Is Paubox HIPAA compliant? Does it sign a BAA?
The answer
Signs a BAA
Yes. Paubox says it includes a BAA with all accounts.
CRM and email. Checked on the vendor's own pages on .
Using Paubox on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What Paubox says
“Paubox includes a BAA with all accounts.”
“Everything you need to send HIPAA compliant emails with Google Workspace or Microsoft 365.”
What this means for ad tracking
Paubox describes its email suite as “Everything you need to send HIPAA compliant emails with Google Workspace or Microsoft 365,” and its products include Paubox Marketing and the Paubox Email API (Paubox).
A BAA binds only the vendor that signs it. Google and Microsoft have their own terms for the mailbox, listed in this directory under Google Workspace and Microsoft 365. Our guides to HIPAA compliant email providers and healthcare email marketing platforms compare the options.
The ad side is separate. Pixels on your website send data to the ad platforms, and this directory lists Meta and Google Ads as not signing one, so conversions sent to them need to leave PHI behind.
Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.
A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare CRMs, see our guide to HIPAA-compliant CRM.
How Curve helps
- Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Paubox for what it does well.
- Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
- Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
- Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
- Event Logs show what Curve sent to each platform and what the platform accepted.
- Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Is Paubox HIPAA compliant?
Yes. Paubox says it includes a BAA with all accounts. With a signed BAA, Paubox can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.
Does Paubox sign a BAA?
Yes. In Paubox's words: “Paubox includes a BAA with all accounts” (Paubox). We checked Paubox's own page on October 26, 2026.
Does Paubox work with Google Workspace or Microsoft 365?
Yes. Paubox describes its email suite as “Everything you need to send HIPAA compliant emails with Google Workspace or Microsoft 365” (Paubox). Google and Microsoft have their own BAA terms; see Google Workspace and Microsoft 365 in this directory.
Does a BAA with Paubox cover my ad pixels?
No. A BAA covers the data Paubox handles for you. A pixel sends data from the visitor's browser to Meta, Google or TikTok, and none of them is a party to your BAA with Paubox.
What does Curve Compliance do for ad tracking?
Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with Paubox before you send it patient data.
Related tools
- Does Virtru sign a BAA?Signs a BAA. All packages: Starter lists a signed BAA, and higher packages include Starter.
- Does Hushmail sign a BAA?Signs a BAA on specific plans. Hushmail for Healthcare plans (Basic, Essentials, Growth) and Hushmail for Professionals.
- Does Proton Mail sign a BAA?Signs a BAA. Signed on request; contact Proton.
- Does Google Workspace sign a BAA?Signs a BAA. Covered services such as Gmail, Drive and Meet.
- Does Microsoft 365 sign a BAA?Signs a BAA. By default through Microsoft's Data Protection Addendum; in-scope services.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
- Does Curve Compliance sign a BAA?Signs a BAA. Every plan: Compliance, Growth and Enterprise.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call