot","last_checked":"2026-09-29"},{"tool":"Hushmail","vendor":"Hushmail","category":"CRM and email","answer":"Signs a BAA on specific plans","conditions":"Hushmail for Healthcare plans (Basic, Essentials, Growth) and Hushmail for Professionals","quote":"Get a signed business associate agreement (BAA) for healthcare providers","source_url":"https://www.hushmail.com/plans/healthcare-hipaa-compliant-email","entry_url":"https://www.curvecompliance.com/baa-registry/hushmail","last_checked":"2026-10-26"},{"tool":"iCloud","vendor":"Apple","category":"Automation and workspace","answer":"Does not sign a BAA","conditions":"Terms bar PHI and business associate use","quote":"If you are a covered entity, business associate or representative of a covered entity or business associate (as those terms are defined at 45 C.F.R § 160.103), You agree that you will not use any component, function or other facility of the Service to create, receive, maintain or transmit any “protected health information” (as such term is defined at 45 C.F.R § 160.103) or use the Service in any manner that would make Apple (or any Apple Subsidiary) your or any third party’s business associate.","source_url":"https://www.apple.com/legal/internet-services/icloud/","entry_url":"https://www.curvecompliance.com/baa-registry/icloud","last_checked":"2026-10-05"},{"tool":"iMessage","vendor":"Apple","category":"Messaging and payments","answer":"Does not sign a BAA","conditions":"License bars PHI and business associate use","quote":"If you are a HIPAA covered entity or business associate, you will not use the Apple Software, Apple Services, or any component or function thereof, to create, receive, maintain or transmit any sensitive, individually-identifiable health information, including protected health information, or use the Apple Software or Apple Services in any manner that would make Apple (or any Apple Subsidiary) your or any third party’s business associate.","source_url":"https://www.apple.com/legal/sla/docs/iOS27_iPadOS27.pdf","entry_url":"https://www.curvecompliance.com/baa-registry/imessage","last_checked":"2026-10-05"},{"tool":"IntakeQ","vendor":"IntakeQ","category":"Scheduling and intake","answer":"Signs a BAA","conditions":"Signed in the account by the admin","quote":"Because IntakeQ has access to your clients' Protected Health Information, it's important to have a Business Associate Agreement, or BAA, on file.","source_url":"https://support.intakeq.com/article/1070-sign-and-access-your-baa","entry_url":"https://www.curvecompliance.com/baa-registry/intakeq","last_checked":"2026-09-29"},{"tool":"Intercom","vendor":"Intercom","category":"Support and chat","answer":"Signs a BAA on specific plans","conditions":"Expert plan","quote":"If your business is required to be HIPAA compliant, we can enter into a business associate agreement with your organization.","source_url":"https://www.intercom.com/help/en/articles/8827723-contacts-faqs","entry_url":"https://www.curvecompliance.com/baa-registry/intercom","last_checked":"2026-09-29"},{"tool":"Invoca","vendor":"Invoca","category":"Call tracking and phones","answer":"Signs a BAA","conditions":"Standard BAA, or the customer's own on review","quote":"For customers who are subject to HIPAA, Invoca offers an industry-standard BAA template easing the process of obtaining legal review and signature. Customers who have a BAA template tailored for software vendors that they prefer can request Invoca review and sign their version.","source_url":"https://www.invoca.com/legal/hipaa-compliance","entry_url":"https://www.curvecompliance.com/baa-registry/invoca","last_checked":"2026-09-29"},{"tool":"Iterable","vendor":"Iterable","category":"CRM and email","answer":"No public statement","conditions":"HIPAA compliance listed; no BAA statement found","quote":"Iterable maintains the highest global standards for data security, including SOC 2, ISO 27001, and HIPAA compliance.","source_url":"https://trust.iterable.com/","entry_url":"https://www.curvecompliance.com/baa-registry/iterable","last_checked":"2026-10-01"},{"tool":"Jane App","vendor":"Jane","category":"Scheduling and intake","answer":"Signs a BAA","conditions":"BAA arranged with Jane","quote":"Yes, Jane is HIPAA compliant.","source_url":"https://jane.app/guide/is-jane-hipaa-compliant","entry_url":"https://www.curvecompliance.com/baa-registry/jane-app","last_checked":"2026-09-29"},{"tool":"JENTIS","vendor":"JENTIS","category":"HIPAA ad tracking","answer":"No public statement","conditions":"No BAA statement found","quote":"","source_url":"https://www.jentis.com/blog/solve-hipaa-with-jentis","entry_url":"https://www.curvecompliance.com/baa-registry/jentis","last_checked":"2026-10-26"},{"tool":"Jotform","vendor":"Jotform","category":"Forms and landing pages","answer":"Signs a BAA on specific plans","conditions":"Gold and Enterprise, with HIPAA features enabled","quote":"We are offering HIPAA compliance features on the Gold subscription and on Jotform Enterprise.","source_url":"https://www.jotform.com/help/500-how-to-enable-hipaa-compliance/","entry_url":"https://www.curvecompliance.com/baa-registry/jotform","last_checked":"2026-09-29"},{"tool":"Keap","vendor":"Keap","category":"CRM and email","answer":"Signs a BAA","conditions":"Standard BAA after enabling HIPAA controls","quote":"Keap offers customers the opportunity to execute our standard Business Associate Agreement Addendum (or “BAA”) that satisfies the applicable subcontracting requirements under HIPAA and the HITECH Act.","source_url":"https://learn.thryv.com/hc/en-us/articles/37506928781325","entry_url":"https://www.curvecompliance.com/baa-registry/keap","last_checked":"2026-10-01"},{"tool":"Klaviyo","vendor":"Klaviyo","category":"CRM and email","answer":"Does not sign a BAA","conditions":"Acceptable Use Policy bars PHI","quote":"You may not solicit, store, process, send, or transmit any of the following types of data or information in the Klaviyo platform:","source_url":"https://www.klaviyo.com/legal/acceptable-use-policy","entry_url":"https://www.curvecompliance.com/baa-registry/klaviyo","last_checked":"2026-09-29"},{"tool":"Liine","vendor":"Liine","category":"Call tracking and phones","answer":"Signs a BAA","conditions":"BAA attached to its Terms of Service","quote":"If and to the extent you are a “covered entity” or a “business associate” and your Content includes “protected health information,” as those terms are defined in 45 CFR § 160.103, the HIPAA Business Associate Addendum (“BAA”) attached as Exhibit A hereto will apply to Liine’s provision and your use of the Software and Services","source_url":"https://www.liine.com/termsofservice/","entry_url":"https://www.curvecompliance.com/baa-registry/liine","last_checked":"2026-10-26"},{"tool":"LinkedIn Ads","vendor":"LinkedIn","category":"Ad platforms","answer":"Does not sign a BAA","conditions":"Ads Agreement bars Sensitive Data, including medical","quote":"You will also not transfer to LinkedIn any data that you know or reasonably should