Skip to main content
BAA Directory

Is PandaDoc HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on Annual Enterprise plans. PandaDoc says customers should sign a BAA with it before sending ePHI through PandaDoc, and arranges it through its support team.

Forms and landing pages. Checked on the vendor's own pages on .

Collecting patient details in a form? Curve Forms are HIPAA-hosted intake and lead forms with the ad that brought each person attached, covered by Curve Compliance's BAA on every plan. Book a call

On this page

What PandaDoc says

“In order to transmit electronic Protected Health Information (ePHI) using PandaDoc and maintain it with HIPAA compliance, customers should sign a Business Associate Agreement (BAA) with PandaDoc.”

Source: PandaDoc, HIPAA compliance (Business Associate Agreement), checked .

“Please contact the PandaDoc support team via this link to sign a Business Associate Agreement.”

Source: PandaDoc, HIPAA compliance FAQ: How do I enable HIPAA compliance for my PandaDoc account?, checked .

“PandaDoc can support HIPAA compliance with a signed BAA for Annual Enterprise plans”

Source: PandaDoc Pricing, Compare the plans: HIPAA compliance (optional on Enterprise), checked .

What this means for ad tracking

Proposals, consent forms and patient agreements often go out for e-signature, and a signed document can be the step a practice counts as a conversion.

A BAA with PandaDoc covers the documents PandaDoc handles for you. It does not cover a pixel on the page a signer lands on afterwards, so a completed signature should reach your ad platforms as a neutral event with nothing from the document.

This directory lists Meta and Google Ads as not signing a BAA. Our guide to HIPAA compliant e-signature tools compares the options.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare form builders, see our guide to HIPAA compliant forms.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep PandaDoc for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is PandaDoc HIPAA compliant?

Yes, on Annual Enterprise plans. PandaDoc says customers should sign a BAA with it before sending ePHI through PandaDoc, and arranges it through its support team. With a signed BAA, PandaDoc can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does PandaDoc sign a BAA?

Yes. PandaDoc says customers who transmit ePHI using PandaDoc “should sign a Business Associate Agreement (BAA) with PandaDoc” (PandaDoc). We checked PandaDoc's own pages on October 26, 2026.

Which PandaDoc plans include a BAA?

PandaDoc's plan comparison lists HIPAA compliance as optional on its Enterprise plan only, and says “PandaDoc can support HIPAA compliance with a signed BAA for Annual Enterprise plans” (PandaDoc). Its HIPAA page asks customers to contact PandaDoc support to sign one (PandaDoc).

How do I enable HIPAA compliance in PandaDoc?

In PandaDoc's words: “Please contact the PandaDoc support team via this link to sign a Business Associate Agreement” (PandaDoc).

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with PandaDoc before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call