Skip to main content
BAA Directory

Does Northbeam sign a BAA?

The answer

Does not sign a BAA

No. Northbeam's terms bar customers from storing or processing sensitive personal information in it, including Personal Health Information under HIPAA.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Northbeam says

“Customer shall not store, or process Sensitive Personal Information in the Company Solution, including but not limited to Personal Health Information, as defined by the Health Insurance Portability and Accountability Act.”

Source: Northbeam Terms and Conditions, section 3.2 Restrictions, checked .

“Customer agrees and understands that the Company Solution is not designed to host, process, or store Sensitive Personal Information”

Source: Northbeam Terms and Conditions, section 3.2 Restrictions, checked .

What this means for ad tracking

Analytics and tag scripts run on every page, including pages about a condition, a treatment or a booking. They collect page addresses, page titles, IP addresses and device identifiers, which together can connect a person to the care they were looking for.

Northbeam's terms describe NB Attribution as its “multi-touch attribution solution, which provides Customer with more detailed information about Customer's web visitors and which sales and marketing efforts lead those web visitors to convert.” On a telehealth site, those visitors include people on intake, eligibility and checkout pages.

Northbeam's terms say its platform “is not designed to host, process, or store Sensitive Personal Information,” and that customers shall not process Personal Health Information in it. We found no BAA offer on its terms, privacy policy or data security pages. Without a BAA, Northbeam should stay off pages where a visit could reveal a condition, a treatment or a booking. Those are also the pages that produce your best conversion signals, so the signals need another route to your ad platforms.

This directory lists Meta and Google Ads as not signing a BAA, so the conversion has to reach them without health information. See which ad platforms sign a BAA. For how Northbeam's terms compare with Hyros and Triple Whale on health data, read Hyros vs Triple Whale vs Northbeam for telehealth.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve's team does the HIPAA-compliant setup for you, typically live in about a week, under a BAA Curve signs on every plan.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Northbeam and patient data, read Switching From Northbeam: A Guide for Telehealth Brands.

Frequently asked questions

Does Northbeam sign a BAA?

No. Northbeam's terms bar Personal Health Information, and we found no BAA offer on its terms, privacy policy or data security pages. In Northbeam's words: “Customer shall not store, or process Sensitive Personal Information in the Company Solution, including but not limited to Personal Health Information, as defined by the Health Insurance Portability and Accountability Act.” We checked Northbeam's own pages on October 26, 2026.

Is Northbeam HIPAA compliant?

Northbeam's terms say its platform “is not designed to host, process, or store Sensitive Personal Information,” and bar customers from processing Personal Health Information in it. Without a BAA, Northbeam should not receive patient information. Talk to your counsel about how this applies to your funnel.

Can a telehealth brand use Northbeam on intake or checkout pages?

Not with patient information. Northbeam's terms bar Personal Health Information, and on a telehealth site a visit to an intake, eligibility or checkout page can reveal a condition or a treatment. Send the conversions from those pages server-side through a service that signs a BAA with you.

How do I switch from Northbeam without losing attribution?

Curve's team sets up server-side conversion tracking to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, typically live in about a week. Curve's Campaign Reporting puts Meta and Google Ads spend next to Curve-tracked conversions per campaign, with five attribution models and a list of the conversions behind any number. Our guide to switching from Northbeam walks through the move.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Northbeam before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call