Skip to main content
BAA Directory

Is Meta HIPAA compliant? Does it sign a BAA?

The answer

Does not sign a BAA

No. Meta's Business Tools Terms say you will not share data with Meta that includes or is based on health information.

Ad platforms. Checked on the vendor's own pages on .

Running Meta ads for a healthcare brand? Curve Compliance sends your conversions server-side with PHI filtered out, under a BAA on every plan. Book a call

On this page

What Meta says

“You represent and warrant that you will not share Business Tool Data with us that (i) you know or reasonably should know is from or about children under the age of 13, (ii) includes Contact Information not hashed in accordance with Section 1.a.i, (iii) includes identifiers we do not permit, such as social security or credit card numbers, or (iv) includes or is based on, directly or otherwise, health information, financial information, consumer report information, or other categories of sensitive information (including any information defined as sensitive under applicable laws, regulations and applicable industry guidelines).”

Source: Meta Business Tools Terms, Section 1.h (effective November 3, 2025), checked .

“The names you choose and criteria you establish for your events, conversions, and any custom audiences you create must not reflect, imply or be based on any category of information described in this Section 1.h.”

Source: Meta Business Tools Terms, Section 1.h (effective November 3, 2025), checked .

What this means for ad tracking

Meta is where your conversion data ends up, so the question is not whether Meta will protect PHI but what you send it. A browser pixel sends the page address, the event name and identifiers with every conversion, and on a healthcare site those can describe a condition or a treatment.

Meta's own terms rule out health information, so the workable route is to send Meta conversions that carry none: a neutral event name, hashed identifiers and no page details that reveal care. Why healthcare sites remove the Meta pixel covers what the pixel sends on a clinic site, page by page.

Curve Compliance sends Meta conversions that way: server-side in place of the pixel, with neutral event names, PHI-like pattern detection and SHA-256 hashed identifiers, under a BAA it signs on every plan. Book a call to see it on your own funnel.

Already restricted by Meta? Start with the notice you saw: Data sharing restrictions applied, Potentially prohibited information removed, Ad rejected for personal attributes, Data source category review or Core setup.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve sends your Meta conversions server-side, in place of the Meta pixel, with neutral event names and SHA-256 hashed identifiers.
  • Curve checks every event for PHI-like patterns before it goes out, and its neutral event names keep conditions and treatments out of what the platforms see.
  • Curve keeps attribution through booking tools, so a booked appointment is credited to the ad that brought the patient in.
  • Curve adds consent management to your site, alongside the tracking.
  • Curve signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Meta and patient data, read Is the Meta Pixel HIPAA Compliant? Why Healthcare Sites Must Remove It.

Frequently asked questions

Is Meta HIPAA compliant?

No. Meta's Business Tools Terms say you will not share data with Meta that includes or is based on health information. Without a BAA, Meta should not receive patient information.

Does Meta sign a BAA?

No. Meta's Business Tools Terms say you will not share data with Meta that includes or is based on health information. In Meta's words: “The names you choose and criteria you establish for your events, conversions, and any custom audiences you create must not reflect, imply or be based on any category of information described in this Section 1.h.” We checked Meta's own pages on September 29, 2026.

Can I send Meta data about patients?

Not health information. Meta's own terms rule it out, as quoted on this page. Send Meta conversions with neutral event names and hashed identifiers, and nothing that reveals a condition or a treatment.

Can a healthcare business still track Meta ad conversions?

Yes, when the conversion carries no health information. Curve sends Meta conversions server-side, in place of the pixel, with neutral event names and identifiers hashed with SHA-256 to Meta's requirements.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Meta before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call