Skip to main content
BAA Directory

Is Virtru HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes. Virtru lists a signed BAA in its Starter package, and its Business, Compliance and Enterprise packages build on Starter.

CRM and email. Checked on the vendor's own pages on .

Using Virtru on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Virtru says

“Signed Business Associate’s Agreement (BAA) helps meet HIPAA compliance obligations”

Source: Virtru Data Protection Packages, Starter, checked .

“Virtru has a BAA for HIPAA compliance, and it has FedRAMP authorized, FIPS 140-3 validated encryption.”

Source: Virtru, HIPAA Compliant Email and File Encryption (Easy to Use, Powerful for HIPAA Compliance), checked .

“Send HIPAA compliant emails and attachments from Gmail, Outlook, and mobile devices.”

Source: Virtru, HIPAA Compliant Email and File Encryption, checked .

What this means for ad tracking

Email is where many patient conversations continue after the first click. Virtru encrypts email and attachments on top of the mailbox you already use. In Virtru's words, you can “Send HIPAA compliant emails and attachments from Gmail, Outlook, and mobile devices” (Virtru).

A BAA binds only the vendor that signs it. Your mailbox provider has its own terms, and this directory covers Gmail and Outlook separately. Our guide to HIPAA compliant email providers compares mailbox and secure email services.

Ad tracking is a separate question. The pixels on your contact, booking and thank-you pages send data to the ad platforms, and this directory lists Meta and Google Ads as not signing one, so those conversions need to leave PHI behind.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own. To compare CRMs, see our guide to HIPAA-compliant CRM.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Virtru for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Virtru HIPAA compliant?

Yes. Virtru lists a signed BAA in its Starter package, and its Business, Compliance and Enterprise packages build on Starter. With a signed BAA, Virtru can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Virtru sign a BAA?

Yes. In Virtru's words: “Virtru has a BAA for HIPAA compliance.” Virtru's packages page lists a “Signed Business Associate’s Agreement (BAA)” in its Starter package, and the Business package includes “Everything in Starter” (Virtru). We checked Virtru's own pages on October 26, 2026.

Does Virtru work with Gmail and Outlook?

Yes. Virtru says you can “Send HIPAA compliant emails and attachments from Gmail, Outlook, and mobile devices” (Virtru). Google and Microsoft have their own BAA terms for the mailbox itself; see Gmail and Outlook in this directory.

Does a BAA with Virtru cover my ad pixels?

No. A BAA covers the data Virtru handles for you. A pixel sends data from the visitor's browser to Meta, Google or TikTok, and none of them is a party to your BAA with Virtru.

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Virtru before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call