Skip to main content
BAA Directory

Is Quo (OpenPhone) HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on its Business and Scale plans. Quo says text messaging and third-party integrations are not covered services under its BAA.

Call tracking and phones. Checked on the vendor's own pages on .

Using Quo (OpenPhone) on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Quo says

“To use Quo in a HIPAA-compliant way, your organization must sign a Business Associate Agreement (BAA), which is available for Business and Scale plans.”

Source: Quo Resource Center, HIPAA compliance, checked .

“If you’re an existing Quo customer, you can request a BAA here.”

Source: Quo Resource Center, How to get a BAA with Quo, checked .

What the BAA covers and excludes

Excludes or limits, in Quo's words:

  • "Text messaging (SMS/MMS) is not a Covered Service under the Quo BAA due to technical limitations that prevent full HIPAA compliance."
  • "Any third-party integrations or connected services (including CRM systems, email delivery services, messaging platforms, analytics tools, or similar integrations) are not Covered Services under the Quo BAA."
  • "Additionally, any analytics or reporting features that transmit data to third-party analytics platforms not covered under the Quo BAA are also excluded."

What this means for ad tracking

A phone call from an ad is often a clinic's most valuable conversion. The phone system records calls, voicemails and texts, so it holds PHI and needs a BAA. Quo says its BAA “is available for Business and Scale plans” (Quo).

Quo is specific about the edges of its BAA. It says text messaging is not a covered service, that third-party integrations including “analytics tools” are not covered services, and that analytics features sending data “to third-party analytics platforms not covered under the Quo BAA are also excluded” (Quo). A BAA binds only the vendor that signs it, and this directory lists Meta and Google Ads as not signing one, so call conversions sent to them need to leave PHI behind. Our guides to HIPAA compliant phone systems and HIPAA compliant call tracking software compare BAAs by plan.

Curve Compliance helps with that part: it receives outcomes from call tracking and booking systems through incoming webhooks, credits each to the original ad click, and sends the conversion server-side under a BAA it signs on every plan. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Quo for what it does well.
  • Curve receives outcomes from call tracking and booking systems through incoming webhooks and credits each to the original ad click.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Quo (OpenPhone) HIPAA compliant?

Yes, on its Business and Scale plans. Quo says text messaging and third-party integrations are not covered services under its BAA. With a signed BAA, Quo (OpenPhone) can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Quo sign a BAA?

Yes, on its Business and Scale plans. In Quo's words: “To use Quo in a HIPAA-compliant way, your organization must sign a Business Associate Agreement (BAA), which is available for Business and Scale plans” (Quo). We checked Quo's own page on October 26, 2026.

Is texting covered by Quo's BAA?

No. Quo says “Text messaging (SMS/MMS) is not a Covered Service under the Quo BAA due to technical limitations that prevent full HIPAA compliance.” It says you may still use SMS in a manner consistent with HIPAA if you get patient authorization, limit PHI to the minimum necessary, document the decision and its risks, and put safeguards in place (Quo).

Is Quo the same as OpenPhone?

Yes. Quo's site title calls it “Quo (formerly OpenPhone)” (Quo).

Does a BAA with Quo cover call conversions sent to Google Ads or Meta?

No. A BAA binds only Quo. Google Ads and Meta are listed in this directory as not signing a BAA, so caller details and call content should stay out of the call conversions they receive.

What does Curve Compliance do for ad tracking?

Curve receives outcomes from call tracking and booking systems through incoming webhooks, credits each to the original ad click, and sends the conversion to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn server-side. It detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Quo before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call