Does Postmark sign a BAA?
The answer
Does not sign a BAA
No. Postmark says it is not HIPAA-compliant and cannot sign Business Associate Agreements.
CRM and email. Checked on the vendor's own pages on .
Using Postmark on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What Postmark says
“Postmark is not HIPAA-compliant so we do not recommend using our platform if you need to send HIPAA-compliant emails.”
“We also cannot sign any Business Associate Agreements around HIPAA.”
What this means for ad tracking
Transactional email services like Postmark send booking confirmations, reminders and receipts, so they sit right where a lead becomes a patient. Click tracking rewrites the links in those emails and open tracking adds a tracking image, and both record activity tied to a person.
Without a BAA, keep appointment details and anything that names a condition out of email sent through Postmark. The booking is the conversion your ads need, and it can reach your ad platforms without the email.
Curve Compliance closes that gap: it tracks the booking itself and sends the conversion server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without patient data in an email or a pixel. Book a call to see it on your own funnel.
How Curve helps
- Curve Compliance gives you a conversion signal that does not depend on Postmark or a browser pixel carrying patient details.
- Attribution is kept through booking tools, so a booked appointment is credited to the ad that brought the patient in, even when it is made days later.
- Server-side conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, sent from Curve's servers with neutral event names and SHA-256 hashed identifiers.
- PHI-like pattern detection flags condition names, form answers and emails in URLs before data reaches an ad platform, so they can be stopped at the source.
- A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Does Postmark sign a BAA?
No. Postmark says it is not HIPAA-compliant and cannot sign Business Associate Agreements. In Postmark's words: “We also cannot sign any Business Associate Agreements around HIPAA.” We checked Postmark's own pages on October 1, 2026.
Can I use Postmark with patient data?
Not under a BAA from Postmark, based on its own pages. Keep Protected Health Information out of Postmark, and check what it sends to other services.
Can I still track ad conversions when Postmark sends the confirmation email?
Yes. The conversion is the booking, not the email. Curve Compliance keeps ad attribution when a visitor leaves to book, and sends the booking to your ad platforms server-side under a BAA it signs on every plan, with neutral event names and SHA-256 hashed identifiers.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with Postmark before you send it patient data.
Related tools
- Does SendGrid sign a BAA?Does not sign a BAA. Not HIPAA eligible; no BAA for SendGrid.
- Does Mailgun sign a BAA?Signs a BAA. HIPAA Addendum to the Mailgun Terms of Service.
- Does Amazon SES sign a BAA?Signs a BAA. Under the AWS BAA; SES is a HIPAA Eligible Service.
- Does Twilio sign a BAA?Signs a BAA on specific plans. Security or Enterprise Edition; HIPAA-eligible products.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call