Is Loom HIPAA compliant? Does it sign a BAA?
The answer
Does not sign a BAA
No. Loom says it is currently not able to sign Business Associate Agreements, and asks customers not to send it personal health information where that would breach their HIPAA obligations.
Video, reviews and SMS. Checked on the vendor's own pages on .
Using Loom on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What Atlassian says
“Loom currently is not able to sign Business Associate Agreements in support of customers’ compliance with the Health Insurance Portability and Accountability Act (HIPAA).”
“Please do not send any personal health information to Loom if doing so would violate any of your obligations under HIPAA.”
What this means for ad tracking
Practices and agencies record their screens to walk through dashboards, ad accounts and lead lists, and a recording can show a patient's name or the reason for a visit.
Without a BAA, keep anything that ties a person to their care out of Loom recordings. Loom asks customers not to send it personal health information if doing so would violate their HIPAA obligations (Atlassian Support). Our HIPAA compliant software list covers tools that sign one.
Your ad platforms need conversions too, and this directory lists Meta and Google Ads as not signing a BAA. Curve Compliance sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.
A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.
How Curve helps
- Curve Compliance gives you a conversion signal that does not depend on Loom or a browser pixel carrying patient details.
- Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
- Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
- Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
- Event Logs show what Curve sent to each platform and what the platform accepted.
- Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Does Loom sign a BAA?
No. In Loom's words: “Loom currently is not able to sign Business Associate Agreements in support of customers’ compliance with the Health Insurance Portability and Accountability Act (HIPAA)” (Atlassian Support). We checked Loom's own support page on October 26, 2026.
Is Loom HIPAA compliant?
Loom's support page says Loom is not yet HIPAA compliant, and asks customers not to send it personal health information if doing so would violate their HIPAA obligations (Atlassian Support).
Does Atlassian's BAA cover Loom?
Atlassian says it can sign BAAs for Standard, Premium and Enterprise plans for Jira, Jira Service Management, Jira Product Discovery and Confluence (Atlassian Support). Loom's own support page says Loom is currently not able to sign BAAs (Atlassian Support).
What does Curve Compliance do for ad tracking?
Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with Atlassian before you send it patient data.
Related tools
- Does Zoom sign a BAA?Signs a BAA on specific plans. Paid plans such as Pro, Business, Business Plus and Enterprise.
- Does Vimeo sign a BAA?Signs a BAA on specific plans. Eligible Vimeo Enterprise plans.
- Does Wistia sign a BAA?Does not sign a BAA. Not HIPAA compliant; does not sign BAAs.
- Does Trello sign a BAA?No public statement. Not on Atlassian's BAA product list; PHI barred without a BAA.
- Does Google Meet sign a BAA?Signs a BAA on specific plans. Google Workspace accounts, after an administrator accepts Google's BAA.
- Does Microsoft Teams sign a BAA?Signs a BAA on specific plans. Office 365 Commercial or GCC subscriptions; BAA by default through the Data Protection Addendum.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
- Does Curve Compliance sign a BAA?Signs a BAA. Every plan: Compliance, Growth and Enterprise.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call