Skip to main content
BAA Directory

Does Matomo sign a BAA?

The answer

Does not sign a BAA

No. Matomo says its Cloud service is not HIPAA compliant, and that self-hosted users won't need a BAA with Matomo because it doesn't host their data.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Matomo says

“The official Matomo Cloud service is not HIPAA compliant.”

Source: Matomo FAQ, Configure Matomo Analytics for HIPAA compliance (Self-Hosting on HIPAA-Compliant Infrastructure), checked .

“You won’t need to sign the BAA document with us at Matomo since we don’t host your data and we cannot access it.”

Source: Matomo FAQ, Configure Matomo Analytics for HIPAA compliance (Business Associate Agreement), checked .

“Sign a business associate contract (BAA) with any third-parties that have access to the PHI.”

Source: Matomo FAQ, Configure Matomo Analytics for HIPAA compliance (Business Associate Agreement), checked .

What this means for ad tracking

Analytics and tag scripts run on every page, including pages about a condition, a treatment or a booking. They collect page addresses, page titles, IP addresses and device identifiers, which together can connect a person to the care they were looking for.

Matomo's HIPAA path is self-hosting. It tells healthcare users to “Download and install Matomo On-Premise on infrastructure and servers you own or lease from a HIPAA-compliant webhosting company,” and to sign a BAA with any third parties that have access to the PHI (Matomo). The company that hosts your Matomo is the one to ask for a BAA.

Matomo measures your site. Your ad platforms still need conversions to optimize on, and this directory lists Meta and Google Ads as not signing a BAA, so those conversions need to reach them without PHI. For the analytics side, see our HIPAA-compliant analytics comparison and our guide to Piwik PRO alternatives for healthcare.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Matomo for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Matomo and patient data, read Matomo vs Curve for Healthcare: Self-Hosted Analytics or Managed HIPAA Compliance.

Frequently asked questions

Does Matomo sign a BAA?

No. In Matomo's words: “You won’t need to sign the BAA document with us at Matomo since we don’t host your data and we cannot access it.” Matomo also says “The official Matomo Cloud service is not HIPAA compliant” (Matomo). We checked Matomo's own page on October 26, 2026.

Is Matomo HIPAA compliant?

Matomo Cloud is not: Matomo says “The official Matomo Cloud service is not HIPAA compliant.” Self-hosted Matomo can be. Matomo says it “can be configured in a way that it is compliant with HIPAA,” on Matomo On-Premise installed on servers you own or lease from a HIPAA-compliant host, with a BAA signed with any third parties that have access to the PHI (Matomo).

Can self-hosted Matomo be HIPAA compliant?

Matomo says it “can be configured in a way that it is compliant with HIPAA.” Its steps include installing Matomo On-Premise on HIPAA-compliant infrastructure and signing a BAA with any third parties that have access to the PHI, such as your host (Matomo). Talk to your counsel about your own setup.

How does Curve Compliance help with HIPAA ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Matomo before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call