Best HIPAA Compliant Session Replay and Heatmap Tools

The best HIPAA compliant session replay and heatmap tool for a healthcare website is Curve Compliance, which records visitor sessions and builds heatmaps under the same BAA that covers its conversion tracking, signed on every plan. PostHog, FullStory, Amplitude, Mixpanel and Heap also offer a BAA, some only on certain plans, and Mouseflow and LogRocket mention one for enterprise and self-hosted setups. We found no BAA statement from Hotjar, and Microsoft Clarity's terms bar health care content. This guide ranks the tools and quotes each vendor's own pages, as checked on October 10, 2026.

Book a call. Curve Compliance records sessions and builds heatmaps on your site under the same BAA as your conversion tracking, and Curve's team switches them on during setup. Book a call with Curve.

Which session replay and heatmap tools sign a BAA

Curve Compliance publishes this guide and ranks itself first for what it verifiably does. Every other row links the vendor's own page, read on October 10, 2026. Each tool listed offers session replay and heatmaps, per its own site.

Tool	BAA position	Conditions and limits	Source
Curve Compliance	Signs a BAA on every plan	Same BAA as its conversion tracking	Curve
PostHog	Offers a BAA	PostHog Cloud on Boost, Scale or Enterprise; managed proxy and AI features excluded	PostHog
FullStory	Provides its BAA	Paid plans, through your account manager; health data still prohibited	Fullstory
Amplitude	Can enter a BAA	AI features covered, per Amplitude	Amplitude
Mixpanel	Offers a BAA	Enterprise Plan customers who qualify, through sales	Mixpanel
Heap	Signs BAAs with customers	No plan named on the page	Heap
Mouseflow	Open to a BAA	Enterprise commercial terms; HIPAA listed for the US region	Mouseflow
LogRocket	Lists a BAA for healthcare	Self-hosted deployments	LogRocket
Hotjar	No BAA statement found	Hotjar.com now redirects to Contentsquare	Hotjar help
Microsoft Clarity	No	Terms bar use with health care content	Microsoft
Contentsquare	No BAA statement found	Terms limit visitor data to "Permitted Personal Data"	Contentsquare
Quantum Metric	No BAA statement found	Says it is "HIPAA-ready"	Quantum Metric

Want to see recordings and heatmaps on your own booking pages? Book a call with Curve. A BAA covers only the data one vendor handles for you: Curve Compliance's BAA covers the data that passes through Curve, and any other replay tool needs its own. The BAA Directory quotes more vendors.

Why session replay needs a BAA on a clinic website

HHS names session replay in its bulletin on online tracking technologies. It lists "session replay scripts" among the tracking tools websites use, and says "Session replay scripts record a user's activities (e.g., mouse movements, clicks, and typing) when using a webpage or app." On a clinic site, that can include the service a visitor viewed and the intake form they started.

The same HHS bulletin says tracking on a page that "permits individuals to schedule appointments or use a symptom-checker tool without entering credentials may have access to PHI in certain circumstances." It says tracking vendors that receive PHI need a signed BAA, and that "it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information." Masking helps, but it does not replace a BAA. HHS notes at the top of the page that on June 20, 2024, a federal court vacated the part saying HIPAA applies when tracking connects an IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers.

The best HIPAA compliant session replay and heatmap tools, ranked

1. Curve Compliance: replay and heatmaps under the same BAA as your conversion tracking

Curve Compliance records visitor sessions and builds click, scroll and movement heatmaps under the same BAA that covers its server-side conversion tracking, signed on every plan. Recordings stay in Curve's US-hosted environment and are never sent to Meta, Google or any other ad platform (how it works). Form fields and text inputs are masked automatically in recordings, with masking on by default (Curve session replay).

Recordings are tied to your conversions. Curve's events appear on each recording's timeline, so you can jump to the moment a visitor started a booking or submitted a form. Filter by converted visits, page, event, or UTM source, medium and campaign to see how people from one ad behave. Heatmaps are built from the same recorded sessions and show desktop and mobile separately (Curve heatmaps). Curve records visits where the visitor's consent allows analytics, at the share of visits you choose, keeps recordings for 60 days and logs every play and deletion (details).

Best for: healthcare marketing teams that want replay, heatmaps and HIPAA compliant conversion tracking from one SOC 2 Type II vendor. Curve sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, detects PHI-like patterns before data reaches an ad platform, and its team does the setup, typically in about a week.

