Is WhatsApp HIPAA compliant? Does it sign a BAA?
The answer
Does not sign a BAA
No. Meta's terms for the WhatsApp Business Platform say Meta is not a business associate under HIPAA and that the platform is not HIPAA compliant.
Messaging and payments. Checked on the vendor's own pages on .
Using WhatsApp on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What Meta says
“With regard to health information, you acknowledge that Meta is not a Business Associate or Subcontractor (as those terms are defined in the Health Insurance Portability and Accountability Act, ("HIPAA")) and that the WhatsApp Business Platform is not HIPAA compliant.”
“We make no representations or warranties that our Business App Services meet the needs of entities regulated by laws and regulations with heightened confidentiality requirements for personal data, such as healthcare, financial, or legal services entities.”
What this means for ad tracking
Clinics use WhatsApp to answer questions about treatments and to confirm visits, and some run ads that open a WhatsApp chat, so a started chat often counts as the conversion.
Because Meta's terms say it is not a business associate and the WhatsApp Business Platform is not HIPAA compliant, patient details should not go through WhatsApp, and a chat you count as a conversion should reach your ad platforms with nothing about the conversation.
Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.
A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.
How Curve helps
- Curve gives you a conversion signal that does not depend on WhatsApp or a browser pixel carrying patient details.
- Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
- A fixed field list per platform, so each ad platform receives only the fields set for it.
- PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
- When identifiers are enabled, Curve hashes them with SHA-256.
- Consent management for your site, alongside the tracking.
- A HIPAA-compliant setup done by Curve's team, with a BAA signed on every plan.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Is WhatsApp HIPAA compliant?
No. Meta's terms for the WhatsApp Business Platform say Meta is not a business associate under HIPAA and that the platform is not HIPAA compliant. Without a BAA, WhatsApp should not receive patient information.
Does WhatsApp sign a BAA?
No. Meta's terms for the WhatsApp Business Platform say Meta is not a business associate under HIPAA and that the platform is not HIPAA compliant. In Meta's words: “With regard to health information, you acknowledge that Meta is not a Business Associate or Subcontractor (as those terms are defined in the Health Insurance Portability and Accountability Act, ("HIPAA")) and that the WhatsApp Business Platform is not HIPAA compliant.” We checked Meta's own pages on October 5, 2026.
Can I use WhatsApp with patient data?
Not under a BAA from Meta, based on its own pages. Meta's Business Platform terms say Meta is not a business associate and the platform is not HIPAA compliant, and the WhatsApp Business App terms make no promise that the app meets the needs of healthcare entities. Keep Protected Health Information out of WhatsApp.
Can I still track ad conversions that come through WhatsApp?
Yes, when the conversion reaches your ad platforms without health information. Curve sends conversions server-side under a BAA it signs on every plan, with neutral event names and SHA-256 hashed identifiers.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with Meta before you send it patient data.
Related tools
- Does iMessage sign a BAA?Does not sign a BAA. License bars PHI and business associate use.
- Does Signal sign a BAA?No public statement. No BAA statement found.
- Does Telegram sign a BAA?No public statement. No BAA statement found.
- Does Twilio sign a BAA?Signs a BAA on specific plans. Security or Enterprise Edition; HIPAA-eligible products.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call