Is Grasshopper HIPAA compliant? Does it sign a BAA?
The answer
Does not sign a BAA
No. Grasshopper's support page says “At this time, Grasshopper is not HIPAA compliant,” and points customers who need a HIPAA compliant product to GoTo.
Call tracking and phones. Checked on the vendor's own pages on .
Using Grasshopper on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What Grasshopper says
“At this time, Grasshopper is not HIPAA compliant.”
“In order to assist our customers with any technical issues they are experiencing, our support team must have access to the account settings and information. This includes messages that may pass through the Grasshopper system, like text messages, faxes, and voicemails.”
“If you require a Business Associate Agreement (BAA), please use the Contact Support option in this article.”
What this means for ad tracking
Grasshopper describes itself as a “Lightweight virtual phone system for small business.” Its support page says its support team must have access to account settings and information, including “messages that may pass through the Grasshopper system, like text messages, faxes, and voicemails” (Grasshopper).
A practice that handles patient calls, texts and voicemails needs a phone system that signs a BAA. Our guides to HIPAA compliant phone systems and HIPAA compliant call tracking software compare BAAs by plan.
Call conversions are a separate question. This directory lists Meta and Google Ads as not signing a BAA, so caller details and call content should stay out of the conversions they receive.
Curve Compliance helps with that part: it receives outcomes from call tracking and booking systems through incoming webhooks, credits each to the original ad click, and sends the conversion server-side under a BAA it signs on every plan. Book a call to see it on your own funnel.
A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.
How Curve helps
- Curve receives outcomes from call tracking and booking systems through incoming webhooks and credits each to the original ad click.
- Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
- Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
- Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
- Event Logs show what Curve sent to each platform and what the platform accepted.
- Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Is Grasshopper HIPAA compliant?
No. Grasshopper's own support page says “At this time, Grasshopper is not HIPAA compliant” (Grasshopper). We checked Grasshopper's own page on October 26, 2026.
Can I get a BAA from Grasshopper?
Grasshopper's page says “If you require a Business Associate Agreement (BAA), please use the Contact Support option in this article,” and points customers who need a HIPAA compliant product to GoTo's healthcare page (Grasshopper). Until a vendor signs a BAA with you, keep patient information out of it.
Can I send Grasshopper call conversions to Google Ads or Meta?
Google Ads and Meta are listed in this directory as not signing a BAA, so caller details and call content should stay out of any call conversion they receive.
What does Curve Compliance do for ad tracking?
Curve receives outcomes from call tracking and booking systems through incoming webhooks, credits each to the original ad click, and sends the conversion to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn server-side. It detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with Grasshopper before you send it patient data.
Related tools
- Does Dialpad sign a BAA?Signs a BAA on specific plans. All paid accounts; signed by a Company Admin.
- Does Quo (OpenPhone) sign a BAA?Signs a BAA on specific plans. Business and Scale plans; texting and integrations excluded.
- Does Nextiva sign a BAA?Signs a BAA. Covered services.
- Does RingCentral sign a BAA?Signs a BAA. Paying customers; listed services such as RingEX and RingCX.
- Does Google Voice sign a BAA?Signs a BAA on specific plans. Licensed users managed in Google Workspace.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
- Does Curve Compliance sign a BAA?Signs a BAA. Every plan: Compliance, Growth and Enterprise.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call