Skip to main content
BAA Directory

Is Square HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes. Square's HIPAA BAA covers Square Appointments, Invoices and other features Square identifies as HIPAA-enabled, and you agree to it when you use them with PHI as a covered entity or business associate.

Scheduling and intake. Checked on the vendor's own pages on .

Using Square on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Square says

“This HIPAA BAA applies only to the Services and configurations where Square is acting as your Business Associate, including when you use Square Appointments, Invoices, or other features that have been explicitly identified as HIPAA-enabled by Square.”

Source: Square HIPAA Business Associate Agreement, checked .

“If you are subject to HIPAA as a Covered Entity or Business Associate, as defined in HIPAA, and use Square services in a manner that causes Square to create, receive, maintain, or transmit Protected Health Information (PHI) on your behalf, then you agree to the HIPAA Business Associate Agreement ("HIPAA BAA").”

Source: Square Support Center, Comply with Square’s HIPAA requirements, checked .

What the BAA covers and excludes

Excludes or limits, in Square's words:

  • "Not all Services are HIPAA-enabled, and you are responsible for evaluating whether a particular Service or configuration is appropriate for your use with PHI."
  • Square Buyer Services, its features for consumers: data collected through them "is processed by Square as an independent controller, not as a Business Associate."

What this means for ad tracking

The booking is the conversion most clinics optimize their ads for, and with Square the payment often comes with it. A pixel on a booking or checkout page can send the page address, the service booked and the visitor's identifiers to Meta, Google or TikTok.

A BAA with Square covers the data Square handles as your business associate, such as appointments and invoices. It does not cover what an ad pixel on a booking page sends to an ad platform, because the ad platform is a separate recipient that has not signed your BAA. Meta's Business Tools Terms bar health information, so the booking has to reach Meta without it.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

How Curve helps

  • Keep Square for what it does well. Curve carries the conversion signal to your ad platforms separately, under its own BAA.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • A fixed field list per platform, so each ad platform receives only the fields set for it.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • When identifiers are enabled, Curve hashes them with SHA-256.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Square HIPAA compliant?

Yes. Square's HIPAA BAA covers Square Appointments, Invoices and other features Square identifies as HIPAA-enabled, and you agree to it when you use them with PHI as a covered entity or business associate. With a signed BAA, Square can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Square sign a BAA?

Yes. Square's HIPAA BAA covers Square Appointments, Invoices and other features Square identifies as HIPAA-enabled, and you agree to it when you use them with PHI as a covered entity or business associate. In Square's words: “This HIPAA BAA applies only to the Services and configurations where Square is acting as your Business Associate, including when you use Square Appointments, Invoices, or other features that have been explicitly identified as HIPAA-enabled by Square.” We checked Square's own pages on October 5, 2026.

Does Square's BAA cover Square payments?

Square's BAA names Square Appointments and Invoices, plus other features Square has explicitly identified as HIPAA-enabled. It does not list payment processing by name, and it says not all Services are HIPAA-enabled, so confirm with Square which payment features it treats as HIPAA-enabled before they handle PHI.

Does a BAA with Square cover my ad pixels?

No. A BAA covers the data Square handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with Square.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Square before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call