How many healthcare marketing tools sign a BAA?
The answer
Of the 181 healthcare marketing tools in Curve Compliance's BAA Directory, 45 sign a BAA outright, 78 sign one only on specific plans, 35 don't sign one and 23 make no public statement, as of October 2026. None of the 8 ad platforms in the directory signs one, which is why ad conversions need their own HIPAA path.
Checked on each vendor's own page between and .
Curve Compliance signs a BAA on every plan and carries your ad conversions server-side. Book a call
On this page
The answer in four numbers
| Answer | Tools | Share |
|---|---|---|
| Signs a BAA | 45 | 25% |
| Signs a BAA on specific plans | 78 | 43% |
| Does not sign a BAA | 35 | 19% |
| No public statement | 23 | 13% |
| All tools | 181 | 100% |
Each answer comes from the vendor's own page, quoted in the tool's entry with a link and the date we checked it. Curve Compliance's own entry is not counted. Shares are rounded to the nearest whole number. What each answer means.
By category
| Category | Tools | Signs | Specific plans | Does not sign | No statement |
|---|---|---|---|---|---|
| Scheduling and intake | 17 | 10 | 5 | 1 | 1 |
| CRM and email | 23 | 8 | 8 | 6 | 1 |
| Call tracking and phones | 12 | 5 | 6 | 1 | 0 |
| Analytics and data | 26 | 5 | 9 | 5 | 7 |
| Forms and landing pages | 16 | 1 | 11 | 1 | 3 |
| Support and chat | 3 | 0 | 2 | 1 | 0 |
| Messaging and payments | 12 | 1 | 3 | 3 | 5 |
| Site builders | 7 | 0 | 3 | 3 | 1 |
| Automation and workspace | 30 | 5 | 20 | 2 | 3 |
| Video, reviews and SMS | 14 | 5 | 4 | 4 | 1 |
| Ad platforms | 8 | 0 | 0 | 8 | 0 |
| AI assistants | 7 | 2 | 5 | 0 | 0 |
| HIPAA ad tracking | 6 | 3 | 2 | 0 | 1 |
Select a category for every tool in it, with each answer, its conditions and the date we checked it.
Ad platforms
None of the 8 ad platforms in the directory signs one. Each platform's entry quotes its own terms:
- Google Ads: Does not sign a BAA. Google Ads call terms disclaim HIPAA.
- LinkedIn Ads: Does not sign a BAA. Ads Agreement bars Sensitive Data, including medical.
- Meta: Does not sign a BAA. Business Tools Terms bar health information.
- Microsoft Advertising: Does not sign a BAA. No BAA for UET; keep UET off HIPAA pages.
- Pinterest Ads: Does not sign a BAA. Ad Data Terms bar sensitive categories.
- Reddit Ads: Does not sign a BAA. Business Tool Terms bar health information.
- Snapchat Ads: Does not sign a BAA. Personal Data Terms bar health information.
- TikTok: Does not sign a BAA. Business terms bar health information.
A BAA with your scheduling tool, form builder or CRM covers that vendor only. A pixel on the same page sends data to the ad platform, which is not a party to that BAA. Curve Compliance sends conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn server-side, with a fixed list of fields, under the BAA it signs on every plan.
What “specific plans” means at renewal
78 of the 181 tools (43%) sign a BAA only on the plans, editions, add-ons or products they name. For example:
- HubSpot: Enterprise subscriptions with Sensitive Data enabled.
- Intercom: Expert plan.
- Twilio: Security or Enterprise Edition; HIPAA-eligible products.
A downgrade, a new product or a team on a plan outside that list can fall outside the BAA. At renewal, check the plan named in each entry against your contract, and ask the vendor before patient information reaches a product its BAA does not name.
How we check
- We read the vendor's own pages: its trust center, terms, pricing, help center or BAA page.
- We quote the vendor word for word, link the page and record the date we checked it.
- If no vendor page settles the answer, the entry says No public statement and lists the pages we checked. We never infer a BAA from SOC 2, ISO or a page that only says HIPAA compliant.
- Curve Compliance's own entry is listed in the directory but left out of these numbers.
Most recently checked
These 59 tools were checked on :
- Boulevard: Signs a BAA on specific plans.
- Cal.com: Signs a BAA on specific plans.
- Carepatron: Signs a BAA.
- ClickUp: Signs a BAA on specific plans.
- Cloudflare: Signs a BAA on specific plans.
- Cloudflare Zaraz: Signs a BAA on specific plans.
- Cometly: No public statement.
- Crazy Egg: No public statement.
- CustomerLabs: Signs a BAA.
- Dialpad: Signs a BAA on specific plans.
