Skip to main content
BAA Directory

Is ShareFile HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on its HIPAA Eligible plans. ShareFile's plans page marks HIPAA Eligible as included in its Premium, Enterprise and Virtual Data Room plans, with a signed BAA required.

Automation and workspace. Checked on the vendor's own pages on .

Using ShareFile on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What ShareFile (Progress Software Corporation) says

“Customers must have a signed BAA in place with ShareFile (Progress Software Corporation).”

Source: ShareFile Plans, feature table: HIPAA Eligible, checked .

“Within ShareFile, we make it easy for administrators to sign a BAA, outlining the responsibilities for protecting PHI and ensuring HIPAA compliance.”

Source: ShareFile blog, Stay compliant when sharing HIPAA-regulated content (February 28, 2024), checked .

What the BAA covers and excludes

Excludes or limits, in ShareFile (Progress Software Corporation)'s words:

  • "Certain features may be limited or unavailable."

What this means for ad tracking

ShareFile often holds intake packets, referral letters and exported lead lists, so files that tie a person to their care can end up there.

A BAA with ShareFile covers the files ShareFile handles for you. It does not cover an ad platform, so a lead list or conversion file that goes from ShareFile to Meta or Google leaves that BAA behind and should carry no health details. This directory lists Meta and Google Ads as not signing a BAA, and our guide to HIPAA compliant cloud storage compares the options.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep ShareFile for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is ShareFile HIPAA compliant?

Yes, on its HIPAA Eligible plans. ShareFile's plans page marks HIPAA Eligible as included in its Premium, Enterprise and Virtual Data Room plans, with a signed BAA required. With a signed BAA, ShareFile can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does ShareFile sign a BAA?

Yes, on its HIPAA Eligible plans. ShareFile says “Within ShareFile, we make it easy for administrators to sign a BAA, outlining the responsibilities for protecting PHI and ensuring HIPAA compliance” (ShareFile). We checked ShareFile's own pages on October 26, 2026.

Which ShareFile plans include a BAA?

ShareFile's plans page marks HIPAA Eligible as included in its Premium, Enterprise and Virtual Data Room plans, and says “Customers must have a signed BAA in place with ShareFile (Progress Software Corporation)” (ShareFile). The same note says certain features may be limited or unavailable.

Who signs the ShareFile BAA?

ShareFile's plans page names ShareFile (Progress Software Corporation) as the party to the BAA (ShareFile).

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with ShareFile (Progress Software Corporation) before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call