2. PostHog: product analytics with replay and heatmaps on named plans

PostHog says it "only offers Business Associate Agreements (BAAs) for PostHog Cloud to users with the Boost, Scale, or Enterprise package." The same page says "The managed reverse proxy is not covered by BAAs" and that "PostHog AI and other AI features are not covered by BAAs" (PostHog docs). PostHog masks input fields by default, but "General text is not masked by default" (PostHog replay privacy). It also offers heatmaps. Best for: product teams that can work within those limits. More in Is PostHog HIPAA compliant?

3. FullStory: a BAA, with health data still prohibited

Fullstory says "Yes, Fullstory provides our BAA to support our Customer's respective HIPAA obligations when using our services." The same article says "It is Fullstory's policy to prohibit Customers from sending us any sensitive data," and it counts health data as sensitive data. Paid customers ask their account manager for it (Fullstory help). Fullstory offers replay and heatmaps; with "Private by Default" on, "no text is captured or sent outside the user's browser unless it is explicitly allowlisted as safe to capture" (Fullstory help). Best for: product research on pages that carry no health details. See Is FullStory HIPAA compliant?

4. Amplitude: analytics, replay and heatmaps with a BAA

Amplitude says it "can enter a Business Associates Agreement to help you maintain your HIPAA compliance," and that "all of Amplitude's AI features are covered under our BAAs" (Amplitude trust page). Its Session Replay offers "default text masking," and its Heatmaps show "clicks, scrolls, and engagement hotspots." Best for: teams already on Amplitude analytics.

5. Mixpanel: a BAA for Enterprise Plan customers

Mixpanel says its standard BAA helps "our Enterprise Plan customers maintain their HIPAA compliance," and "To see if you qualify for a BAA, please contact a sales representative" (Mixpanel HIPAA). Mixpanel offers session replay and heatmaps, and says "Everything in your session replays starts fully masked by default" (Mixpanel Session Replay). Best for: enterprise product teams already on Mixpanel.

6. Heap: replay and heatmaps from a vendor that signs BAAs

Heap says it "signs BAAs with customers" (Heap blog). It offers session replay and heatmaps, with privacy settings to "Exclude sensitive information from user sessions." Best for: teams that want autocaptured analytics with replay.

7. Mouseflow: heatmaps and replay, with a BAA open on enterprise terms

Mouseflow's compliance page lists "HIPAA (US region)." In its enterprise section it says "Commercial terms are open to discussion, with room for a Business Associate Agreement or a DORA addendum where the industry requires one." It also says "Keystrokes in form fields are masked automatically" (Mouseflow security and compliance). Mouseflow offers session replay and heatmaps. Best for: heatmap-led marketing teams.

8. LogRocket: self-hosted replay for regulated teams

LogRocket's plans page lists HIPAA and a BAA for healthcare under its self-hosted deployments. Its self-hosted page says "Self-host LogRocket to ensure that all the data you capture and store complies with industry regulations, including HIPAA and FINRA" (LogRocket self-hosted). LogRocket offers session replay and heatmaps, and its SDK "can automatically sanitize all text, inputs, and images from your session recordings" (LogRocket docs). Best for: teams that can self-host.

Session replay tools with no BAA statement

On October 10, 2026 we found no BAA offer on the vendor pages we checked, or their terms bar health data. Without a BAA, keep them off pages that could reveal a condition, a treatment or a booking.

Hotjar, now part of Contentsquare

We found no statement about a BAA or HIPAA on Hotjar's Privacy FAQs, data safety or legal documents help pages. Hotjar says it "automatically suppresses keystroke data on all input fields." Hotjar.com now redirects to a Contentsquare page that says Contentsquare "includes everything Hotjar was known for." More in Hotjar vs Microsoft Clarity for healthcare and Is Hotjar HIPAA compliant?

Microsoft Clarity

Clarity's terms of use say "You will not use the Offering in connection with content which may contain sensitive user materials, such as health care, financial services or government-related information." See Is Microsoft Clarity HIPAA compliant?

Contentsquare

Contentsquare's terms say its service "is not intended for the processing of any Personal Data of Visitors other than the Permitted Personal Data." We found no BAA statement in its terms or on its Hotjar page.

Quantum Metric

Quantum Metric's healthcare page says "Quantum Metric is HIPAA-ready" and "We do not collect protected health information (PHI) or personally identifiable information (PII) by default." The page does not mention a BAA.

