Skip to main content
BAA Directory

Is Wistia HIPAA compliant? Does it sign a BAA?

The answer

Does not sign a BAA

No. Wistia says it is not HIPAA compliant and does not sign BAAs.

Video, reviews and SMS. Checked on the vendor's own pages on .

Using Wistia on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Wistia says

“Wistia is not HIPAA compliant and does not sign BAAs. Player Privacy Mode can obscure IP addresses but does not meet HIPAA standards.”

Source: Wistia Help Center, Privacy, Data Protection, and Security, checked .

What this means for ad tracking

Video on a landing page or a patient page loads a player script, and players report plays and viewing activity. A video about a condition or a treatment, watched by an identifiable visitor, can say a lot about the care someone is looking for.

Without a BAA, keep patient videos and anything that ties a viewer to a condition out of Wistia. Wistia's Player Privacy Mode can obscure IP addresses, but Wistia says it does not meet HIPAA standards.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve Compliance gives you a conversion signal that does not depend on Wistia or a browser pixel carrying patient details.
  • Curve sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from its own servers, with neutral event names and SHA-256 hashed identifiers.
  • Curve flags PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, so they can be stopped at the source.
  • Curve keeps attribution through booking tools, so a booked appointment is credited to the ad that brought the patient in, even when it is made days later.
  • Curve signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Wistia HIPAA compliant?

No. Wistia says it is not HIPAA compliant and does not sign BAAs. Without a BAA, Wistia should not receive patient information.

Does Wistia sign a BAA?

No. Wistia says it is not HIPAA compliant and does not sign BAAs. In Wistia's words: “Wistia is not HIPAA compliant and does not sign BAAs. Player Privacy Mode can obscure IP addresses but does not meet HIPAA standards.” We checked Wistia's own pages on October 1, 2026.

Can I use Wistia with patient data?

Not under a BAA from Wistia, based on its own pages. Keep Protected Health Information out of Wistia, and check what it sends to other services.

Can I still track ad conversions that come through Wistia?

Yes, when the conversion reaches your ad platforms without health information. Curve Compliance sends conversions server-side under a BAA it signs on every plan, with neutral event names and SHA-256 hashed identifiers.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Wistia before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call