On this page
Mixpanel offers its standard BAA to Enterprise Plan customers, Amplitude says it can enter a BAA, and PostHog offers BAAs for PostHog Cloud on its Boost, Scale and Enterprise packages (Mixpanel; Amplitude; PostHog). A BAA is only half the job: HHS counts code in a mobile app as a tracking technology, so what your events carry matters as much as which vendor receives them (HHS). Curve Compliance, which sends healthcare conversions to ad platforms server-side under a BAA it signs on every plan, checked every vendor page below on November 9, 2026.
Book a call. Running ads to grow a health app or patient portal? Curve Compliance sends sign-ups and bookings from your website and web app to Meta, Google Ads and other ad platforms from its own servers, with a fixed list of fields, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
Which product analytics tools sign a BAA, by plan
Each vendor below says on its own pages that it signs a BAA. The plan matters, because on several of them the BAA comes only with a specific package or condition.
| Tool | What its own page says | Plan or condition | Directory entry |
|---|---|---|---|
| Mixpanel | Its “standard Business Associates Agreement (“BAA”), help our Enterprise Plan customers maintain their HIPAA compliance” (Mixpanel) | Enterprise Plan. “To see if you qualify for a BAA, please contact a sales representative” (Mixpanel) | Mixpanel |
| Amplitude | “Amplitude can enter a Business Associates Agreement to help you maintain your HIPAA compliance” (Amplitude) | No plan named on that page. Its AI features “are covered under our BAAs” (Amplitude) | Amplitude |
| PostHog | “PostHog only offers Business Associate Agreements (BAAs) for PostHog Cloud to users with the Boost, Scale, or Enterprise package” (PostHog) | PostHog Cloud. PostHog AI and the managed reverse proxy “are not covered by BAAs” (PostHog) | PostHog |
| Fullstory | “Fullstory provides our BAA to support our Customer’s respective HIPAA obligations when using our services” (Fullstory) | Paid plan customers ask their Account Manager. Fullstory “continues to prohibit customers from using Fullstory’s services to collect health data” (Fullstory) | Fullstory |
| Heap | Heap “signs BAAs with customers” (Heap) | No plan named on that page | Heap |
| Pendo | “Pendo supports HIPAA customers via a Business Associate Agreement” (Pendo) | For BAA customers, “Google Generative AI is on by default and OpenAI is off and cannot be turned on” (Pendo) | Pendo |
For one tool at a time, see our verdicts on Mixpanel, Amplitude, PostHog, Fullstory and Heap. A BAA covers the vendor that signs it. It doesn't decide what your app sends: event names, page addresses and properties are set by your own team.
What HHS says about tracking code in apps and patient portals
HHS defines the category broadly: “Generally, a tracking technology is a script or code on a website or mobile app used to gather information about users or their actions as they interact with a website or mobile app” (HHS). A product analytics script or SDK fits that description.
Patient portals. HHS names “a patient or health plan beneficiary portal or a telehealth platform” as examples of logged-in pages and says “Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI.” It lists “an individual's IP address, medical record number, home or email addresses, dates of appointments” as examples (HHS).
Mobile apps. HHS says information collected by a regulated entity's mobile app “generally is PHI,” and that the regulated entity must comply with the HIPAA Rules for “any subsequent disclosures to the mobile app vendor, tracking technology vendor, or any other third party who receives such information” (HHS).
Vendors that receive PHI. Regulated entities must “enter into a business associate agreement (BAA) with these tracking technology vendors to ensure that PHI is protected in accordance with the HIPAA Rules.” HHS adds that “it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information” (HHS).
On June 20, 2024, a federal court in Texas vacated part of this guidance, and HHS notes it at the top of the page: the vacated part is about tracking that connects an IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers (HHS). See what still applies after AHA v. Becerra. How this applies to your app depends on what it does and who offers it, so talk to your counsel about your own setup.
Events to track in a healthcare app, and what to leave out
- Track the step, not the detail. Use neutral event names such as account created, appointment requested or plan started. Keep condition, medication and test names out of event names and properties.
