Skip to main content
BAA Directory

Is OnceHub HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, with OnceHub's Security and Compliance Add-On, which OnceHub says can be added to any paid plan and is included on Enterprise.

Scheduling and intake. Checked on the vendor's own pages on .

Using OnceHub on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What OnceHub says

“We willingly enter into a Business Associate Agreement (BAA) with you, as HIPAA requires.”

Source: OnceHub, HIPAA Compliant Healthcare Providers, checked .

“As defined in the BAA, we are committed to guarding your patients' Protected Health Information (PHI).”

Source: OnceHub, HIPAA Compliant Healthcare Providers, checked .

“Enhanced security and compliance for your account. Can be added to any paid plan.”

Source: OnceHub Pricing, Security and Compliance Add-On (lists HIPAA BAA Agreements), checked .

“Security and compliance add-on included”

Source: OnceHub Pricing, Enterprise, checked .

What the BAA covers and excludes

Excludes or limits, in OnceHub's words:

  • SMS reminders: “SMS reminders are not HIPAA compliant”, in OnceHub's FAQ on its HIPAA page.

What this means for ad tracking

Booking pages ask what a patient wants to be seen for and when. Routing forms, booking forms and confirmation pages can carry a service or a reason for the visit, which can connect a person to the care they were looking for.

OnceHub says “We willingly enter into a Business Associate Agreement (BAA) with you, as HIPAA requires” (OnceHub), and its pricing page lists HIPAA BAA Agreements in its Security and Compliance Add-On (OnceHub). OnceHub also says “SMS reminders are not HIPAA compliant,” so check which reminders you turn on.

A BAA with OnceHub covers the booking data OnceHub handles for you. This directory lists Meta and Google Ads as not signing one, so a booking counted as an ad conversion needs to reach them without PHI.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare schedulers, see our guide to HIPAA compliant scheduling software.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep OnceHub for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is OnceHub HIPAA compliant?

OnceHub says it enters into a Business Associate Agreement with you, as HIPAA requires, and lists HIPAA BAA Agreements in its Security and Compliance Add-On (OnceHub). With a signed BAA, OnceHub can handle patient scheduling data for you, set up the way OnceHub describes. OnceHub also says “SMS reminders are not HIPAA compliant.”

Does OnceHub sign a BAA on every plan?

OnceHub's pricing page lists HIPAA BAA Agreements in its Security and Compliance Add-On, which it says “Can be added to any paid plan,” and says the add-on is included on Enterprise. We checked OnceHub's own pages on October 26, 2026.

Does a BAA with OnceHub cover my ad pixels?

No. A BAA covers the data OnceHub handles for you. A pixel sends data from the visitor's browser to Meta, Google or TikTok, and none of them is a party to your BAA with OnceHub.

What should I use for ad conversions on pages where OnceHub runs?

Send the booking to your ad platforms server-side, without health details. Curve Compliance replaces browser ad pixels with one script and sends conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from its servers, with a fixed list of fields and neutral event names, under a BAA it signs on every plan. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with OnceHub before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call