Skip to main content
BAA Directory

Is Qualtrics HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes, on request. Qualtrics says it will execute BAAs with its customers who are covered entities.

Forms and landing pages. Checked on the vendor's own pages on .

Collecting patient details in a form? Curve Forms are HIPAA-hosted intake and lead forms with the ad that brought each person attached, covered by Curve Compliance's BAA on every plan. Book a call

On this page

What Qualtrics says

“Upon request, Qualtrics will execute BAAs with its customers who are covered entities.”

Source: Qualtrics, Safeguarding patient information in the digital age (September 23, 2024), Understanding PHI, BAA and HIPAA, checked .

“we sign BAAs with our customers that are covered entities that allow us to process PHI”

Source: Qualtrics Support, Data Security & Privacy for Digital Experience Analytics, FAQ: Is Digital Experience Analytics HIPAA compliant?, checked .

What this means for ad tracking

Patient experience surveys go out after visits and can carry the service, the provider or the reason for a visit.

Qualtrics' BAA covers the data Qualtrics handles for you. Its article names customers who are covered entities (Qualtrics), so an agency or vendor working for a practice should ask Qualtrics directly.

A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing a BAA, so a survey response you count as a conversion should reach them with no answers attached. Our guide to HIPAA compliant survey tools compares the options.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare form builders, see our guide to HIPAA compliant forms.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Qualtrics for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Qualtrics sign a BAA?

Yes, on request. In Qualtrics' words: “Upon request, Qualtrics will execute BAAs with its customers who are covered entities” (Qualtrics). We checked Qualtrics' own page on October 26, 2026.

Which Qualtrics plans include a BAA?

The Qualtrics page we checked names no plan. It says Qualtrics will execute BAAs upon request with customers who are covered entities (Qualtrics), so ask your Qualtrics account team to add one to your contract.

Is Qualtrics HIPAA compliant?

Qualtrics says “Individual tools are not HIPAA compliant or non-compliant,” and that “we sign BAAs with our customers that are covered entities that allow us to process PHI” (Qualtrics). Whether your own use is compliant depends on your setup, so talk to your counsel.

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Qualtrics before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call