know was (1) collected from or about children under the age of 16, or (2) constitutes Sensitive Data, including by way of installing the Insight Tag on a page that collects medical, financial, or other Sensitive Data about identified or identifiable individuals.","source_url":"https://www.linkedin.com/legal/sas-terms","entry_url":"https://www.curvecompliance.com/baa-registry/linkedin-ads","last_checked":"2026-10-01"},{"tool":"Looker Studio","vendor":"Google","category":"Analytics and data","answer":"Signs a BAA","conditions":"Under the Google Cloud Platform BAA","quote":"Customers who are subject to HIPAA and wish to use Data Studio with PHI must execute a Google Cloud Platform Business Associate Agreement (BAA) with Google before proceeding. Customers who have not signed the Google Cloud Platform BAA with Google must not use Data Studio in connection with PHI.","source_url":"https://cloud.google.com/looker/docs/studio/looker-studio-hipaa-implementation-guide","entry_url":"https://www.curvecompliance.com/baa-registry/looker-studio","last_checked":"2026-09-29"},{"tool":"Loom","vendor":"Atlassian","category":"Video, reviews and SMS","answer":"Does not sign a BAA","conditions":"Not able to sign BAAs; keep PHI out","quote":"Loom currently is not able to sign Business Associate Agreements in support of customers’ compliance with the Health Insurance Portability and Accountability Act (HIPAA).","source_url":"https://support.atlassian.com/loom/docs/is-loom-hipaa-compliant/","entry_url":"https://www.curvecompliance.com/baa-registry/loom","last_checked":"2026-10-26"},{"tool":"Lucky Orange","vendor":"Lucky Orange","category":"Analytics and data","answer":"No public statement","conditions":"DPA bars sensitive data unless agreed in writing; no BAA statement found","quote":"The Service is not designed to Process Sensitive Data, and Lucky Orange shall have no obligation to implement additional safeguards specific to such data.","source_url":"https://www.luckyorange.com/legal/data-processing-agreement","entry_url":"https://www.curvecompliance.com/baa-registry/lucky-orange","last_checked":"2026-10-26"},{"tool":"Mailchimp","vendor":"Mailchimp","category":"CRM and email","answer":"Does not sign a BAA","conditions":"Data Processing Addendum bars health information","quote":"Customer will not provide (or cause to be provided) any Sensitive Data to Mailchimp for processing under the Agreement, and Mailchimp will have no liability whatsoever for Sensitive Data, whether in connection with a Security Incident or otherwise.","source_url":"https://mailchimp.com/legal/data-processing-addendum/","entry_url":"https://www.curvecompliance.com/baa-registry/mailchimp","last_checked":"2026-09-29"},{"tool":"Mailgun","vendor":"Mailgun","category":"CRM and email","answer":"Signs a BAA","conditions":"HIPAA Addendum to the Mailgun Terms of Service","quote":"This HIPAA Business Association Addendum (this “HIPAA Addendum”) is an addendum to the Mailgun Terms of Service (the “Terms”).","source_url":"https://www.mailgun.com/legal/hipaa-baa/","entry_url":"https://www.curvecompliance.com/baa-registry/mailgun","last_checked":"2026-10-01"},{"tool":"Make.com","vendor":"Make","category":"Automation and workspace","answer":"No public statement","conditions":"No BAA statement found","quote":"Make has ISO 27001 certificate (you can find it here) and we are currently concentrating on other certificates (such as SOC 2) and evaluating the customer's demand for other certificates (including HIPAA).","source_url":"https://community.make.com/t/sign-baa-for-hipaa-compliance/62960","entry_url":"https://www.curvecompliance.com/baa-registry/make","last_checked":"2026-09-29"},{"tool":"Matomo","vendor":"Matomo","category":"Analytics and data","answer":"Does not sign a BAA","conditions":"Cloud not HIPAA compliant; no BAA for self-hosted","quote":"The official Matomo Cloud service is not HIPAA compliant.","source_url":"https://matomo.org/faq/new-to-piwik/matomo-analytics-hipaa-compliance/","entry_url":"https://www.curvecompliance.com/baa-registry/matomo","last_checked":"2026-10-26"},{"tool":"Meta","vendor":"Meta","category":"Ad platforms","answer":"Does not sign a BAA","conditions":"Business Tools Terms bar health information","quote":"You represent and warrant that you will not share Business Tool Data with us that (i) you know or reasonably should know is from or about children under the age of 13, (ii) includes Contact Information not hashed in accordance with Section 1.a.i, (iii) includes identifiers we do not permit, such as social security or credit card numbers, or (iv) includes or is based on, directly or otherwise, health information, financial information, consumer report information, or other categories of sensitive information (including any information defined as sensitive under applicable laws, regulations and applicable industry guidelines).","source_url":"https://www.facebook.com/legal/businesstech","entry_url":"https://www.curvecompliance.com/baa-registry/meta","last_checked":"2026-09-29"},{"tool":"Microsoft 365","vendor":"Microsoft","category":"Automation and workspace","answer":"Signs a BAA","conditions":"By default through Microsoft's Data Protection Addendum; in-scope services","quote":"The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA.","source_url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech","entry_url":"https://www.curvecompliance.com/baa-registry/microsoft-365","last_checked":"2026-09-29"},{"tool":"Microsoft Advertising","vendor":"Microsoft","category":"Ad platforms","answer":"Does not sign a BAA","conditions":"No BAA for UET; keep UET off HIPAA pages","quote":"Microsoft does not offer Business Associate Agreements (BAAs) for UET and does not represent that UET meets HIPAA requirements.","source_url":"https://help.ads.microsoft.com/#apex/ads/en/60301/2","entry_url":"https://www.curvecompliance.com/baa-registry/microsoft-advertising","last_checked":"2026-10-01"},{"tool":"Microsoft Azure","vendor":"Microsoft","category":"Automation and workspace","answer":"Signs a BAA","conditions":"By default through the Microsoft Product Terms; in-scope Azure services","quote":"To support our customers who are subject to HIPAA compliance, Microsoft will enter into BAAs with its covered entity and business associate customers.","source_url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hipaa-us","entry_url":"https://www.curvecompliance.com/baa-registry/microsoft-azure","last_checked":"2026-10-05"},{"tool":"Microsoft Clarity","vendor":"Microsoft","category":"Analytics and data","answer":"Does not sign a BAA","conditions":"Terms bar health care content","quote":"You will not use the Offering in connection with content which may contain sensitive user materials, such as health care, financial services or government-related information.","source_url":"https://clarity.microsoft.com/terms","entry_url":"https://www.curvecompliance.com/baa-registry/microsoft-clarity","last_checked":"2026-09-29"},{"tool":"Microsoft Copilot","vendor":"Microsoft","category":"AI assistants","answer":"Signs a BAA on specific plans","conditions":"Work or school (Microsoft Entra) accounts on Office 365 Commercial or GCC; web search queries excluded","quote":"Microsoft Copilot Chat supports the BAA and HIPAA compliance for prompts and responses for properly configured implementations. HIPAA compliance does not apply to web search queries as they are not covered by the DPA and BAA.","source_url":"https://learn.microsoft.com/en-us/copilot/faq","entry_url":"https://www.curvecompliance.com/baa-registry/microsoft-copilot","last_checked":"2026-10-05"},{"tool":"Microsoft Forms","vendor":"Microsoft","category":"Forms and landing pages","answer":"Signs a BAA on specific plans","conditions":"Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum","quote":"Yes. Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services.","source_url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech","entry_url":"https://www.curvecompliance.com/baa-registry/microsoft-forms","last_checked":"2026-10-05"},{"tool":"Microsoft Teams","vendor":"Microsoft","category":"Video, reviews and SMS","answer":"Signs a BAA on specific plans","conditions":"Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum","quote":"Yes. Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services.","source_url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech","entry_url":"https://www.curvecompliance.com/baa-registry/microsoft-teams","last_checked":"2026-10-05"},{"tool":"Mindbody","vendor":"Mindbody","category":"Scheduling and intake","answer":"Signs a BAA","conditions":"On request for US businesses subject to HIPAA; covers SOAP Notes and Progress Notes only","quote":"If you or any Affiliate is subject to HIPAA and providing or processing any PHI in connection with the Services, prior to accessing or using the Services you must notify Mindbody and enter into a Business Associate Agreement (\"BAA\") in the form provided by Mindbody.","source_url":"https://company.mindbodyonline.com/legal/terms-of-service","entry_url":"https://www.curvecompliance.com/baa-registry/mindbody","last_checked":"2026-10-26"},{"tool":"Mixpanel","vendor":"Mixpanel","category":"Analytics and data","answer":"Signs a BAA on specific plans","conditions":"Enterprise Plan","quote":"Mixpanel's SOC 2, ISO27001 Data Center, GDPR, and EU-US Data Privacy Framework compliant data centers, along with our standard Business Associates Agreement (“BAA”), help our Enterprise Plan customers maintain their HIPAA compliance.","source_url":"https://mixpanel.com/legal/mixpanel-hipaa/","entry_url":"https://www.curvecompliance.com/baa-registry/mixpanel","last_checked":"2026-09-29"},{"tool":"monday.com","vendor":"monday.com","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Enterprise plan with the HIPAA compliance feature enabled","quote":"To sign a BAA with us, you can either (i) countersign the online version of this BAA posted at www.monday.com/terms/hipaa-baa, using the “Sign Online Version” link to sign through DocuSign or (ii) if you are the Admin, by clicking the “I Accept” button on the monday.com Platform when enabling the HIPAA compliant feature.","source_url":"https://monday.com/l/privacy/hipaa-baa/","entry_url":"https://www.curvecompliance.com/baa-registry/monday-com","last_checked":"2026-10-05"},{"tool":"Mouseflow","vendor":"Mouseflow","category":"Analytics and data","answer":"Signs a BAA on specific plans","conditions":"Enterprise plans, on negotiated terms","quote":"Commercial terms are open to discussion, with room for a Business Associate Agreement or a DORA addendum where the industry requires one.","source_url":"https://mouseflow.com/legal/compliance/","entry_url":"https://www.curvecompliance.com/baa-registry/mouseflow","last_checked":"2026-10-26"},{"tool":"Nextiva","vendor":"Nextiva","category":"Call tracking and phones","answer":"Signs a BAA","conditions":"Covered services","quote":"HIPAA-compliant with a signed BAA.","source_url":"https://www.nextiva.com/industry/healthcare","entry_url":"https://www.curvecompliance.com/baa-registry/nextiva","last_checked":"2026-10-26"},{"tool":"Northbeam","vendor":"Northbeam","category":"Analytics and data","answer":"Does not sign a BAA","conditions":"Terms bar Personal Health Information","quote":"Customer shall not store, or process Sensitive Personal Information in the Company Solution, including but not limited to Personal Health Information, as defined by the Health Insurance Portability and Accountability Act.","source_url":"https://www.northbeam.io/terms-conditions","entry_url":"https://www.curvecompliance.com/baa-registry/northbeam","last_checked":"2026-10-26"},{"tool":"Notion","vendor":"Notion","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Enterprise Plan; Beta Services excluded","quote":"Notion's Business Associate Agreement (BAA) governs the protection of Personal Health Information (PHI) that is stored in the Notion Service. To be eligible to sign Notion’s BAA, you must subscribe to our Enterprise Plan.","source_url":"https://www.notion.com/help/hipaa","entry_url":"https://www.curvecompliance.com/baa-registry/notion","last_checked":"2026-10-05"},{"tool":"OnceHub","vendor":"OnceHub","category":"Scheduling and intake","answer":"Signs a BAA on specific plans","conditions":"Security and Compliance Add-On on a paid plan; included on Enterprise","quote":"We willingly enter into a Business Associate Agreement (BAA) with you, as HIPAA requires.","source_url":"https://www.oncehub.com/solutions/hipaa-services","entry_url":"https://www.curvecompliance.com/baa-registry/oncehub","last_checked":"2026-10-26"},{"tool":"OneDrive","vendor":"Microsoft","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"OneDrive for Business on Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum","quote":"The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA.","source_url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech","entry_url":"https://www.curvecompliance.com/baa-registry/onedrive","last_checked":"2026-10-26"},{"tool":"OpenEvidence","vendor":"OpenEvidence","category":"AI assistants","answer":"Signs a BAA","conditions":"Healthcare providers that are covered entities; BAA is part of the Terms of Use","quote":"We securely store, process, and transmit PHI according to our standard Business Associate Agreement or other customer-specific agreements.","source_url":"https://www.openevidence.com/security","entry_url":"https://www.curvecompliance.com/baa-registry/openevidence","last_checked":"2026-10-26"},{"tool":"Optimizely","vendor":"Optimizely","category":"Analytics and data","answer":"Signs a BAA on specific plans","conditions":"Enterprise customers; HIPAA-ready CMS and Web and Feature Experimentation","quote":"Signing Business Associate Agreements (BAAs) with enterprise customers","source_url":"https://www.optimizely.com/trust-center/compliance","entry_url":"https://www.curvecompliance.com/baa-registry/optimizely","last_checked":"2026-10-26"},{"tool":"Otter.ai","vendor":"Otter.ai","category":"AI assistants","answer":"Signs a BAA on specific plans","conditions":"Enterprise plan","quote":"HIPAA compliance is only available for the Enterprise plan.","source_url":"https://help.otter.ai/hc/en-us/articles/33975072019991-HIPAA-Otter-ai","entry_url":"https://www.curvecompliance.com/baa-registry/otter-ai","last_checked":"2026-10-05"},{"tool":"Outlook","vendor":"Microsoft","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Exchange Online on Office 365 Commercial or GCC subscriptions","quote":"Yes. Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services.","source_url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech","entry_url":"https://www.curvecompliance.com/baa-registry/outlook","last_checked":"2026-10-05"},{"tool":"PandaDoc","vendor":"PandaDoc","category":"Forms and landing pages","answer":"Signs a BAA on specific plans","conditions":"Annual Enterprise plans; request through PandaDoc support or sales","quote":"In order to transmit electronic Protected Health Information (ePHI) using PandaDoc and maintain it with HIPAA compliance, customers should sign a Business Associate Agreement (BAA) with PandaDoc.","source_url":"https://www.pandadoc.com/hipaa/","entry_url":"https://www.curvecompliance.com/baa-registry/pandadoc","last_checked":"2026-10-26"},{"tool":"Paubox","vendor":"Paubox","category":"CRM and email","answer":"Signs a BAA","conditions":"All accounts","quote":"Paubox includes a BAA with all accounts.","source_url":"https://www.paubox.com/pricing/paubox-email-suite","entry_url":"https://www.curvecompliance.com/baa-registry/paubox","last_checked":"2026-10-26"},{"tool":"PayPal","vendor":"PayPal","category":"Messaging and payments","answer":"No public statement","conditions":"No BAA statement found; PHI barred in Invoicing","quote":"If you are subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as a Covered Entity or Business Associate (as defined in HIPAA), you covenant and agree that you will not use Invoicing in a manner that causes PayPal to create, receive, maintain or transmit Protected Health Information (PHI) on your behalf.","source_url":"https://www.paypal.com/us/legalhub/paypal/invoicing-tnc","entry_url":"https://www.curvecompliance.com/baa-registry/paypal","last_checked":"2026-10-05"},{"tool":"Pendo","vendor":"Pendo","category":"Analytics and data","answer":"Signs a BAA","conditions":"HIPAA customers","quote":"Pendo supports HIPAA customers via a Business Associate Agreement.","source_url":"https://www.pendo.io/pendo-blog/how-to-get-pendos-ai-features-approved-at-your-company/","entry_url":"https://www.curvecompliance.com/baa-registry/pendo","last_checked":"2026-10-26"},{"tool":"Pinterest Ads","vendor":"Pinterest","category":"Ad platforms","answer":"Does not sign a BAA","conditions":"Ad Data Terms bar sensitive categories","quote":"Don’t give us Ad Data that relates to sensitive categories","source_url":"https://policy.pinterest.com/en/ad-data-terms","entry_url":"https://www.curvecompliance.com/baa-registry/pinterest-ads","last_checked":"2026-10-01"},{"tool":"Pipedrive","vendor":"Pipedrive","category":"CRM and email","answer":"Does not sign a BAA","conditions":"Terms: not designed for HIPAA; sensitive information barred","quote":"Pipedrive Services are not designed to comply with industry-specific regulations such as the Health Insurance Portability and Accountability Act (HIPAA) or the Federal Information Security Management Act (FISMA).","source_url":"https://www.pipedrive.com/en/terms-of-service","entry_url":"https://www.curvecompliance.com/baa-registry/pipedrive","last_checked":"2026-10-05"},{"tool":"Piwik PRO","vendor":"Piwik PRO","category":"Analytics and data","answer":"Signs a BAA on specific plans","conditions":"Enterprise plan: Trusted Insights and Secure Intelligence tiers","quote":"Piwik PRO signs a BAA in the Enterprise plan, making it a suitable option for organizations that must comply with HIPAA.","source_url":"https://piwik.pro/pricing/","entry_url":"https://www.curvecompliance.com/baa-registry/piwik-pro","last_checked":"2026-10-26"},{"tool":"Plaud","vendor":"Plaud Inc.","category":"AI assistants","answer":"Signs a BAA","conditions":"On request, through Plaud's privacy team","quote":"To request a signed Business Associate Agreement (BAA), contact privacy@plaud.ai.","source_url":"https://support.plaud.ai/hc/en-us/articles/53443476408985-Does-Plaud-automatically-mask-remove-patient-identifiable-information-before-using-AI","entry_url":"https://www.curvecompliance.com/baa-registry/plaud","last_checked":"2026-10-26"},{"tool":"Podium","vendor":"Podium","category":"Video, reviews and SMS","answer":"Signs a BAA","conditions":"Covered entities and business associates, under Podium's terms","quote":"If Client is a Covered Entity or Business Associate, as defined in HIPAA, Podium and Client agree to the terms of Podium's BAA (currently available at https://legal.podium.com/#baa), which may be amended from time to time, and to secure and utilize PHI in accordance with the BAA.","source_url":"https://legal.podium.com/","entry_url":"https://www.curvecompliance.com/baa-registry/podium","last_checked":"2026-09-29"},{"tool":"PostHog","vendor":"PostHog","category":"Analytics and data","answer":"Signs a BAA on specific plans","conditions":"PostHog Cloud on Boost, Scale or Enterprise","quote":"PostHog only offers Business Associate Agreements (BAAs) for PostHog Cloud to users with the Boost, Scale, or Enterprise package. You can use our BAA generator to create a BAA for us to countersign.","source_url":"https://posthog.com/docs/privacy/hipaa-compliance","entry_url":"https://www.curvecompliance.com/baa-registry/posthog","last_checked":"2026-09-29"},{"tool":"Postmark","vendor":"Postmark","category":"CRM and email","answer":"Does not sign a BAA","conditions":"Not HIPAA-compliant; cannot sign BAAs","quote":"Postmark is not HIPAA-compliant so we do not recommend using our platform if you need to send HIPAA-compliant emails.","source_url":"https://postmarkapp.com/support/article/1041-is-postmark-hipaa-compliant","entry_url":"https://www.curvecompliance.com/baa-registry/postmark","last_checked":"2026-10-01"},{"tool":"Proton Mail","vendor":"Proton","category":"CRM and email","answer":"Signs a BAA","conditions":"Signed on request; contact Proton","quote":"You can download our Business Associate Agreement here. Simply contact us if you need it signed.","source_url":"https://proton.me/business/blog/hipaa-compliant-email-guide","entry_url":"https://www.curvecompliance.com/baa-registry/proton-mail","last_checked":"2026-10-26"},{"tool":"Qualtrics","vendor":"Qualtrics","category":"Forms and landing pages","answer":"Signs a BAA","conditions":"On request, for customers who are covered entities","quote":"Upon request, Qualtrics will execute BAAs with its customers who are covered entities.","source_url":"https://www.qualtrics.com/articles/customer-experience/safeguarding-patient-information-in-the-digital-age/","entry_url":"https://www.curvecompliance.com/baa-registry/qualtrics","last_checked":"2026-10-26"},{"tool":"QuickBooks","vendor":"Intuit","category":"Messaging