Skip to main content
BAA Directory

Does Meta sign a BAA?

The answer

Does not sign a BAA

No. Meta's Business Tools Terms say you will not share data with Meta that includes or is based on health information.

Ad platforms. Checked on the vendor's own pages on .

On this page

What Meta says

“You represent and warrant that you will not share Business Tool Data with us that (i) you know or reasonably should know is from or about children under the age of 13, (ii) includes Contact Information not hashed in accordance with Section 1.a.i, (iii) includes identifiers we do not permit, such as social security or credit card numbers, or (iv) includes or is based on, directly or otherwise, health information, financial information, consumer report information, or other categories of sensitive information (including any information defined as sensitive under applicable laws, regulations and applicable industry guidelines).”

Source: Meta Business Tools Terms, Section 1.h (effective November 3, 2025), checked .

“The names you choose and criteria you establish for your events, conversions, and any custom audiences you create must not reflect, imply or be based on any category of information described in this Section 1.h.”

Source: Meta Business Tools Terms, Section 1.h (effective November 3, 2025), checked .

What this means for ad tracking

Meta is where your conversion data ends up, so the question is not whether Meta will protect PHI but what you send it. A browser pixel sends the page address, the event name and identifiers with every conversion, and on a healthcare site those can describe a condition or a treatment.

Meta's own terms rule out health information, so the workable route is to send Meta conversions that carry none: a neutral event name, hashed identifiers and no page details that reveal care.

Curve Compliance sends Meta conversions that way: server-side in place of the pixel, with neutral event names, PHI-like pattern detection and SHA-256 hashed identifiers, under a BAA it signs on every plan. Book a call to see it on your own funnel.

How Curve helps

  • Curve sends your Meta conversions server-side, in place of the Meta pixel, with neutral event names and SHA-256 hashed identifiers.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • Attribution is kept through booking tools, so a booked appointment is credited to the ad that brought the patient in.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Meta and patient data, read Is the Meta Pixel HIPAA Compliant? Why Healthcare Sites Must Remove It.

Frequently asked questions

Does Meta sign a BAA?

No. Meta's Business Tools Terms say you will not share data with Meta that includes or is based on health information. In Meta's words: “The names you choose and criteria you establish for your events, conversions, and any custom audiences you create must not reflect, imply or be based on any category of information described in this Section 1.h.” We checked Meta's own pages on September 29, 2026.

Can I send Meta data about patients?

Not health information. Meta's own terms rule it out, as quoted on this page. Send Meta conversions with neutral event names and hashed identifiers, and nothing that reveals a condition or a treatment.

Can a healthcare business still track Meta ad conversions?

Yes, when the conversion carries no health information. Curve sends Meta conversions server-side, in place of the pixel, with neutral event names and identifiers hashed with SHA-256 to Meta's requirements.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Meta before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call