Skip to main content
BAA Directory

Does RudderStack sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on its Enterprise plan. RudderStack says it can sign a BAA, and its pricing table marks HIPAA / BAA for the Enterprise plan only.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What RudderStack says

“We comply with HIPAA requirements for PHI and can sign a BAA”

Source: RudderStack Security, Industry-Standard Compliance, checked .

“HIPAA / BAA”

Source: RudderStack pricing, Compare features by plan (Legal row, marked for Enterprise only), checked .

“We do not store your data, giving you complete ownership, control and transparency.”

Source: RudderStack Security, warehouse native architecture, checked .

What this means for ad tracking

Analytics and tag scripts run on every page, including pages about a condition, a treatment or a booking. They collect page addresses, page titles, IP addresses and device identifiers, which together can connect a person to the care they were looking for.

RudderStack collects events and sends them on to the tools you connect. Its products include Event Stream, Reverse ETL, Profiles and Transformations, and it says “We do not store your data” (RudderStack). Your RudderStack setup decides which fields each destination receives.

RudderStack's plan comparison lists “HIPAA / BAA” under Legal and marks it for the Enterprise plan only, and its Enterprise plan card lists HIPAA (RudderStack pricing). Its Free and Growth plans don't show it.

A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing one, so events RudderStack sends on to them need to leave PHI behind. Our guide to HIPAA-compliant CDPs for healthcare marketing compares the options.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep RudderStack for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on RudderStack and patient data, read Curve vs Rudderstack for Healthcare Data Pipelines: BAA Coverage and PHI Routing Compared.

Frequently asked questions

Is RudderStack HIPAA compliant?

Yes, on its Enterprise plan. RudderStack says it can sign a BAA, and its pricing table marks HIPAA / BAA for the Enterprise plan only. With a signed BAA, RudderStack can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does RudderStack sign a BAA?

Yes, on its Enterprise plan. In RudderStack's words: “We comply with HIPAA requirements for PHI and can sign a BAA” (RudderStack). Its pricing table marks “HIPAA / BAA” for the Enterprise plan only (RudderStack pricing). We checked RudderStack's own pages on October 26, 2026.

Which RudderStack plan includes a BAA?

The Enterprise plan. RudderStack's plan comparison lists “HIPAA / BAA” under Legal and marks it for Enterprise only, and the Enterprise plan card lists HIPAA. The Free and Growth plans don't show it. RudderStack sells Enterprise through its sales team (RudderStack pricing).

Does RudderStack's BAA cover Meta or Google Ads?

No. A BAA binds only the vendor that signs it, so it does not extend to the destinations RudderStack sends events to. Meta and Google Ads are listed in this directory as not signing one, so keep PHI out of the events you send them.

How does Curve Compliance differ from a data pipeline?

In a pipeline, your own configuration decides which fields each destination receives. Curve's team sets up conversion tracking for you, typically live in about a week. Curve sends each ad platform only a fixed list of fields, detects PHI-like patterns before data reaches an ad platform, and shows in Event Logs what each platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with RudderStack before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call