Does SendGrid sign a BAA?
The answer
Does not sign a BAA
No. Twilio says SendGrid is not a HIPAA Eligible Service and that it is not able to sign BAAs for SendGrid.
CRM and email. Checked on the vendor's own pages on .
Using SendGrid on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What Twilio says
“Twilio is not able to sign Business Associate Agreements for SendGrid, therefore, customers should not use SendGrid for any purpose or in any manner involving Protected Health Information (as defined in HIPAA).”
“SendGrid does not natively support HIPAA compliant data transmission and is not a HIPAA Eligible Service.”
What this means for ad tracking
Transactional email services like SendGrid send booking confirmations, reminders and receipts, so they sit right where a lead becomes a patient. Click tracking rewrites the links in those emails and open tracking adds a tracking image, and both record activity tied to a person.
Twilio signs a BAA for the products on its HIPAA eligible list, such as Twilio messaging and voice, but says SendGrid is not a HIPAA Eligible Service. Keep appointment details and anything that names a condition out of email sent through SendGrid.
Curve Compliance closes that gap: it tracks the booking itself and sends the conversion server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without patient data in an email or a pixel. Book a call to see it on your own funnel.
How Curve helps
- Curve Compliance gives you a conversion signal that does not depend on SendGrid or a browser pixel carrying patient details.
- Attribution is kept through booking tools, so a booked appointment is credited to the ad that brought the patient in, even when it is made days later.
- Server-side conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, sent from Curve's servers with neutral event names and SHA-256 hashed identifiers.
- PHI-like pattern detection flags condition names, form answers and emails in URLs before data reaches an ad platform, so they can be stopped at the source.
- A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Does SendGrid sign a BAA?
No. Twilio says SendGrid is not a HIPAA Eligible Service and that it is not able to sign BAAs for SendGrid. In Twilio's words: “Twilio is not able to sign Business Associate Agreements for SendGrid, therefore, customers should not use SendGrid for any purpose or in any manner involving Protected Health Information (as defined in HIPAA).” We checked Twilio's own pages on October 1, 2026.
Can I use SendGrid with patient data?
Not under a BAA from Twilio, based on its own pages. Keep Protected Health Information out of SendGrid, including appointment details in the content of your emails.
Can I still track ad conversions when SendGrid sends the confirmation email?
Yes. The conversion is the booking, not the email. Curve Compliance keeps ad attribution when a visitor leaves to book, and sends the booking to your ad platforms server-side under a BAA it signs on every plan, with neutral event names and SHA-256 hashed identifiers.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with Twilio before you send it patient data.
Related tools
- Does Twilio sign a BAA?Signs a BAA on specific plans. Security or Enterprise Edition; HIPAA-eligible products.
- Does Mailgun sign a BAA?Signs a BAA. HIPAA Addendum to the Mailgun Terms of Service.
- Does Postmark sign a BAA?Does not sign a BAA. Not HIPAA-compliant; cannot sign BAAs.
- Does Amazon SES sign a BAA?Signs a BAA. Under the AWS BAA; SES is a HIPAA Eligible Service.
- Does Mailchimp sign a BAA?Does not sign a BAA. Data Processing Addendum bars health information.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call