and payments","answer":"Does not sign a BAA","conditions":"QuickBooks Online: not HIPAA compliant; health information not recommended","quote":"Currently, QuickBooks Online meets industry standards for online security, but is not compliant with the HIPAA standards for privacy. If you are a health care professional, it is not recommended that you enter \"individually identifiable health information\" into the QuickBooks Online program.","source_url":"https://quickbooks.intuit.com/learn-support/en-us/help-article/insurance-medical-benefits/quickbooks-online-hipaa-compliant/L9HSimAH5_US_en_US","entry_url":"https://www.curvecompliance.com/baa-registry/quickbooks","last_checked":"2026-10-05"},{"tool":"Quo (OpenPhone)","vendor":"Quo","category":"Call tracking and phones","answer":"Signs a BAA on specific plans","conditions":"Business and Scale plans; texting and integrations excluded","quote":"To use Quo in a HIPAA-compliant way, your organization must sign a Business Associate Agreement (BAA), which is available for Business and Scale plans.","source_url":"https://support.quo.com/core-concepts/administration/hipaa-compliance","entry_url":"https://www.curvecompliance.com/baa-registry/quo","last_checked":"2026-10-26"},{"tool":"Reddit Ads","vendor":"Reddit","category":"Ad platforms","answer":"Does not sign a BAA","conditions":"Business Tool Terms bar health information","quote":"You will not use the Business Tools to share with Reddit any data that you know or reasonably should know is or includes sensitive data or special categories of data (as defined under any applicable laws or regulations (including Data Protection Laws), including data that is based on or includes: an alleged or actual commission of a crime; health, genetic, or biometric information","source_url":"https://business.reddithelp.com/s/article/Reddit-Business-Tool-Terms","entry_url":"https://www.curvecompliance.com/baa-registry/reddit-ads","last_checked":"2026-10-01"},{"tool":"RingCentral","vendor":"RingCentral","category":"Call tracking and phones","answer":"Signs a BAA","conditions":"Paying customers; listed services such as RingEX and RingCX","quote":"RingCentral makes available a business associate agreement (BAA) for our paying Covered Entity customers in alignment with HIPAA requirements.","source_url":"https://assets.ringcentral.com/legal/rc-ringcentral-hipaa.pdf","entry_url":"https://www.curvecompliance.com/baa-registry/ringcentral","last_checked":"2026-09-29"},{"tool":"RudderStack","vendor":"RudderStack","category":"Analytics and data","answer":"Signs a BAA on specific plans","conditions":"Enterprise plan","quote":"We comply with HIPAA requirements for PHI and can sign a BAA","source_url":"https://www.rudderstack.com/security/","entry_url":"https://www.curvecompliance.com/baa-registry/rudderstack","last_checked":"2026-10-26"},{"tool":"Salesforce","vendor":"Salesforce","category":"CRM and email","answer":"Signs a BAA on specific plans","conditions":"HIPAA Covered Services only, such as Sales Cloud and Marketing Cloud Engagement","quote":"For Customer's use of a HIPAA Covered Service to be covered by the BAA: (1) Customer and Salesforce must sign a BAA that includes the HIPAA Covered Service; and (2) Customer must comply with the terms of the BAA and this article, to the extent applicable.","source_url":"https://www.salesforce.com/company/legal/business-associate-addendum-restrictions/","entry_url":"https://www.curvecompliance.com/baa-registry/salesforce","last_checked":"2026-09-29"},{"tool":"SendGrid","vendor":"Twilio","category":"CRM and email","answer":"Does not sign a BAA","conditions":"Not HIPAA eligible; no BAA for SendGrid","quote":"Twilio is not able to sign Business Associate Agreements for SendGrid, therefore, customers should not use SendGrid for any purpose or in any manner involving Protected Health Information (as defined in HIPAA).","source_url":"https://www.twilio.com/docs/sendgrid/ui/account-and-settings/hipaa-compliant","entry_url":"https://www.curvecompliance.com/baa-registry/sendgrid","last_checked":"2026-10-01"},{"tool":"ShareFile","vendor":"ShareFile (Progress Software Corporation)","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Premium, Enterprise and Virtual Data Room plans, with a signed BAA","quote":"Customers must have a signed BAA in place with ShareFile (Progress Software Corporation).","source_url":"https://www.sharefile.com/plans","entry_url":"https://www.curvecompliance.com/baa-registry/sharefile","last_checked":"2026-10-26"},{"tool":"SharePoint","vendor":"Microsoft","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"SharePoint Online on Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum","quote":"The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA.","source_url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech","entry_url":"https://www.curvecompliance.com/baa-registry/sharepoint","last_checked":"2026-10-26"},{"tool":"Shopify","vendor":"Shopify","category":"Site builders","answer":"Does not sign a BAA","conditions":"Acceptable Use Policy: PHI not supported","quote":"You must likewise respect that certain business activities are not supported by our platform, such as uploading Protected Health Information subject to HIPAA.","source_url":"https://www.shopify.com/legal/aup","entry_url":"https://www.curvecompliance.com/baa-registry/shopify","last_checked":"2026-09-29"},{"tool":"Signal","vendor":"Signal","category":"Messaging and payments","answer":"No public statement","conditions":"No BAA statement found","quote":"","source_url":"https://signal.org/legal/","entry_url":"https://www.curvecompliance.com/baa-registry/signal","last_checked":"2026-10-05"},{"tool":"SimplePractice","vendor":"SimplePractice","category":"Scheduling and intake","answer":"Signs a BAA","conditions":"Agreed at signup; carries over to paid plans","quote":"When you create your trial account, you agree to the Business Associate Agreement, the Terms of Service, and the Privacy Policy.","source_url":"https://support.simplepractice.com/hc/en-us/articles/360018696052-SimplePractice-BAA-Terms-of-Service-and-Trust-Security-information","entry_url":"https://www.curvecompliance.com/baa-registry/simplepractice","last_checked":"2026-10-01"},{"tool":"Slack","vendor":"Slack","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Enterprise-level plan plus the Slack HIPAA Enabled SKU","quote":"Enterprise-Level Slack Plan. Customer must purchase an Enterprise-Level Slack plan. (Please note that GovGrid plans are not currently eligible for BAA coverage.)","source_url":"https://www.salesforce.com/company/legal/business-associate-addendum-restrictions/","entry_url":"https://www.curvecompliance.com/baa-registry/slack","last_checked":"2026-09-29"},{"tool":"Smartsheet","vendor":"Smartsheet","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Enterprise plan, excluding Legacy Enterprise","quote":"Customers are