Skip to main content
BAA Directory

Is Doximity HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes. Doximity says PHI that covered entities send through its secure tools, such as messaging and its fax service, is handled under its BAA.

Video, reviews and SMS. Checked on the vendor's own pages on .

Using Doximity on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Doximity says

“If you are a “covered entity” under the Health Insurance Portability and Accountability Act (HIPAA) and choose to transmit protected health information using a Doximity tool that we identify as appropriately secure for that purpose, such as our communication tools, AI tools, member messaging, or electronic fax service, such information will be handled in accordance with the Doximity Business Associate Agreement, which is incorporated into the Doximity Terms of Service by reference, or our Business Associate Agreement with the relevant covered entity, as applicable.”

Source: Doximity Privacy Policy, Protected health information, checked .

“The Services include secure communication tools that enable our members to communicate with each other and with third parties, including their patients, such as Doximity Dialer and electronic fax.”

Source: Doximity Privacy Policy, checked .

What the BAA covers and excludes

Covers, in Doximity's words:

  • PHI sent through "a Doximity tool that we identify as appropriately secure for that purpose, such as our communication tools, AI tools, member messaging, or electronic fax service".

What this means for ad tracking

Doximity's tools for its members include Dialer for calls with patients and an electronic fax service. Doximity says PHI from covered entities is handled under the Doximity Business Associate Agreement, “which is incorporated into the Doximity Terms of Service by reference” (Doximity).

That BAA covers Doximity's own tools. The ad tracking on your practice website is a separate question: a BAA binds only the vendor that signs it, and this directory lists Meta and Google Ads as not signing one. Our guides to HIPAA compliant fax services and HIPAA compliant telehealth platforms compare the options.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Doximity for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Doximity HIPAA compliant?

Yes. Doximity says PHI that covered entities send through its secure tools, such as messaging and its fax service, is handled under its BAA. With a signed BAA, Doximity can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Doximity sign a BAA?

Yes. Doximity says PHI that a covered entity sends through its secure tools “will be handled in accordance with the Doximity Business Associate Agreement, which is incorporated into the Doximity Terms of Service by reference” (Doximity). We checked Doximity's own page on October 26, 2026.

Which Doximity tools does the BAA cover?

Doximity names “a Doximity tool that we identify as appropriately secure for that purpose, such as our communication tools, AI tools, member messaging, or electronic fax service” (Doximity). Its communication tools include Doximity Dialer and electronic fax.

Do I need to sign a separate BAA with Doximity?

Doximity says its BAA is incorporated into its Terms of Service by reference, “or our Business Associate Agreement with the relevant covered entity, as applicable” (Doximity). Ask Doximity which one applies to your organization.

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Doximity before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call