Hotjar alternatives for healthcare

If you use Hotjar and need a BAA, pick from the tools above that state one: Curve Compliance for replay and heatmaps tied to ad conversions under one BAA, PostHog, Amplitude, Mixpanel or Heap for product analytics, Mouseflow on enterprise terms, or LogRocket self-hosted.

What to check before turning on session replay: masking, consent and BAA scope

1. A signed BAA for your plan. Several vendors sign only on named plans. Sign before replay runs on a booking or intake page.
2. What the BAA leaves out. PostHog, for example, excludes its managed reverse proxy and AI features.
3. Masking in the browser. Confirm form fields and typed text are masked before data leaves the browser, then watch a test recording of your intake form.
4. Page text and URLs. Input masking does not hide a condition named in a heading, a page title or a URL. Check those too.
5. Consent. Record only visits where the visitor's consent allows analytics.
6. Access and retention. Limit who can watch recordings, log each view, and set a retention period.
7. Where replay runs. Decide whether replay belongs on a patient portal at all.

Curve Compliance's free website scan lists the pixels and trackers on a page. For the criteria in depth, read what makes session replay HIPAA compliant, and for analytics beyond replay, HIPAA compliant analytics tools.

Vendors change their terms. Confirm the BAA for the plan you will buy before any patient data flows, and talk to your counsel about your own HIPAA obligations.

Sources, checked October 10, 2026: HHS tracking bulletin; Fullstory BAA, privacy and home; PostHog HIPAA, privacy and heatmaps; Amplitude trust, replay and heatmaps; Mixpanel HIPAA and replay; Heap blog, replay and heatmaps; Mouseflow compliance and home; LogRocket plans, self-hosted and privacy; Hotjar Privacy FAQs, data safety and legal; Contentsquare Hotjar page and terms; Microsoft Clarity terms; Quantum Metric healthcare; the Curve Compliance BAA Directory.

Frequently Asked Questions

Is Hotjar HIPAA compliant?

We found no BAA statement on Hotjar's own help pages on October 10, 2026, so keep Hotjar off pages that could reveal a condition, a treatment or a booking. Hotjar.com now redirects to Contentsquare, whose terms limit visitor data to "Permitted Personal Data." See Hotjar in the BAA Directory.

Is Microsoft Clarity HIPAA compliant?

Not for health data. Clarity's terms bar use with content that "may contain sensitive user materials, such as health care, financial services or government-related information." See Microsoft Clarity in the BAA Directory.

Does FullStory sign a BAA?

Yes. Fullstory says it "provides our BAA" to support customers' HIPAA obligations, while it still prohibits customers from sending it health data. Customers on a paid plan request the BAA through their account manager (Fullstory help).

Which PostHog plans include a BAA?

PostHog Cloud on the Boost, Scale or Enterprise package, per PostHog's HIPAA docs. PostHog says its managed reverse proxy and its AI features are not covered by BAAs.

Can session replay record PHI?

Yes, unless it is set up to prevent it. HHS says session replay scripts record "mouse movements, clicks, and typing," and that tracking on booking pages may have access to PHI (HHS). Curve Compliance masks form fields and text inputs by default (Curve session replay) and signs a BAA on every plan.

Do I need a separate BAA for heatmaps?

Yes, if another vendor provides them or your vendor's BAA leaves them out. HHS says "all tracking technology vendors" must have "signed a BAA" before PHI is disclosed to them (HHS). Curve Compliance builds heatmaps from the same recordings, under the same BAA as replay and conversion tracking (details).

What is the best Hotjar alternative for healthcare?

Curve Compliance, if you want session replay and heatmaps tied to your ad conversions under one BAA signed on every plan. For product analytics, Amplitude, Heap, PostHog (Boost, Scale or Enterprise) and Mixpanel (Enterprise Plan) say they offer a BAA: see PostHog, Amplitude, Mixpanel and Heap in the BAA Directory.

Does Curve Compliance record sessions under a BAA?

Yes. Curve Compliance signs a BAA on every plan, and session recordings and heatmaps sit under the same agreement as its conversion tracking (details). Curve's team switches recordings on during setup, typically live in about a week. Book a call to get started.

Talk to Curve Compliance

Book a call. Curve's team will show you session recordings and heatmaps on your own pages, tied to the conversions you track, under one BAA signed on every plan. Most customers are live in about a week. Book a call with Curve.