only permitted to upload PHI into the Subscription Services if (1) using PHI Eligible Services and (2) they have executed a Business Associate Agreement (BAA) with Smartsheet.","source_url":"https://help.smartsheet.com/articles/2476526-smartsheet-hipaa","entry_url":"https://www.curvecompliance.com/baa-registry/smartsheet","last_checked":"2026-10-05"},{"tool":"Snapchat Ads","vendor":"Snap","category":"Ad platforms","answer":"Does not sign a BAA","conditions":"Personal Data Terms bar health information","quote":"any sensitive information or special category data, as defined in the Rules, including any information that is based on, or includes: (i) an alleged or actual commission of a crime; (ii) health information, including any health information further detailed in our Business Help Center","source_url":"https://www.snap.com/terms/personal-data","entry_url":"https://www.curvecompliance.com/baa-registry/snapchat-ads","last_checked":"2026-10-01"},{"tool":"Square","vendor":"Square","category":"Scheduling and intake","answer":"Signs a BAA","conditions":"Square Appointments, Invoices and other features Square identifies as HIPAA-enabled","quote":"This HIPAA BAA applies only to the Services and configurations where Square is acting as your Business Associate, including when you use Square Appointments, Invoices, or other features that have been explicitly identified as HIPAA-enabled by Square.","source_url":"https://squareup.com/us/en/legal/general/hipaa","entry_url":"https://www.curvecompliance.com/baa-registry/square","last_checked":"2026-10-05"},{"tool":"Squarespace","vendor":"Squarespace","category":"Site builders","answer":"Does not sign a BAA","conditions":"BAA covers Acuity only, not website features","quote":"Acuity is the only Squarespace feature currently designed to offer services consistent with HIPAA obligations. Your Business Associate Addendum (BAA) doesn't cover other Squarespace features. You shouldn't maintain or transmit Protected Health Information through Squarespace outside of Acuity.","source_url":"https://support.squarespace.com/hc/en-us/articles/360028867231-Acuity-Scheduling-and-HIPAA","entry_url":"https://www.curvecompliance.com/baa-registry/squarespace","last_checked":"2026-09-29"},{"tool":"Stape","vendor":"Stape","category":"HIPAA ad tracking","answer":"Signs a BAA on specific plans","conditions":"Custom plan","quote":"Enables signing BAA to be HIPAA compliant. Available on any Custom plan.","source_url":"https://stape.io/price","entry_url":"https://www.curvecompliance.com/baa-registry/stape","last_checked":"2026-10-10"},{"tool":"Stripe","vendor":"Stripe","category":"Messaging and payments","answer":"No public statement","conditions":"No BAA statement found; PHI barred in Third Party Data","quote":"User must not provide Protected Health Information to Stripe as part of Third Party Data. User is liable for any disclosure of Protected Health Information to Stripe when User provides access to the Third Party Data.","source_url":"https://stripe.com/legal/ssa","entry_url":"https://www.curvecompliance.com/baa-registry/stripe","last_checked":"2026-09-29"},{"tool":"Supabase","vendor":"Supabase","category":"Automation and workspace","answer":"Signs a BAA on specific plans","conditions":"Team and Enterprise plans with the HIPAA add-on; hosted platform","quote":"If you want to start developing healthcare apps on Supabase, reach out to the Supabase team here to sign the Business Associate Agreement (BAA).","source_url":"https://supabase.com/docs/guides/platform/hipaa-projects","entry_url":"https://www.curvecompliance.com/baa-registry/supabase","last_checked":"2026-10-26"},{"tool":"SurveyMonkey","vendor":"SurveyMonkey","category":"Forms and landing pages","answer":"Signs a BAA on specific plans","conditions":"Enterprise customers, on a HIPAA-enabled account","quote":"Yes, SurveyMonkey offers a business associate agreement (BAA) to Enterprise customers.","source_url":"https://www.surveymonkey.com/product/features/hipaa-compliance/","entry_url":"https://www.curvecompliance.com/baa-registry/surveymonkey","last_checked":"2026-10-26"},{"tool":"Tableau","vendor":"Salesforce","category":"Analytics and data","answer":"Signs a BAA on specific plans","conditions":"Tableau Cloud and Tableau Next","quote":"For Customer’s use of a HIPAA Covered Service to be covered by the BAA: (1) Customer and Salesforce must sign a BAA that includes the HIPAA Covered Service; and (2) Customer must comply with the terms of the BAA and this article, to the extent applicable.","source_url":"https://www.salesforce.com/company/legal/business-associate-addendum-restrictions/","entry_url":"https://www.curvecompliance.com/baa-registry/tableau","last_checked":"2026-10-01"},{"tool":"Tealium","vendor":"Tealium","category":"HIPAA ad tracking","answer":"Signs a BAA","conditions":"HIPAA customers in Healthcare and Pharma","quote":"As a priority to our organization we sign BAAs for our HIPAA customers across the Healthcare and Pharma verticals.","source_url":"https://tealium.com/products/tealium-for-healthcare/","entry_url":"https://www.curvecompliance.com/baa-registry/tealium","last_checked":"2026-10-10"},{"tool":"Tebra","vendor":"Tebra","category":"Scheduling and intake","answer":"Signs a BAA","conditions":"Part of the Terms of Service for covered entities","quote":"This Business Associate Agreement (the “Agreement”) shall be incorporated into the Terms of Service for Customers that are Covered Entities (as defined in the HIPAA Rules) and that provide Protected Health Information (“PHI”) (as defined in the HIPAA Rules) to Tebra Technologies, Inc. and its subsidiaries (“Tebra” or “Business Associate”) in connection with the software and services they have purchased.","source_url":"https://www.tebra.com/business-associate-agreement/","entry_url":"https://www.curvecompliance.com/baa-registry/tebra","last_checked":"2026-10-01"},{"tool":"Telegram","vendor":"Telegram","category":"Messaging and payments","answer":"No public statement","conditions":"No BAA statement found","quote":"","source_url":"https://telegram.org/tos","entry_url":"https://www.curvecompliance.com/baa-registry/telegram","last_checked":"2026-10-05"},{"tool":"TherapyNotes","vendor":"TherapyNotes","category":"Scheduling and intake","answer":"Signs a BAA","conditions":"Built into the Terms of Service for covered entities","quote":"The BAA is now built directly into the Terms of Service for customers who need one.","source_url":"https://support.therapynotes.com/hc/en-us/articles/49471054973851-FAQ-TherapyNotes-Terms-of-Service-Privacy-Policies-and-Business-Associate-Agreement","entry_url":"https://www.curvecompliance.com/baa-registry/therapynotes","last_checked":"2026-10-26"},{"tool":"TikTok","vendor":"TikTok","category":"Ad platforms","answer":"Does not sign a BAA","conditions":"Business terms bar health information","quote":"At TikTok, we don't allow advertisers to share information about children, health or financial information, or other categories of prohibited