Does WordPress.com sign a BAA?
The answer
No public statement
No public statement. A search of WordPress.com's support site for HIPAA returned no articles, and its Terms of Service do not mention it.
Site builders. Checked on the vendor's own pages on .
On this page
What we checked
We looked for a statement about a BAA on WordPress.com's own pages and could not find one we could quote. These are the pages we checked:
Until WordPress.com puts a BAA in writing for you, treat it as a tool that has not agreed to protect patient data.
What this means for ad tracking
The site builder is where your pixels live. Built-in marketing integrations and tag settings load ad pixels on every page, including service pages, forms and checkout.
Without a BAA, patient data should not be collected through WordPress.com itself, and browser pixels on service, booking and checkout pages tell ad platforms which page a visitor was on.
Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.
How Curve helps
- Curve gives you a conversion signal that does not depend on WordPress.com or a browser pixel carrying patient details.
- Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
- PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
- Identifiers are hashed with SHA-256 to each platform's requirements.
- Attribution is kept through booking tools, so a booked appointment is credited to the ad that brought the patient in.
- Consent management for your site, alongside the tracking.
- A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Does WordPress.com sign a BAA?
No public statement. A search of WordPress.com's support site for HIPAA returned no articles, and its Terms of Service do not mention it. We checked WordPress.com's own pages on September 29, 2026.
Can I use WordPress.com with patient data?
Not until WordPress.com signs a BAA with you. We could not find a statement from WordPress.com offering one on its own pages, so ask WordPress.com directly and keep Protected Health Information out of WordPress.com until a BAA is in place.
Can I still track ad conversions that come through WordPress.com?
Yes, when the conversion reaches your ad platforms without health information. Curve sends conversions server-side under a BAA it signs on every plan, with neutral event names and SHA-256 hashed identifiers.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with WordPress.com before you send it patient data.
Related tools
- Does Shopify sign a BAA?Does not sign a BAA. Acceptable Use Policy: PHI not supported.
- Does Webflow sign a BAA?Does not sign a BAA. Terms: no HIPAA compliant services.
- Does Wix sign a BAA?Signs a BAA on specific plans. Business, Plus, Elite, Business Elite and Enterprise plans.
- Does Squarespace sign a BAA?Does not sign a BAA. BAA covers Acuity only, not website features.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call