Is GoDaddy HIPAA compliant? Does it sign a BAA?
The answer
Signs a BAA on specific plans
Only for Microsoft 365 email from GoDaddy. Its help page offers a HIPAA BAA for that email; we found no BAA statement for GoDaddy web hosting.
Site builders. Checked on the vendor's own pages on .
Using GoDaddy on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What GoDaddy says
“No, by offering a BAA, GoDaddy and Microsoft help support your HIPAA compliance, but using this service doesn't achieve compliance on its own.”
“We offer an optional privacy and security contractual supplement (also called a HIPAA business associate agreement or BAA) to assist Microsoft 365 customers in meeting HIPAA compliance requirements.”
“After you set up your email account, activate your HIPAA compliant email and sign the Microsoft 365 HIPAA Business Associate Agreement (BAA).”
What this means for ad tracking
GoDaddy's HIPAA help page is about Microsoft 365 email from GoDaddy. It says business associates, “i.e., GoDaddy and Microsoft,” must safeguard ePHI, and has you sign “the Microsoft 365 HIPAA Business Associate Agreement (BAA)” after you activate HIPAA compliant email (GoDaddy). The page doesn't mention web hosting or website builders, so ask GoDaddy before your GoDaddy site collects patient information.
A BAA binds only the vendor that signs it. The ad pixels on your website send data to the ad platforms, and this directory lists Meta and Google Ads as not signing one. Our guides to HIPAA compliant website hosting and removing the Meta Pixel from a healthcare website cover the rest.
Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.
A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.
How Curve helps
- Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep GoDaddy for what it does well.
- Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
- Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
- Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
- Event Logs show what Curve sent to each platform and what the platform accepted.
- Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Is GoDaddy HIPAA compliant?
GoDaddy offers a BAA for its Microsoft 365 email, and says “by offering a BAA, GoDaddy and Microsoft help support your HIPAA compliance, but using this service doesn't achieve compliance on its own” (GoDaddy). We found no BAA statement for GoDaddy web hosting, so ask GoDaddy before a GoDaddy site handles patient information.
Does GoDaddy sign a BAA?
For Microsoft 365 email from GoDaddy, yes. GoDaddy's help page says to “activate your HIPAA compliant email and sign the Microsoft 365 HIPAA Business Associate Agreement (BAA)” (GoDaddy). We checked GoDaddy's own page on October 26, 2026.
How do I get HIPAA compliant email from GoDaddy?
GoDaddy says your email plan needs “one Business Professional or Premium Security email account.” After you set up your email account, you activate HIPAA compliant email and sign the Microsoft 365 HIPAA BAA (GoDaddy).
Does a BAA with GoDaddy cover my ad pixels?
No. A BAA covers the data GoDaddy handles for you. A pixel sends data from the visitor's browser to Meta, Google or TikTok, and none of them is a party to your BAA with GoDaddy.
What does Curve Compliance do for ad tracking?
Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with GoDaddy before you send it patient data.
Related tools
- Does Microsoft 365 sign a BAA?Signs a BAA. By default through Microsoft's Data Protection Addendum; in-scope services.
- Does Outlook sign a BAA?Signs a BAA on specific plans. Exchange Online on Office 365 Commercial or GCC subscriptions.
- Does Wix sign a BAA?Signs a BAA on specific plans. Business, Plus, Elite, Business Elite and Enterprise plans.
- Does Squarespace sign a BAA?Does not sign a BAA. BAA covers Acuity only, not website features.
- Does WordPress.com sign a BAA?No public statement. No BAA statement found.
- Does Vercel sign a BAA?Signs a BAA on specific plans. Enterprise and Pro (HIPAA add-on).
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
- Does Curve Compliance sign a BAA?Signs a BAA. Every plan: Compliance, Growth and Enterprise.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call