data.","source_url":"https://ads.tiktok.com/help/article/about-notifications-of-potentially-prohibited-data-sharing-on-tiktok","entry_url":"https://www.curvecompliance.com/baa-registry/tiktok","last_checked":"2026-09-29"},{"tool":"Trello","vendor":"Atlassian","category":"Automation and workspace","answer":"No public statement","conditions":"Not on Atlassian's BAA product list; PHI barred without a BAA","quote":"We can sign BAAs for Standard, Premium, and Enterprise plans for Jira, Jira Service Management, Jira Product Discovery, and Confluence. Free and trial plans are not eligible to sign BAAs.","source_url":"https://support.atlassian.com/organization-administration/docs/understand-hipaa-compliance-for-atlassian-products/","entry_url":"https://www.curvecompliance.com/baa-registry/trello","last_checked":"2026-10-05"},{"tool":"Triple Whale","vendor":"Triple Whale","category":"Analytics and data","answer":"No public statement","conditions":"DPA: not intended for health information","quote":"The Parties agree that the Platform and underlying Services are not intended for the processing of Sensitive Data, and that if Customer wishes to use the Platform and underlying Services to process Sensitive Data, it must first obtain Triple Whale's explicit prior written consent and enter into any additional agreements as required by Triple Whale.","source_url":"https://www.triplewhale.com/pages/data-processing-addendum","entry_url":"https://www.curvecompliance.com/baa-registry/triple-whale","last_checked":"2026-10-26"},{"tool":"Twilio","vendor":"Twilio","category":"Messaging and payments","answer":"Signs a BAA on specific plans","conditions":"Security or Enterprise Edition; HIPAA-eligible products","quote":"HIPAA Accounts require Twilio Security Edition or Enterprise Edition.","source_url":"https://www.twilio.com/docs/iam/twilio-editions/hippa","entry_url":"https://www.curvecompliance.com/baa-registry/twilio","last_checked":"2026-09-29"},{"tool":"Twilio Segment","vendor":"Twilio","category":"Analytics and data","answer":"Signs a BAA on specific plans","conditions":"Business Tier plan","quote":"Twilio BAAs are available to customers on a Business Tier plan.","source_url":"https://www.twilio.com/docs/segment/privacy/hipaa-eligible-segment","entry_url":"https://www.curvecompliance.com/baa-registry/segment","last_checked":"2026-09-29"},{"tool":"Typeform","vendor":"Typeform","category":"Forms and landing pages","answer":"Signs a BAA on specific plans","conditions":"Enterprise and Growth Custom plans","quote":"Typeform's data protection standards are HIPAA compliant and we can currently provide a BAA for customers on our Enterprise or Growth Custom plans.","source_url":"https://help.typeform.com/hc/en-us/articles/4404321307796-Business-Associate-Agreement-BAA","entry_url":"https://www.curvecompliance.com/baa-registry/typeform","last_checked":"2026-09-29"},{"tool":"Unbounce","vendor":"Unbounce","category":"Forms and landing pages","answer":"No public statement","conditions":"No BAA statement found","quote":"If you use the Services to collect, store, use, or disclose Sensitive or Personal Information about identifiable individuals, you agree only to do so in accordance with applicable law.","source_url":"https://unbounce.com/terms-of-service/","entry_url":"https://www.curvecompliance.com/baa-registry/unbounce","last_checked":"2026-09-29"},{"tool":"Vagaro","vendor":"Vagaro","category":"Scheduling and intake","answer":"Signs a BAA","conditions":"US businesses; signed in Vagaro when you turn on HIPAA Compliant Notifications","quote":"Turning on the HIPAA Compliant Notifications setting in Vagaro also requires that you sign the Business Associate Agreement (BAA) to confirm that you will adhere to the rules about allowable and impermissible uses of health information between your business and Vagaro.","source_url":"https://support.vagaro.com/hc/en-us/articles/360035413093-Send-HIPAA-Compliant-Notifications","entry_url":"https://www.curvecompliance.com/baa-registry/vagaro","last_checked":"2026-10-26"},{"tool":"Venmo","vendor":"PayPal","category":"Messaging and payments","answer":"No public statement","conditions":"No BAA statement found","quote":"","source_url":"https://venmo.com/legal/us-user-agreement","entry_url":"https://www.curvecompliance.com/baa-registry/venmo","last_checked":"2026-10-05"},{"tool":"Vercel","vendor":"Vercel","category":"Site builders","answer":"Signs a BAA on specific plans","conditions":"Enterprise and Pro (HIPAA add-on)","quote":"We sign Business Associate Agreements (BAAs) with customers.","source_url":"https://vercel.com/kb/guide/hipaa-compliance-guide-vercel","entry_url":"https://www.curvecompliance.com/baa-registry/vercel","last_checked":"2026-10-26"},{"tool":"Vimeo","vendor":"Vimeo","category":"Video, reviews and SMS","answer":"Signs a BAA on specific plans","conditions":"Eligible Vimeo Enterprise plans","quote":"Eligible Vimeo Enterprise clients can configure their account to support HIPAA-compliant video delivery after signing a Business Associate Agreement (BAA).","source_url":"https://help.vimeo.com/hc/en-us/articles/12427605151249-Is-Vimeo-HIPAA-compliant","entry_url":"https://www.curvecompliance.com/baa-registry/vimeo","last_checked":"2026-10-01"},{"tool":"Virtru","vendor":"Virtru","category":"CRM and email","answer":"Signs a BAA","conditions":"All packages: Starter lists a signed BAA, and higher packages include Starter","quote":"Signed Business Associate’s Agreement (BAA) helps meet HIPAA compliance obligations","source_url":"https://www.virtru.com/data-security-platform/pricing-packages","entry_url":"https://www.curvecompliance.com/baa-registry/virtru","last_checked":"2026-10-26"},{"tool":"VSee","vendor":"VSee","category":"Video, reviews and SMS","answer":"Signs a BAA","conditions":"All VSee plans except Free VSee Messenger","quote":"VSee offers the HIPAA-required Business Associate Agreement where VSee agrees to be responsible for keeping all patient information secure and to immediately report any breach of personal health information.","source_url":"https://vsee.com/hipaa/","entry_url":"https://www.curvecompliance.com/baa-registry/vsee","last_checked":"2026-10-26"},{"tool":"VWO","vendor":"Wingify","category":"Analytics and data","answer":"Does not sign a BAA","conditions":"BAA not applicable by default; no PHI stored","quote":"Because Wingify does not store or collect PHI/ePHI by default, we do not meet the definition of a Business Associate or Business Associate Subcontractor under HIPAA.","source_url":"https://wingify.com/compliance/hipaa/","entry_url":"https://www.curvecompliance.com/baa-registry/vwo","last_checked":"2026-10-26"},{"tool":"Weave","vendor":"Weave","category":"Call tracking and phones","answer":"Signs a BAA","conditions":"Business Associate Addendum with every client","quote":"This Business Associate Addendum (the “Addendum”) supplements the underlying agreement, including the Terms of Service (collectively “Underlying Agreement”), between Weave