Is iCloud HIPAA compliant? Does it sign a BAA?
The answer
Does not sign a BAA
No. Apple's iCloud terms say a HIPAA covered entity or business associate will not use iCloud to create, receive, maintain or transmit protected health information, or in any way that would make Apple its business associate.
Automation and workspace. Checked on the vendor's own pages on .
Using iCloud on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What Apple says
“If you are a covered entity, business associate or representative of a covered entity or business associate (as those terms are defined at 45 C.F.R § 160.103), You agree that you will not use any component, function or other facility of the Service to create, receive, maintain or transmit any “protected health information” (as such term is defined at 45 C.F.R § 160.103) or use the Service in any manner that would make Apple (or any Apple Subsidiary) your or any third party’s business associate.”
What this means for ad tracking
iCloud syncs photos, files, notes and backups across a team's Apple devices, so screenshots of intake forms, exported lead lists and patient messages can end up there through sync and backup.
Because Apple's iCloud terms bar protected health information, patient files and lead lists should stay out of iCloud, including any list you later upload to Meta or Google as an audience or conversion file.
Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.
A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.
How Curve helps
- Curve gives you a conversion signal that does not depend on iCloud or a browser pixel carrying patient details.
- Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
- A fixed field list per platform, so each ad platform receives only the fields set for it.
- PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
- When identifiers are enabled, Curve hashes them with SHA-256.
- Consent management for your site, alongside the tracking.
- A HIPAA-compliant setup done by Curve's team, with a BAA signed on every plan.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Is iCloud HIPAA compliant?
No. Apple's iCloud terms say a HIPAA covered entity or business associate will not use iCloud to create, receive, maintain or transmit protected health information, or in any way that would make Apple its business associate. Without a BAA, iCloud should not receive patient information.
Does iCloud sign a BAA?
No. Apple's iCloud terms say a HIPAA covered entity or business associate will not use iCloud to create, receive, maintain or transmit protected health information, or in any way that would make Apple its business associate. In Apple's words: “If you are a covered entity, business associate or representative of a covered entity or business associate (as those terms are defined at 45 C.F.R § 160.103), You agree that you will not use any component, function or other facility of the Service to create, receive, maintain or transmit any “protected health information” (as such term is defined at 45 C.F.R § 160.103) or use the Service in any manner that would make Apple (or any Apple Subsidiary) your or any third party’s business associate.” We checked Apple's own pages on October 5, 2026.
Can I store patient files in iCloud?
Not under a BAA from Apple, based on its own pages. iCloud's terms say a HIPAA covered entity or business associate will not use any component, function or other facility of iCloud for protected health information, and iCloud Backup can include messages, photos and documents. Keep Protected Health Information out of iCloud.
How do I send conversions to ad platforms without a file export?
Send the conversion server-side instead of uploading a list. Curve sends conversions to your ad platforms under a BAA it signs on every plan, with neutral event names and SHA-256 hashed identifiers.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with Apple before you send it patient data.
Related tools
- Does Dropbox sign a BAA?Signs a BAA on specific plans. Team plans such as Standard, Advanced, Business and Enterprise.
- Does Box sign a BAA?Signs a BAA on specific plans. Enterprise, Enterprise Plus or Enterprise Advanced accounts.
- Does Google Workspace sign a BAA?Signs a BAA. Covered services such as Gmail, Drive and Meet.
- Does Microsoft 365 sign a BAA?Signs a BAA. By default through Microsoft's Data Protection Addendum; in-scope services.
- Does iMessage sign a BAA?Does not sign a BAA. License bars PHI and business associate use.
- Does FaceTime sign a BAA?Does not sign a BAA. License bars PHI and business associate use.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call