Skip to main content
BAA Directory

Is Heidi HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes. Heidi says it is a Business Associate under HIPAA and makes a BAA available to every covered entity it works with.

AI assistants. Checked on the vendor's own pages on .

Using Heidi on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Heidi Health says

“Heidi is a Business Associate under HIPAA. We make a BAA available to every covered entity we work with, safeguard protected health information under the Privacy and Security Rules, and give you what you need to meet your own obligations to your patients.”

Source: Heidi, HIPAA (Business Associate Agreements (BAAs)), checked .

“Heidi complies with HIPAA through enterprise-grade security controls, privacy safeguards and customer contracting, including a Business Associate Agreement (BAA) when applicable.”

Source: Heidi, HIPAA (FAQ: How does Heidi comply with HIPAA?), checked .

What this means for ad tracking

Heidi describes itself as “Clinical-grade AI for physicians and health systems, built on one of the world's most used ambient scribes” (Heidi), so its transcripts and notes put a patient's name next to their condition.

Heidi says US data is hosted locally, audio is never retained, and “we sign BAAs with covered entities” (Heidi). That BAA covers Heidi. A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing a BAA, so data from your practice website should reach them with no health details. Our guide to HIPAA compliant AI tools covers other AI tools.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Heidi for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Heidi sign a BAA?

Yes. In Heidi's words: “Heidi is a Business Associate under HIPAA. We make a BAA available to every covered entity we work with” (Heidi). We checked Heidi's own pages on November 2, 2026.

Is Heidi HIPAA compliant?

Heidi says “Heidi is compliant with the Health Insurance Portability and Accountability Act (HIPAA) in the United States”, and that it complies through security controls, privacy safeguards and “customer contracting, including a Business Associate Agreement (BAA) when applicable” (Heidi). How you use it is still your responsibility, so talk to your counsel about your own setup.

Which Heidi plans include a BAA?

Heidi's BAA statement names no plan: it says “We make a BAA available to every covered entity we work with” (Heidi). Ask Heidi to confirm how the BAA applies to your account before clinicians record visits.

Are Heidi's subcontractors covered by BAAs?

Heidi says yes where they handle PHI: “Subcontractors that create, receive, maintain, or transmit PHI on Heidi's behalf are bound by Business Associate Agreements (BAAs) that flow HIPAA obligations through to them” (Heidi).

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Heidi Health before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call