Skip to main content
BAA Directory

Is Snowflake HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on Business Critical Edition and Virtual Private Snowflake. Snowflake says a signed BAA must be in place before any PHI is stored in Snowflake.

Analytics and data. Checked on the vendor's own pages on .

Measuring a healthcare website? Curve Compliance includes web analytics, session replay and heatmaps under the same BAA as its HIPAA-compliant ad tracking. Book a call

On this page

What Snowflake says

“Business Critical Edition, formerly known as Enterprise for Sensitive Data (ESD), offers even higher levels of data protection to support the needs of organizations with extremely sensitive data, particularly PHI data”

Source: Snowflake Documentation, Snowflake editions (Business Critical Edition), checked .

“before any PHI data can be stored in Snowflake, a signed business associate agreement (BAA) must be in place between your agency/organization and Snowflake Inc.”

Source: Snowflake Documentation, Snowflake editions (Business Critical Edition, note), checked .

What the BAA covers and excludes

Covers, in Snowflake's words:

  • Virtual Private Snowflake (VPS): Snowflake says it “includes all the features and services of Business Critical Edition, but in a completely separate Snowflake environment” (Snowflake Documentation).

Excludes or limits, in Snowflake's words:

  • Standard and Enterprise Editions: Snowflake's feature table marks support for PHI data for Business Critical and Virtual Private Snowflake only (Snowflake Documentation).

What this means for ad tracking

Data teams load ad spend, site analytics, CRM records and bookings into Snowflake, and once those tables meet, a row can connect a person to the care they were looking for.

A BAA with Snowflake covers the data stored in an eligible account. It does not cover the ad platforms the data came from or goes to, so audiences or conversions sent from your warehouse to Meta or Google leave the BAA behind. Our HIPAA-compliant analytics comparison covers the measurement side.

Curve Compliance closes that gap: Campaign Reporting puts Meta and Google Ads spend next to Curve-tracked conversions per platform and campaign, and the conversions themselves reach your ad platforms server-side, under a BAA Curve signs on every plan. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Snowflake for what it does well.
  • Curve puts Meta and Google Ads spend next to the conversions it tracks, per platform and campaign, in Campaign Reporting, with five attribution models and the conversions behind any number.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Snowflake sign a BAA?

Yes, on Business Critical Edition and Virtual Private Snowflake. Snowflake's documentation says “before any PHI data can be stored in Snowflake, a signed business associate agreement (BAA) must be in place between your agency/organization and Snowflake Inc.” (Snowflake Documentation). We checked Snowflake's own pages on November 9, 2026.

Is Snowflake HIPAA compliant?

Snowflake supports PHI on Business Critical Edition, which it says is built for “organizations with extremely sensitive data, particularly PHI data,” and on Virtual Private Snowflake, with a signed BAA in place first (Snowflake Documentation). How you load, share and secure the data is still your responsibility, so talk to your counsel about your own setup.

Which Snowflake editions support PHI?

Business Critical Edition, formerly called Enterprise for Sensitive Data, and Virtual Private Snowflake, which Snowflake says “includes all the features and services of Business Critical Edition” (Snowflake Documentation). Snowflake's feature table does not mark Standard or Enterprise Edition for PHI data.

Does a BAA with Snowflake cover my ad pixels?

No. A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing a BAA, so audiences and conversions sent to them need to leave PHI behind.

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Snowflake before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call