Skip to main content
BAA Directory

Is Hushmail HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on Hushmail for Healthcare plans and Hushmail for Professionals, which both list a Business Associate Agreement (BAA) among their features.

CRM and email. Checked on the vendor's own pages on .

Using Hushmail on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Hushmail says

“Get a signed business associate agreement (BAA) for healthcare providers”

Source: Hushmail for Healthcare, checked .

“Signed Business Associate Agreement (BAA)”

Source: Hushmail for Healthcare, plan features, checked .

“Business Associate Agreement (BAA)”

Source: Hushmail pricing, Healthcare Basic, checked .

“Business Associate Agreement (BAA)”

Source: Hushmail pricing, Hushmail for Professionals, checked .

What this means for ad tracking

Hushmail is built for small practices. Its healthcare page says Hushmail “supports your HIPAA compliance with encrypted email and e-signable forms,” and that you can “Place a secure, HIPAA-compliant contact form on your website” (Hushmail).

A BAA binds only the vendor that signs it. The page that holds a contact form often carries ad pixels too, and this directory lists Meta and Google Ads as not signing one, so the form conversion those pixels report needs to leave PHI behind. Our guide to HIPAA compliant email providers compares secure email services.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare CRMs, see our guide to HIPAA-compliant CRM.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Hushmail for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Hushmail HIPAA compliant?

Yes, on Hushmail for Healthcare plans and Hushmail for Professionals, which both list a Business Associate Agreement (BAA) among their features. With a signed BAA, Hushmail can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Hushmail sign a BAA?

Yes, on its healthcare plans and Hushmail for Professionals. In Hushmail's words: “Get a signed business associate agreement (BAA) for healthcare providers” (Hushmail). We checked Hushmail's own pages on October 26, 2026.

Which Hushmail plans include a BAA?

Hushmail's pricing page lists a Business Associate Agreement (BAA) with Healthcare Basic. Healthcare Essentials includes “Everything in Basic,” and Healthcare Growth includes “Everything in Essentials” (Hushmail pricing). Hushmail for Professionals, its secure messaging and forms plan for people who keep their current email, also lists a Business Associate Agreement (BAA) (Hushmail pricing). If you use another Hushmail plan, ask Hushmail about a BAA before sending patient information.

Can I put a Hushmail contact form on my website?

Hushmail says you can “Place a secure, HIPAA-compliant contact form on your website” (Hushmail). Its BAA does not reach Meta or Google, so keep what the form collects out of the ad tags on that page.

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Hushmail before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call