Skip to main content
BAA Directory

Is YouTube HIPAA compliant? Does it sign a BAA?

The answer

No public statement

No public statement offering a BAA for YouTube. YouTube is not on Google's list of Workspace services covered by its BAA.

Video, reviews and SMS. Checked on the vendor's own pages on .

Using YouTube on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Google says

“The following Google Workspace services are included in the Google Cloud BAA:”

Source: Google, HIPAA Included Functionality (Google Workspace supported services; YouTube is not listed), checked .

“PHI is not permitted in other Non-Core Services offered by Google where Google has not made a separate HIPAA BAA available for use of such service.”

Source: Google Workspace and Cloud Identity HIPAA Implementation Guide, checked .

What this means for ad tracking

A YouTube embed loads Google's player on the page where it sits, and on a healthcare site that page can be about a condition, a treatment or a booking.

Google says “PHI is not permitted in other Non-Core Services offered by Google where Google has not made a separate HIPAA BAA available for use of such service,” and its HIPAA guide names YouTube among the Non-Core Services to disable for Workspace users who manage PHI, unless a separate BAA covers it (Google). Keep patient information out of YouTube.

For patient-facing video that needs a BAA, this directory lists video hosts and meeting tools by plan, such as Vimeo and Zoom.

Your ad platforms need conversions too, and this directory lists Meta and Google Ads as not signing a BAA. Curve Compliance sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve's free website scan lists the pixels and trackers on a page, so you can see what your video pages load.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is YouTube HIPAA compliant?

YouTube is not on Google's list of Workspace services included in its BAA, and Google says “PHI is not permitted in other Non-Core Services offered by Google where Google has not made a separate HIPAA BAA available for use of such service” (Google). Keep patient information out of YouTube.

Does YouTube sign a BAA?

No public statement offering one. YouTube is not on Google's list of Workspace services covered by its BAA, and we found no separate BAA for YouTube on Google's own pages. We checked them on October 26, 2026.

Does Google Workspace's BAA cover YouTube?

No. Google lists the Workspace services its BAA covers, such as Gmail, Google Drive and Google Meet, and YouTube is not on that list. Google's HIPAA guide names YouTube among the services to disable for Workspace users who manage PHI, unless a separate BAA covers it.

Can I embed YouTube videos on a clinic website?

An embed shows a video; it should never carry patient information, and patient videos should not be uploaded to YouTube. On pages about a condition or a booking, check what every embed and tag on the page loads. Curve Compliance's free website scan lists the pixels and trackers on a page.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Google before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call