Skip to main content
BAA Directory

Is Hightouch HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on its Customer Data Platform and AI Decisioning plans. Hightouch's pricing page lists a BAA in the custom security review included with them.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Hightouch says

“Custom Security Review (BAA, DPA, full SOC2 report)”

Source: Hightouch pricing, Features included in Customer Data Platform and AI Decisioning Plans, checked .

“Hightouch supports customer compliance with HIPAA, GDPR, and CCPA requirements.”

Source: Hightouch Docs, Security overview (Compliance), checked .

What this means for ad tracking

Hightouch's Composable CDP products include a Reverse ETL Platform, Hightouch Events, Customer Studio and Match Booster. Its Agentic Marketing Platform is for “teams looking to bring AI into their lifecycle and advertising marketing workflows” and lists “Integrations with any marketing platform” (Hightouch pricing). Your Hightouch setup decides which fields each destination receives.

Hightouch's pricing page lists “HIPAA Compliance” and a “Custom Security Review (BAA, DPA, full SOC2 report)” among the features included in its Customer Data Platform and AI Decisioning plans. Its Basic Reverse ETL tier doesn't list them. Ask Hightouch which products your BAA covers.

A BAA binds only the vendor that signs it. Data Hightouch sends to ad platforms goes to companies that are not party to it, and this directory lists Meta and Google Ads as not signing one, so that data needs to leave PHI behind. Our guide to HIPAA-compliant CDPs for healthcare marketing compares the options.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Hightouch for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Hightouch HIPAA compliant?

Yes, on its Customer Data Platform and AI Decisioning plans. Hightouch's pricing page lists a BAA in the custom security review included with them. With a signed BAA, Hightouch can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Hightouch sign a BAA?

Yes, on its Customer Data Platform and AI Decisioning plans. Hightouch's pricing page lists a “Custom Security Review (BAA, DPA, full SOC2 report)” among the features included with them (Hightouch pricing). Its security docs say “Hightouch supports customer compliance with HIPAA, GDPR, and CCPA requirements” (Hightouch Docs). We checked Hightouch's own pages on October 26, 2026.

Which Hightouch plans include a BAA?

Hightouch's pricing page lists the BAA, as part of a custom security review, under “Features included in Customer Data Platform and AI Decisioning Plans.” Its Basic Reverse ETL tier doesn't list it (Hightouch pricing).

Does Hightouch's BAA cover Meta or Google Ads?

No. A BAA binds only the vendor that signs it, so it does not extend to the ad platforms Hightouch sends data to. Meta and Google Ads are listed in this directory as not signing one, so keep PHI out of what you send them.

How does Curve Compliance help with HIPAA ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Hightouch before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call