Skip to main content
BAA Directory

Is WhatConverts HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on the Pro and Elite plans. WhatConverts turns on HIPAA compliance for a profile once your BAA is executed.

Call tracking and phones. Checked on the vendor's own pages on .

Using WhatConverts alongside paid ads? Connect it to Curve Compliance and Campaign Reporting shows its revenue and close rate next to ad spend per campaign, with conversions tracked server-side under a BAA on every plan. Book a call

On this page

What WhatConverts says

“Once your Business Associate Agreement (BAA) is executed, the WhatConverts team will activate HIPAA compliance for your profile.”

Source: WhatConverts Help Center, Enable HIPAA Compliance in a Profile, checked .

“Available on: Pro and Elite Plans”

Source: WhatConverts Help Center, Enable HIPAA Compliance in a Profile (feature availability), checked .

“A signed BAA is required to store patient data in the platform.”

Source: WhatConverts Help Center, Data, Privacy & Security FAQs, checked .

What the BAA covers and excludes

Excludes or limits, in WhatConverts's words:

  • "Webhooks must be sent to secure (HTTPS) URLs, and the receiving platform must also be HIPAA-compliant."

What this means for ad tracking

A phone call or form lead from an ad is often a clinic's most valuable conversion. WhatConverts tracks calls, forms and chats, records and transcribes calls, and can pass leads on to other tools.

A BAA with WhatConverts covers the recordings, transcripts and lead details it holds. It does not cover the ad platform that receives a call or lead conversion, so caller details and call content should stay out of what goes to Google Ads or Meta.

Curve Compliance closes that gap: WhatConverts outcomes show in Curve's Campaign Reporting as CRM revenue and close rate, and the conversion reaches your ad platforms server-side, under a BAA Curve signs on every plan. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve Compliance carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep WhatConverts for what it does well.
  • Curve shows WhatConverts outcomes in Campaign Reporting as CRM revenue and close rate, next to ad spend per platform and campaign.
  • Curve sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from its own servers, with neutral event names and SHA-256 hashed identifiers.
  • Curve flags PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, so they can be stopped at the source.
  • Curve signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is WhatConverts HIPAA compliant?

Yes, on the Pro and Elite plans. WhatConverts turns on HIPAA compliance for a profile once your BAA is executed. With a signed BAA, WhatConverts can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does WhatConverts sign a BAA?

Yes, on the Pro and Elite plans. WhatConverts turns on HIPAA compliance for a profile once your BAA is executed. In WhatConverts' words: “Once your Business Associate Agreement (BAA) is executed, the WhatConverts team will activate HIPAA compliance for your profile.” We checked WhatConverts' own pages on October 1, 2026.

Which WhatConverts plans include a BAA?

WhatConverts lists HIPAA compliance as available on its Pro and Elite plans. You request activation, and the WhatConverts team turns on HIPAA compliance for your profile once your BAA is executed.

Does a BAA with WhatConverts cover my ad pixels?

No. A BAA covers the data WhatConverts handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with WhatConverts.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with WhatConverts before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call