Skip to main content
BAA Directory

Is Optimizely HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, for enterprise customers. Optimizely says it signs BAAs with enterprise customers and names its CMS and Web and Feature Experimentation as HIPAA-ready.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Optimizely says

“Signing Business Associate Agreements (BAAs) with enterprise customers”

Source: Optimizely Trust Center, Compliance (HIPAA), checked .

“To view our Optimizely Business Associate Agreement, current customers reach out to your Customer Success Manager. For prospective customers, please reach out to your sales representative.”

Source: Optimizely Trust Center, Compliance (HIPAA), checked .

“Optimizely will now also act as a Business Associate when partnering with Healthcare & Life Sciences (HLS) customers.”

Source: Optimizely press release, November 20, 2024, checked .

What the BAA covers and excludes

Covers, in Optimizely's words:

  • Optimizely lists its HIPAA-ready Software Services as “Content Management System (CMS) (PaaS & SaaS)” and “Web & Feature Experimentation Services.”

Excludes or limits, in Optimizely's words:

  • Future HIPAA features, per Optimizely's HIPAA Disclosure and Safe Harbor note: “It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions.”

What this means for ad tracking

Testing scripts run on the pages you test, and on a healthcare site those can include service, booking and intake pages. A page address, a page title or a form step can connect a visitor to the care they were looking for.

Optimizely says it signs BAAs with enterprise customers, and its November 2024 announcement says it “will now also act as a Business Associate when partnering with Healthcare & Life Sciences (HLS) customers” (Optimizely). Ask Optimizely which products your BAA covers before patient information reaches it. Our guide to HIPAA-compliant A/B testing covers setups that keep PHI out of testing tools.

A BAA with Optimizely covers your testing data, not the ad pixels on the same pages. This directory lists Meta and Google Ads as not signing a BAA, so the conversions your ads count need their own path.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Optimizely for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Optimizely HIPAA compliant?

Optimizely says its CMS and its Web and Feature Experimentation services are HIPAA-ready and that it signs BAAs with enterprise customers (Optimizely). With a signed BAA, Optimizely can handle patient information for you on those products. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Optimizely sign a BAA on every plan?

Optimizely's Trust Center says it signs BAAs “with enterprise customers” and names its CMS (PaaS and SaaS) and Web and Feature Experimentation as its HIPAA-ready services. Current customers ask their Customer Success Manager for the BAA, and prospective customers ask their sales representative. We checked Optimizely's own pages on October 26, 2026.

Does a BAA with Optimizely cover my ad pixels?

No. A BAA covers the data Optimizely handles for you. A pixel sends data from the visitor's browser to Meta, Google or TikTok, and none of them is a party to your BAA with Optimizely.

What should I use for ad conversions on pages where Optimizely runs?

Send conversions server-side, without health details. Curve Compliance replaces browser ad pixels with one script and sends conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from its servers, with a fixed list of fields and neutral event names, under a BAA it signs on every plan. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Optimizely before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call