Skip to main content
BAA Directory

Does Stripe sign a BAA?

The answer

No public statement

No public statement offering a BAA. Stripe's Services Agreement says you must not provide Protected Health Information to Stripe as part of Third Party Data.

Messaging and payments. Checked on the vendor's own pages on .

On this page

What Stripe says

“User must not provide Protected Health Information to Stripe as part of Third Party Data. User is liable for any disclosure of Protected Health Information to Stripe when User provides access to the Third Party Data.”

Source: Stripe Services Agreement, General Terms, checked .

What this means for ad tracking

For a cash-pay clinic or a telehealth brand, the payment is often the conversion that matters most. Product names and receipts in a payment flow can reveal a treatment.

A purchase event sent to Meta or Google from a checkout page carries the page, the product and the value. For healthcare, that event should carry a neutral name and only the fields the platform needs.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

How Curve helps

  • Curve gives you a conversion signal that does not depend on Stripe or a browser pixel carrying patient details.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • Identifiers are hashed with SHA-256 to each platform's requirements.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Stripe and patient data, read Is Stripe HIPAA Compliant? Patient Payments Without a BAA Explained.

Frequently asked questions

Does Stripe sign a BAA?

No public statement offering a BAA. Stripe's Services Agreement says you must not provide Protected Health Information to Stripe as part of Third Party Data. In Stripe's words: “User must not provide Protected Health Information to Stripe as part of Third Party Data. User is liable for any disclosure of Protected Health Information to Stripe when User provides access to the Third Party Data.” We checked Stripe's own pages on September 29, 2026.

Can I use Stripe with patient data?

Keep Protected Health Information out of Stripe. Its Services Agreement says you must not provide PHI to Stripe as part of Third Party Data, and we could not find a statement from Stripe offering a BAA, so ask Stripe directly if your use needs one.

Can I still track ad conversions that come through Stripe?

Yes, when the conversion reaches your ad platforms without health information. Curve sends conversions server-side under a BAA it signs on every plan, with neutral event names and SHA-256 hashed identifiers.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Stripe before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call