Skip to main content
BAA Directory

Does Stape sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on a Custom plan. Stape's pricing page says signing a BAA is available on any Custom plan.

HIPAA ad tracking. Checked on the vendor's own pages on .

Using Stape on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Stape says

“Enables signing BAA to be HIPAA compliant. Available on any Custom plan.”

Source: Stape pricing, Compare plans and features (Legal, HIPAA Compliance), checked .

“BAA for HIPAA compliance”

Source: Stape pricing, Custom plan features, checked .

“On a Custom plan, you can also sign a Business Associate Agreement (BAA) with Stape for covered services.”

Source: Stape blog, How to make your tracking HIPAA-Compliant, checked .

What this means for ad tracking

Analytics and tag scripts run on every page, including pages about a condition, a treatment or a booking. They collect page addresses, page titles, IP addresses and device identifiers, which together can connect a person to the care they were looking for.

Stape hosts server-side Google Tag Manager containers. The Server-side GTM tab of its pricing page lists “BAA for HIPAA compliance” among the features of its Custom plan, and its Free, Pro, Business and Enterprise plans don't list a BAA.

Hosting is one part of the job. Which tags fire in the container, and which fields each tag sends to Meta, Google or TikTok, is set in the container itself, so keeping PHI out of those events falls to whoever configures it. Our server-side GTM guide for healthcare walks through the setup.

Stape says its BAA is for “covered services” and tells customers to contact its sales team to “confirm which services it covers” (Stape). A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing one, so events your container sends to them need to leave PHI behind.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve's team does the HIPAA-compliant setup for you, typically live in about a week, under a BAA Curve signs on every plan.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default and SHA-256 hashed when enabled, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Stape and patient data, read Stape vs Curve for Healthcare: Server-Side GTM Hosting or Managed HIPAA Tracking.

Frequently asked questions

Is Stape HIPAA compliant?

Yes, on a Custom plan. Stape's pricing page says signing a BAA is available on any Custom plan. With a signed BAA, Stape can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Stape sign a BAA?

Yes, on a Custom plan. In Stape's words: “Enables signing BAA to be HIPAA compliant. Available on any Custom plan.” We checked Stape's pricing page on October 10, 2026.

Which Stape plans include a BAA?

Stape's pricing page lists “BAA for HIPAA compliance” only under its Custom plan, which it shows as “Let's Talk” with a “Contact sales” button. Stape's helpdesk says signing a BAA also requires “an additional charge” (Stape helpdesk). Its Free, Pro, Business and Enterprise plans don't list a BAA.

Does a Stape BAA cover the tags in my container?

It covers the Stape services the agreement names. Stape says its BAA is for “covered services” and tells customers to contact its sales team to “confirm which services it covers” (Stape). A BAA binds only the vendor that signs it, so it does not extend to the platforms your tags send events to. Meta and Google Ads are listed in this directory as not signing one, so keep PHI out of the events your tags send.

How does Curve Compliance help with server-side tracking?

Curve's team sets up server-side conversion tracking for you, typically live in about a week. Curve sends conversions to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from its own servers, detects PHI-like patterns before data reaches an ad platform, and shows in Event Logs what each platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Stape before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call