Skip to main content
BAA Directory

Does Mailgun sign a BAA?

The answer

Signs a BAA

Yes. Mailgun has a HIPAA Business Associate Addendum to its Terms of Service, which applies where Mailgun acts as your business associate.

CRM and email. Checked on the vendor's own pages on .

Using Mailgun on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Mailgun says

“This HIPAA Business Association Addendum (this “HIPAA Addendum”) is an addendum to the Mailgun Terms of Service (the “Terms”).”

Source: Mailgun Legal, HIPAA Business Associate Addendum (last revised 11/20/2020), checked .

“Companies that require HIPAA compliance of their communications providers are covered under Mailgun, which maintains HIPAA, SOC I & II, and GDPR compliance.”

Source: Mailgun, Sinch Email for Healthcare, checked .

What the BAA covers and excludes

Excludes or limits, in Mailgun's words:

  • "Depending on your use of the Services, they may include the transmission of plain text email in an unsecured fashion using the public internet."

What this means for ad tracking

Transactional email services like Mailgun send booking confirmations, reminders and receipts, so they sit right where a lead becomes a patient. Click tracking rewrites the links in those emails and open tracking adds a tracking image, and both record activity tied to a person.

A BAA with Mailgun covers the email Mailgun handles for you. It does not cover an ad platform, so a booking confirmed by email should reach Meta or Google as a neutral event, with no appointment details.

Curve Compliance closes that gap: it tracks the booking itself and sends the conversion server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without patient data in an email or a pixel. Book a call to see it on your own funnel.

How Curve helps

  • Keep Mailgun for what it does well. Curve Compliance carries the conversion signal to your ad platforms separately, under its own BAA.
  • Attribution is kept through booking tools, so a booked appointment is credited to the ad that brought the patient in, even when it is made days later.
  • Server-side conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, sent from Curve's servers with neutral event names and SHA-256 hashed identifiers.
  • PHI-like pattern detection flags condition names, form answers and emails in URLs before data reaches an ad platform, so they can be stopped at the source.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Mailgun sign a BAA?

Yes. Mailgun has a HIPAA Business Associate Addendum to its Terms of Service, which applies where Mailgun acts as your business associate. In Mailgun's words: “This HIPAA Business Association Addendum (this “HIPAA Addendum”) is an addendum to the Mailgun Terms of Service (the “Terms”).” We checked Mailgun's own pages on October 1, 2026.

Is Mailgun HIPAA compliant once the BAA is in place?

A BAA is Mailgun's commitment to protect the PHI it handles for you. How you send still matters: the addendum notes that email can travel as plain text over the public internet, and the BAA does not reach ad platforms that receive data from your site.

Does a BAA with Mailgun cover my ad pixels?

No. A BAA covers the data Mailgun handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with Mailgun.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Mailgun before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call