Skip to main content
BAA Directory

Is REDCap HIPAA compliant? Does it sign a BAA?

The answer

Does not sign a BAA

No. REDCap is software that institutions host themselves, and Vanderbilt says it is not a vendor and cannot complete BAA paperwork. The BAA is usually signed with the provider that hosts your REDCap.

Forms and landing pages. Checked on the vendor's own pages on .

Collecting patient details in a form? Curve Forms are HIPAA-hosted intake and lead forms with the ad that brought each person attached, covered by Curve Compliance's BAA on every plan. Book a call

On this page

What Vanderbilt says

“We are unfortunately not able to complete such documentation. Joining the REDCap consortium is not the typical vendor experience. We are not a vendor.”

Source: REDCap FAQ (on vendor documentation such as a business associates agreement), checked .

“a Business Associate Agreement (BAA) is usually required between your organization and your service provider if you’re storing Protected Health Information (PHI) on a cloud-hosted REDCap installation.”

Source: REDCap, Software requirements (virtual and cloud-based servers), checked .

“REDCap is server software. Be mindful that no software alone is truly compliant with any standard. It is the environment into which software is installed that can be called compliant.”

Source: REDCap FAQ, Is REDCap HIPAA-compliant?, checked .

What this means for ad tracking

Survey and data capture forms collect what a person types, such as symptoms, conditions and how to reach them. Whoever stores those answers needs to be covered, and the ad tags on the same pages need to stay away from them.

REDCap's HIPAA path runs through the organization that hosts it. Vanderbilt licenses REDCap to non-profit organizations that host it themselves, and says “a Business Associate Agreement (BAA) is usually required between your organization and your service provider” when PHI sits on a cloud-hosted installation (REDCap). Our guide to HIPAA compliant survey tools compares hosted options.

A BAA binds only the party that signs it. This directory lists Meta and Google Ads as not signing one, so a form conversion sent to them needs to leave PHI behind.

Curve Compliance's HIPAA intake forms, Curve Forms, are hosted by Curve under the BAA Curve signs on every plan, with ad attribution attached. Form events reach Meta, Google Ads and your other destinations server-side, and form answers are never sent. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare form builders, see our guide to HIPAA compliant forms.

How Curve helps

  • Curve Forms are HIPAA intake and lead forms hosted by Curve under the BAA Curve signs on every plan, with ad attribution attached.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does REDCap sign a BAA?

No. Asked about documentation such as a business associates agreement, REDCap's team at Vanderbilt says: “We are unfortunately not able to complete such documentation. Joining the REDCap consortium is not the typical vendor experience. We are not a vendor.” (REDCap FAQ). We checked REDCap's own pages on November 9, 2026.

Is REDCap HIPAA compliant?

REDCap can be run in a HIPAA compliant way, and the compliance belongs to the setup. Its FAQ says “It is the environment into which software is installed that can be called compliant,” so how your organization installs, hosts and maintains REDCap decides it (REDCap FAQ). Talk to your counsel about your own setup.

Who signs the BAA for a cloud-hosted REDCap?

Your hosting provider. REDCap says “a Business Associate Agreement (BAA) is usually required between your organization and your service provider if you’re storing Protected Health Information (PHI) on a cloud-hosted REDCap installation” (REDCap). Work with your provider and your privacy and security team.

What does Curve Compliance offer for intake forms?

Curve Forms are HIPAA intake and lead forms hosted by Curve under the BAA Curve signs on every plan, with ad attribution attached. Form events reach your ad platforms server-side without form answers, so the platforms learn from your leads without seeing what patients typed. To compare form builders side by side, see our guide to the best HIPAA compliant form builders. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Vanderbilt before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call