Skip to main content
BAA Directory

Is TherapyNotes HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes. TherapyNotes builds its BAA into its Terms of Service, so a covered entity that accepts the terms has a BAA in effect with nothing separate to sign.

Scheduling and intake. Checked on the vendor's own pages on .

Using TherapyNotes on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What TherapyNotes says

“The BAA is now built directly into the Terms of Service for customers who need one.”

Source: TherapyNotes Help Center, FAQ: TherapyNotes Terms of Service, Privacy Policies, and Business Associate Agreement, checked .

“It means that for customers who are Covered Entities under HIPAA and require a BAA, the BAA now applies through acceptance of the Terms of Service.”

Source: TherapyNotes Help Center, FAQ: TherapyNotes Terms of Service, Privacy Policies, and Business Associate Agreement, checked .

“If you are a Covered Entity and agree to the updated Terms of Service, the BAA is automatically in effect.”

Source: TherapyNotes Help Center, FAQ: TherapyNotes Terms of Service, Privacy Policies, and Business Associate Agreement, checked .

What the BAA covers and excludes

Covers, in TherapyNotes's words:

  • "The BAA applies only to customers who are Covered Entities under HIPAA and are required to have a BAA with TherapyNotes."

What this means for ad tracking

Therapy practices often run ads that lead to a booking or a consultation request, and the pages along the way can show the kind of care a person is looking for.

TherapyNotes says its updated Terms of Service and BAA took effect April 23, 2026, and that the BAA applies to customers who are covered entities and require one (TherapyNotes). That covers TherapyNotes. A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing a BAA, so a booking you count as a conversion should reach them with no health details. Our guide to HIPAA compliant therapy platforms compares the options, and booked appointment attribution shows how Curve credits bookings to ads.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare schedulers, see our guide to HIPAA compliant scheduling software.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep TherapyNotes for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is TherapyNotes HIPAA compliant?

Yes. TherapyNotes builds its BAA into its Terms of Service, so a covered entity that accepts the terms has a BAA in effect with nothing separate to sign. With a signed BAA, TherapyNotes can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does TherapyNotes sign a BAA?

Yes. TherapyNotes says “The BAA is now built directly into the Terms of Service for customers who need one” (TherapyNotes). We checked TherapyNotes' own page on October 26, 2026.

Do I need to sign a separate BAA with TherapyNotes?

No. In TherapyNotes' words: “If you are a Covered Entity and agree to the updated Terms of Service, the BAA is automatically in effect.” It says there is nothing to sign, download or return (TherapyNotes).

Which TherapyNotes customers does the BAA cover?

TherapyNotes says the BAA applies only to customers who are covered entities under HIPAA and are required to have a BAA with TherapyNotes. If that does not apply to you, it says the BAA does not apply to your account (TherapyNotes).

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with TherapyNotes before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call