- Documo (mFax): Signs a BAA.
- Doximity: Signs a BAA.
- eFax: Signs a BAA on specific plans.
- Elevar (now Audiense Online): No public statement.
- Fax.Plus: Signs a BAA on specific plans.
- Feathery: No public statement.
- Formsort: Signs a BAA on specific plans.
- Freshpaint: Signs a BAA.
- GoDaddy: Signs a BAA on specific plans.
- Google Calendar: Signs a BAA on specific plans.
- Google Docs: Signs a BAA on specific plans.
- Google Sheets: Signs a BAA on specific plans.
- Grasshopper: Does not sign a BAA.
- Hightouch: Signs a BAA on specific plans.
- Hushmail: Signs a BAA on specific plans.
- JENTIS: No public statement.
- Liine: Signs a BAA.
- Loom: Does not sign a BAA.
- Lucky Orange: No public statement.
- Matomo: Does not sign a BAA.
- Mindbody: Signs a BAA.
- Mouseflow: Signs a BAA on specific plans.
- Nextiva: Signs a BAA.
- Northbeam: Does not sign a BAA.
- OnceHub: Signs a BAA on specific plans.
- OneDrive: Signs a BAA on specific plans.
- OpenEvidence: Signs a BAA.
- Optimizely: Signs a BAA on specific plans.
- PandaDoc: Signs a BAA on specific plans.
- Paubox: Signs a BAA.
- Pendo: Signs a BAA.
- Piwik PRO: Signs a BAA on specific plans.
- Plaud: Signs a BAA.
- Proton Mail: Signs a BAA.
- Qualtrics: Signs a BAA.
- Quo (OpenPhone): Signs a BAA on specific plans.
- RudderStack: Signs a BAA on specific plans.
- ShareFile: Signs a BAA on specific plans.
- SharePoint: Signs a BAA on specific plans.
- Supabase: Signs a BAA on specific plans.
- SurveyMonkey: Signs a BAA on specific plans.
- TherapyNotes: Signs a BAA.
- Triple Whale: No public statement.
- Vagaro: Signs a BAA.
- Vercel: Signs a BAA on specific plans.
- Virtru: Signs a BAA.
- VSee: Signs a BAA.
- VWO: Does not sign a BAA.
- YouTube: No public statement.
Download the data
The whole directory is one row per tool, rebuilt from the same files as this page. Download it as CSV or JSON.
Columns: tool, vendor, category, answer, conditions, quote, source_url, entry_url, last_checked.
Each row links back to the tool's entry, where the vendor's own words and every page we checked are listed.
Check your own stack
Pick your tools in the BAA stack checker to see which of them sign a BAA. For a tool that isn't listed, or one with no public statement, ask the vendor for a BAA with our email and questionnaire. For tools grouped by what they do, see our HIPAA compliant software list.
How Curve helps
- Curve's team will map which of your tools touch patient data, and the BAA stack checker shows what each one says about a BAA.
- Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
- Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
- Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
- Event Logs show what Curve sent to each platform and what the platform accepted.
- Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
What share of marketing tools sign a BAA?
Of the 181 tools in Curve Compliance's BAA Directory, 45 sign a BAA outright, 78 sign one only on specific plans, 35 don't sign one and 23 make no public statement. That is 25% outright, 43% on specific plans, 19% not signing and 13% with no public statement. We checked each one on the vendor's own page between September 29, 2026 and October 26, 2026.
Do ad platforms sign BAAs?
No. None of the 8 ad platforms in the directory signs one: Google Ads, LinkedIn Ads, Meta, Microsoft Advertising, Pinterest Ads, Reddit Ads, Snapchat Ads and TikTok. Each entry quotes the platform's own terms. Curve Compliance sends conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn server-side, with a fixed list of fields, under the BAA it signs on every plan.
Which categories are most likely to sign?
Scheduling and intake leads on signing outright: 10 of 17 tools. Counting tools that sign only on specific plans too, the highest share is AI assistants (7 of 7). The category table has every count.
Does “HIPAA compliant” on a vendor page mean it signs a BAA?
Not by itself. HHS's online tracking bulletin says tracking technology vendors are business associates if they “create, receive, maintain, or transmit PHI on behalf of a regulated entity for a covered function,” and that regulated entities must then enter into a BAA with them. A federal court vacated part of that bulletin on June 20, 2024. In this directory, 23 tools make no public statement about a BAA, including Crazy Egg, which says it is HIPAA compliant.
How current is this data?
Every entry shows the date we last checked the vendor's own page. The checks in this report run from September 29, 2026 to October 26, 2026. Vendors change their plans and terms, so confirm the current terms with the vendor before you send it patient data.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call