Skip to main content
BAA Directory

Does Microsoft Advertising sign a BAA?

The answer

Does not sign a BAA

No. Microsoft says it does not offer BAAs for UET, its conversion tag, and tells advertisers not to place UET tags on pages subject to HIPAA.

Ad platforms. Checked on the vendor's own pages on .

Running Microsoft Advertising for a healthcare brand? Curve Compliance sends your conversions server-side with PHI filtered out, under a BAA on every plan. Book a call

On this page

What Microsoft says

“Microsoft does not offer Business Associate Agreements (BAAs) for UET and does not represent that UET meets HIPAA requirements.”

Source: Microsoft Advertising Help, UET technical safeguards for sensitive data, Microsoft HIPAA disclaimer, checked .

“Do not place UET tags on pages subject to HIPAA regulations.”

Source: Microsoft Advertising Help, UET technical safeguards for sensitive data, Advertiser responsibilities, checked .

What this means for ad tracking

Microsoft Advertising is where your conversion data ends up, so the question is not whether Microsoft will protect PHI but what you send it. The UET tag sends the page address, the event name and identifiers with every conversion, and on a healthcare site those can describe a condition or a treatment.

Microsoft's own help pages rule out health information, so the workable route is to send Microsoft Advertising conversions that carry none: a neutral event name, hashed identifiers and no page details that reveal care. Microsoft also says remarketing and audience features are turned off when an advertiser selects the Healthcare/Pharma vertical.

Curve Compliance sends Microsoft Advertising conversions that way: server-side in place of the UET tag, with neutral event names, PHI-like pattern detection and SHA-256 hashed identifiers, under a BAA it signs on every plan. Book a call to see it on your own funnel.

How Curve helps

  • Curve Compliance sends your Microsoft Advertising conversions server-side, in place of the UET tag, with neutral event names and SHA-256 hashed identifiers.
  • PHI-like pattern detection flags condition names, form answers and emails in URLs before data reaches an ad platform, so they can be stopped at the source.
  • Event Logs show what Curve sent to Microsoft Advertising and what Microsoft accepted.
  • Attribution is kept through booking tools, so a booked appointment is credited to the ad that brought the patient in, even when it is made days later.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Microsoft Advertising sign a BAA?

No. Microsoft says it does not offer BAAs for UET, its conversion tag, and tells advertisers not to place UET tags on pages subject to HIPAA. In Microsoft's words: “Microsoft does not offer Business Associate Agreements (BAAs) for UET and does not represent that UET meets HIPAA requirements.” We checked Microsoft's own pages on October 1, 2026.

Can I send Microsoft Advertising data about patients?

Not health information. Microsoft's own help pages rule it out, as quoted on this page. Send Microsoft Advertising conversions with neutral event names and hashed identifiers, and nothing that reveals a condition or a treatment.

Can a healthcare business still track Microsoft Advertising conversions?

Yes, when the conversion carries no health information. Curve Compliance sends Microsoft Advertising conversions server-side, in place of the UET tag, with neutral event names and identifiers hashed with SHA-256 to Microsoft's requirements.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Microsoft before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call