Skip to main content
BAA Directory

Does Piwik PRO sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on two Enterprise tiers. Piwik PRO says its BAA is available in Trusted Insights and Secure Intelligence, and is signed before any data collection begins.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Piwik PRO says

“Piwik PRO signs a BAA in the Enterprise plan, making it a suitable option for organizations that must comply with HIPAA.”

Source: Piwik PRO pricing, FAQ, checked .

“Ability to sign a business associate agreement (BAA) tailored to your needs”

Source: Piwik PRO pricing, Enterprise plan key features, checked .

“Available in Trusted Insights and Secure Intelligence”

Source: Piwik PRO pricing, Enterprise plan key features, note on the BAA line, checked .

“A customized BAA is prepared and signed before any data collection begins.”

Source: Piwik PRO for healthcare, Sign your BAA, checked .

“Where the Customer requires a Business Associate Agreement for its use of the Services, such Business Associate Agreement is made available as a separate document. It applies only if the Customer downloads, completes, signs and returns it to Piwik PRO.”

Source: Piwik PRO BAA terms of service, checked .

What the BAA covers and excludes

Excludes or limits, in Piwik PRO's words:

  • Piwik PRO's plan comparison notes on its BAA row: "Doesn't cover CI CMP" (its Cookie Information Consent Management Platform).

What this means for ad tracking

Analytics and tag scripts run on every page, including pages about a condition, a treatment or a booking. They collect page addresses, page titles, IP addresses and device identifiers, which together can connect a person to the care they were looking for.

Piwik PRO is an analytics suite. Its pricing page lists Analytics, Tag Manager, Data Activation and a Consent Management Platform as the modules in its Enterprise plan, and its healthcare page lists “HIPAA-eligible Azure hosting.” The same pricing page marks the BAA as “Available in Trusted Insights and Secure Intelligence,” two of its three Enterprise tiers, and notes that it “Doesn't cover CI CMP,” the Cookie Information consent platform. The Business plan's key features don't list a BAA.

A BAA with Piwik PRO covers the data Piwik PRO handles for you. If you use its Tag Manager to fire ad platform tags, those tags send data to companies that are not party to your Piwik PRO BAA. This directory lists Meta and Google Ads as not signing a BAA, so the conversion has to reach them without health information. See which ad platforms sign a BAA.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

For a side by side, read Freshpaint vs Curve vs Piwik PRO. Comparing other analytics tools? See PostHog vs Freshpaint for healthcare.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve's team does the HIPAA-compliant setup for you, typically live in about a week, under a BAA Curve signs on every plan.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Piwik PRO and patient data, read Piwik PRO vs Curve: Which HIPAA-Compliant Analytics Platform Fits Your Practice.

Frequently asked questions

Is Piwik PRO HIPAA compliant?

Piwik PRO signs a BAA on its Trusted Insights and Secure Intelligence Enterprise tiers, and its healthcare page lists HIPAA-eligible Azure hosting. With a signed BAA, Piwik PRO can handle patient information for you, set up the way Piwik PRO describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Piwik PRO sign a BAA?

Yes, on two of its Enterprise tiers. In Piwik PRO's words: “Piwik PRO signs a BAA in the Enterprise plan, making it a suitable option for organizations that must comply with HIPAA.” Its pricing page adds that the BAA is “Available in Trusted Insights and Secure Intelligence.” We checked Piwik PRO's own pages on October 26, 2026.

Which Piwik PRO plans include a BAA?

Two Enterprise tiers, Trusted Insights and Secure Intelligence. Piwik PRO's pricing page lists the “Ability to sign a business associate agreement (BAA) tailored to your needs” among its Enterprise plan features, with the note “Available in Trusted Insights and Secure Intelligence,” and its plan comparison shows no BAA for the Business plan or the Data Fundamentals tier. Piwik PRO's BAA terms say the agreement “applies only if the Customer downloads, completes, signs and returns it to Piwik PRO.”

When does Piwik PRO sign the BAA?

Before data collection starts. Piwik PRO's healthcare page says: “A customized BAA is prepared and signed before any data collection begins.”

Does a Piwik PRO BAA cover Meta and Google Ads?

No. A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing one, so events sent on to them need to leave PHI behind.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Piwik PRO before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call