Communications, Inc. (“Weave”, “Business Associate”) and its client (“Client”, “Covered Entity”)","source_url":"https://www.getweave.com/legal/baa/","entry_url":"https://www.curvecompliance.com/baa-registry/weave","last_checked":"2026-09-29"},{"tool":"Webflow","vendor":"Webflow","category":"Site builders","answer":"Does not sign a BAA","conditions":"Terms: no HIPAA compliant services","quote":"Please do not collect Protected Health Information using the Platform as Webflow does not offer HIPAA compliant services at the present time.","source_url":"https://webflow.com/legal/terms","entry_url":"https://www.curvecompliance.com/baa-registry/webflow","last_checked":"2026-09-29"},{"tool":"WhatConverts","vendor":"WhatConverts","category":"Call tracking and phones","answer":"Signs a BAA on specific plans","conditions":"Pro and Elite plans","quote":"Once your Business Associate Agreement (BAA) is executed, the WhatConverts team will activate HIPAA compliance for your profile.","source_url":"https://www.whatconverts.com/help/docs/whatconverts-admin/data-privacy-and-security/enable-hipaa-compliance-in-a-profile/","entry_url":"https://www.curvecompliance.com/baa-registry/whatconverts","last_checked":"2026-10-01"},{"tool":"WhatsApp","vendor":"Meta","category":"Messaging and payments","answer":"Does not sign a BAA","conditions":"Business Platform terms: not HIPAA compliant","quote":"With regard to health information, you acknowledge that Meta is not a Business Associate or Subcontractor (as those terms are defined in the Health Insurance Portability and Accountability Act, (\"HIPAA\")) and that the WhatsApp Business Platform is not HIPAA compliant.","source_url":"https://www.facebook.com/legal/Meta-Terms-for-WhatsApp-Business-Platform","entry_url":"https://www.curvecompliance.com/baa-registry/whatsapp","last_checked":"2026-10-05"},{"tool":"Wistia","vendor":"Wistia","category":"Video, reviews and SMS","answer":"Does not sign a BAA","conditions":"Not HIPAA compliant; does not sign BAAs","quote":"Wistia is not HIPAA compliant and does not sign BAAs. Player Privacy Mode can obscure IP addresses but does not meet HIPAA standards.","source_url":"https://support.wistia.com/en/articles/8264955-privacy-data-protection-and-security","entry_url":"https://www.curvecompliance.com/baa-registry/wistia","last_checked":"2026-10-01"},{"tool":"Wix","vendor":"Wix","category":"Site builders","answer":"Signs a BAA on specific plans","conditions":"Business, Plus, Elite, Business Elite and Enterprise plans","quote":"Wix sites built on the Wix Editor or Wix Studio Editor can be HIPAA compliant. However, you must have a supported Premium or Studio site plan to activate PHI protection. HIPAA compliance is available with Business, Plus, Elite, Business Elite and Enterprise plans.","source_url":"https://support.wix.com/en/article/enabling-hipaa-compliance-for-your-wix-site","entry_url":"https://www.curvecompliance.com/baa-registry/wix","last_checked":"2026-09-29"},{"tool":"WordPress.com","vendor":"WordPress.com","category":"Site builders","answer":"No public statement","conditions":"No BAA statement found","quote":"","source_url":"https://wordpress.com/support/?s=HIPAA","entry_url":"https://www.curvecompliance.com/baa-registry/wordpress-com","last_checked":"2026-09-29"},{"tool":"Wufoo","vendor":"SurveyMonkey","category":"Forms and landing pages","answer":"No public statement","conditions":"No Wufoo BAA statement found; PHI barred without a separate BAA","quote":"For example, you may not use the Services to collect, protect, or otherwise handle “protected health information” (as defined in 45 C.F.R. §160.103 under United States federal regulations) without entering into a separate business associate agreement with SurveyMonkey that permits you to do so.","source_url":"https://www.surveymonkey.com/mp/legal/acceptable-uses-policy/","entry_url":"https://www.curvecompliance.com/baa-registry/wufoo","last_checked":"2026-10-05"},{"tool":"YouTube","vendor":"Google","category":"Video, reviews and SMS","answer":"No public statement","conditions":"Not on Google's Workspace BAA list; no separate BAA found","quote":"The following Google Workspace services are included in the Google Cloud BAA:","source_url":"https://workspace.google.com/terms/2015/1/hipaa_functionality/","entry_url":"https://www.curvecompliance.com/baa-registry/youtube","last_checked":"2026-10-26"},{"tool":"Zapier","vendor":"Zapier","category":"Automation and workspace","answer":"Does not sign a BAA","conditions":"Can't sign BAAs; PHI not supported","quote":"The use of regulated healthcare and medical data including Protected Health Information (PHI) under HIPAA isn't supported on Zapier. Zapier also can't sign business associate agreements (BAAs) or equivalent agreements for handling PHI or other similar information.","source_url":"https://zapier.com/legal/data-privacy","entry_url":"https://www.curvecompliance.com/baa-registry/zapier","last_checked":"2026-09-29"},{"tool":"Zendesk","vendor":"Zendesk","category":"Support and chat","answer":"Signs a BAA on specific plans","conditions":"Advanced Compliance: Suite Professional, Enterprise or Enterprise Plus","quote":"With the purchase of Advanced Compliance, either directly or through the purchase of a plan that includes the Advanced Compliance add-on, Zendesk customers can sign a Healthcare Agreement with Zendesk.","source_url":"https://support.zendesk.com/hc/en-us/articles/4408832117786-Advanced-Compliance","entry_url":"https://www.curvecompliance.com/baa-registry/zendesk","last_checked":"2026-09-29"},{"tool":"Zocdoc","vendor":"Zocdoc","category":"Scheduling and intake","answer":"No public statement","conditions":"Ask Zocdoc directly","quote":"","source_url":"https://www.zocdoc.com/about/privacy/","entry_url":"https://www.curvecompliance.com/baa-registry/zocdoc","last_checked":"2026-09-29"},{"tool":"Zoho CRM","vendor":"Zoho","category":"CRM and email","answer":"Signs a BAA","conditions":"BAA on request; HIPAA settings on paid editions, not Free","quote":"HIPAA requires Covered Entities to sign a Business Associate Agreement (BAA) with its Business Associates. You can request our BAA template by sending an email to legal@zohocorp.com.","source_url":"https://help.zoho.com/portal/en/kb/crm/security-control/compliance-setting/hipaa/articles/hipaa-compliance-with-zoho-crm","entry_url":"https://www.curvecompliance.com/baa-registry/zoho-crm","last_checked":"2026-10-05"},{"tool":"Zoom","vendor":"Zoom","category":"Video, reviews and SMS","answer":"Signs a BAA on specific plans","conditions":"Paid plans such as Pro, Business, Business Plus and Enterprise","quote":"Zoom offers Pro, Business, Business Plus, and Enterprise plans to customers in the healthcare space. Zoom also enters into BAAs with customers who are subscribed to other paid plans listed on Zoom's Plans & Pricing page.","source_url":"https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0067751","entry_url":"https://www.curvecompliance.com/baa-registry/zoom","last_checked":"2026-09-29"}]}