Skip to main content
BAA Directory

Is WordPress.com HIPAA compliant? Does it sign a BAA?

The answer

No public statement

No public statement. A search of WordPress.com's support site for HIPAA returned no articles, and its Terms of Service do not mention it.

Site builders. Checked on the vendor's own pages on .

Using WordPress.com on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What we checked

We looked for a statement about a BAA on WordPress.com's own pages and could not find one we could quote. These are the pages we checked:

Until WordPress.com puts a BAA in writing for you, treat it as a tool that has not agreed to protect patient data.

What this means for ad tracking

The site builder is where your pixels live. Built-in marketing integrations and tag settings load ad pixels on every page, including service pages, forms and checkout.

Without a BAA, patient data should not be collected through WordPress.com itself, and browser pixels on service, booking and checkout pages tell ad platforms which page a visitor was on.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve gives you a conversion signal that does not depend on WordPress.com or a browser pixel carrying patient details.
  • Curve tracks conversions server-side in place of pixels, so they reach your ad platforms from Curve's server, not from the patient's browser.
  • Curve checks every event for PHI-like patterns before it goes out, and its neutral event names keep conditions and treatments out of what the platforms see.
  • Curve hashes identifiers with SHA-256 to each platform's requirements.
  • Curve keeps attribution through booking tools, so a booked appointment is credited to the ad that brought the patient in.
  • Curve adds consent management to your site, alongside the tracking.
  • Curve signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is WordPress.com HIPAA compliant?

No public statement. A search of WordPress.com's support site for HIPAA returned no articles, and its Terms of Service do not mention it. Ask WordPress.com directly before sending it patient information.

Does WordPress.com sign a BAA?

No public statement. A search of WordPress.com's support site for HIPAA returned no articles, and its Terms of Service do not mention it. We checked WordPress.com's own pages on September 29, 2026.

Can I use WordPress.com with patient data?

Not until WordPress.com signs a BAA with you. We could not find a statement from WordPress.com offering one on its own pages, so ask WordPress.com directly and keep Protected Health Information out of WordPress.com until a BAA is in place.

Can I still track ad conversions that come through WordPress.com?

Yes, when the conversion reaches your ad platforms without health information. Curve sends conversions server-side under a BAA it signs on every plan, with neutral event names and SHA-256 hashed identifiers.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with WordPress.com before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call