Is PayPal HIPAA compliant? Does it sign a BAA?
The answer
No public statement
No public statement offering a BAA. PayPal's Invoicing terms say a HIPAA covered entity or business associate will not use Invoicing in a way that causes PayPal to create, receive, maintain or transmit protected health information on its behalf.
Messaging and payments. Checked on the vendor's own pages on .
Using PayPal on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What PayPal says
“If you are subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as a Covered Entity or Business Associate (as defined in HIPAA), you covenant and agree that you will not use Invoicing in a manner that causes PayPal to create, receive, maintain or transmit Protected Health Information (PHI) on your behalf.”
What this means for ad tracking
For a cash-pay clinic or a telehealth brand, the payment is often the conversion that matters most. Invoice line items and product names can reveal a treatment.
A purchase event sent to Meta or Google from a checkout or invoice page carries the page, the product and the value. For healthcare, that event should carry a neutral name and only the fields the platform needs.
Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.
A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.
How Curve helps
- Curve gives you a conversion signal that does not depend on PayPal or a browser pixel carrying patient details.
- Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
- A fixed field list per platform, so each ad platform receives only the fields set for it.
- PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
- When identifiers are enabled, Curve hashes them with SHA-256.
- Consent management for your site, alongside the tracking.
- A HIPAA-compliant setup done by Curve's team, with a BAA signed on every plan.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Is PayPal HIPAA compliant?
No public statement offering a BAA. PayPal's Invoicing terms say a HIPAA covered entity or business associate will not use Invoicing in a way that causes PayPal to create, receive, maintain or transmit protected health information on its behalf. Ask PayPal directly before sending it patient information.
Does PayPal sign a BAA?
No public statement offering a BAA. PayPal's Invoicing terms say a HIPAA covered entity or business associate will not use Invoicing in a way that causes PayPal to create, receive, maintain or transmit protected health information on its behalf. In PayPal's words: “If you are subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as a Covered Entity or Business Associate (as defined in HIPAA), you covenant and agree that you will not use Invoicing in a manner that causes PayPal to create, receive, maintain or transmit Protected Health Information (PHI) on your behalf.” We checked PayPal's own pages on October 5, 2026.
Can I use PayPal with patient data?
Keep Protected Health Information out of PayPal. Its Invoicing terms say a HIPAA covered entity or business associate will not use Invoicing in a way that causes PayPal to handle PHI on its behalf, and we could not find a statement from PayPal offering a BAA, so ask PayPal directly if your use needs one.
Can I still track ad conversions that come through PayPal?
Yes, when the conversion reaches your ad platforms without health information. Curve sends conversions server-side under a BAA it signs on every plan, with neutral event names and SHA-256 hashed identifiers.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with PayPal before you send it patient data.
Related tools
- Does Venmo sign a BAA?No public statement. No BAA statement found.
- Does Stripe sign a BAA?No public statement. No BAA statement found; PHI barred in Third Party Data.
- Does Square sign a BAA?Signs a BAA. Square Appointments, Invoices and other features Square identifies as HIPAA-enabled.
- Does Twilio sign a BAA?Signs a BAA on specific plans. Security or Enterprise Edition; HIPAA-eligible products.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call