Skip to main content
BAA Directory

Does Twilio sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on Twilio Security Edition or Enterprise Edition, for HIPAA-eligible products.

Messaging and payments. Checked on the vendor's own pages on .

On this page

What Twilio says

“HIPAA Accounts require Twilio Security Edition or Enterprise Edition.”

Source: Twilio Docs, HIPAA Accounts, checked .

“customers that are subject to HIPAA and intend to utilize Twilio's products and services to develop communication workflows containing PHI must execute a Business Associate Addendum (BAA) to Twilio's Terms of Service.”

Source: Twilio and HIPAA, checked .

What the BAA covers and excludes

Excludes or limits, in Twilio's words:

  • "HIPAA compliance is a shared responsibility between you and Twilio. Signing a BAA alone does not make your application HIPAA-compliant. You must also follow the architecture guidelines and use only HIPAA-eligible services."

What this means for ad tracking

Twilio carries appointment reminders, follow-up texts and calls, so it holds exactly the kind of message that ties a person to their care.

A BAA with Twilio covers those messages. It does not cover an ad platform, so a reply, a confirmed appointment or a call that you count as a conversion should reach Meta or Google as a neutral event with no message content.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

How Curve helps

  • Keep Twilio for what it does well. Curve carries the conversion signal to your ad platforms separately, under its own BAA.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • Identifiers are hashed with SHA-256 to each platform's requirements.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Twilio sign a BAA?

Yes, on Twilio Security Edition or Enterprise Edition, for HIPAA-eligible products. In Twilio's words: “HIPAA Accounts require Twilio Security Edition or Enterprise Edition.” We checked Twilio's own pages on September 29, 2026.

Which Twilio plans include a BAA?

Twilio's HIPAA Accounts require Security Edition or Enterprise Edition, and the BAA covers the products on Twilio's HIPAA Eligible Products and Services list.

Does a BAA with Twilio cover my ad pixels?

No. A BAA covers the data Twilio handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with Twilio.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Twilio before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call