- Watch page addresses and titles. On each page load, Pendo collects “the URL, some browser information, such as language and browser version, and the title of the page (if enabled)” (Pendo). If a route or screen title names a condition, that detail travels with every page view in any tool that records it.
- Watch captured text. Pendo says the names of page elements are captured by default and “can include PII displayed in your application UI,” and that for session replay “You can replace text with asterisks to mask it or you can block entire elements of the DOM from being captured” (Pendo).
- Use an anonymous ID. Pendo “only needs a unique identifier (ID) for each user in your application to work effectively,” and says it “can be a randomly generated value that is anonymous to Pendo” (Pendo).
- Check AI add-ons separately. PostHog says its AI features “are not covered by BAAs and should not be enabled in organizations where any project processes Protected Health Information (PHI)” (PostHog), while Amplitude says “all of Amplitude’s AI features are covered under our BAAs” (Amplitude).
For a fuller list of events by page type, see event tracking on a healthcare website.
Product analytics vs ad conversion tracking
Product analytics answers how people use your app. Ad conversion tracking answers which ad brought a sign-up or booking, and it sends that event to an ad platform such as Meta or Google Ads. Those are different recipients, and a BAA with your analytics vendor covers only that vendor.
HHS describes a middle path for vendors that won't sign: a regulated entity can “establish a BAA with another vendor, for example a Customer Data Platform vendor, that will enter into a BAA with the regulated entity to de-identify online tracking information that includes PHI and then subsequently disclose only de-identified information to tracking technology vendors that are unwilling to enter into a BAA with a regulated entity” (HHS). Server-side conversion tools such as Curve Compliance sit in that middle position: Curve signs a BAA on every plan and strips PHI before data reaches an ad platform. For the website side of the same question, see what website tracking sends from a health site.
Mixpanel and Amplitude alternatives for HIPAA teams
If you are leaving Mixpanel or Amplitude over BAA terms, compare the conditions, not just the logo:
- PostHog. BAAs for PostHog Cloud on Boost, Scale or Enterprise. PostHog says it “strongly recommend[s]” that teams which need HIPAA compliance use PostHog Cloud under a BAA, “rather than the legacy self-hosted product or Hobby versions” (PostHog).
- Heap. Heap says it “signs BAAs with customers” (Heap). See our Heap verdict.
- Pendo. A BAA for HIPAA customers, with AI defaults set for them in the product (Pendo).
- Fullstory. A BAA is available, but Fullstory still prohibits health data (Fullstory), so plan on masking any screen that shows health details.
- Curve Compliance, for your website and web app. Session replay and heatmaps run under the same BAA as Curve's conversion tracking. See Curve session replay.
For website analytics tools rather than app tools, see HIPAA-compliant analytics: 10 tools and their BAA terms.
How Curve Compliance helps
Curve Compliance covers the website and web app side of a health product. It replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and each platform receives only a fixed list of fields. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names. Event Logs show what Curve sent to each platform and what the platform accepted.
Session replay and heatmaps run under the same BAA, so your product team can watch how people move through sign-up on the web. Campaign Reporting puts Meta and Google Ads spend next to Curve-tracked conversions per campaign. Curve is SOC 2 Type II, signs a BAA on every plan, and its team does the setup, typically live in about a week. Book a call to see it on your own sign-up flow.
Sources, checked November 9, 2026: Mixpanel and HIPAA; Amplitude Security and privacy; PostHog HIPAA compliance; Fullstory Business Associate Agreement; Heap on GA4 and HIPAA; Pendo AI features approval guide and Data collection and compliance; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
Frequently Asked Questions
What are the best product analytics tools for a healthcare app that needs HIPAA compliance?
Pick a tool that signs a BAA on the plan you will actually buy, such as Mixpanel on its Enterprise Plan, PostHog Cloud on Boost, Scale or Enterprise, or Amplitude, Heap or Pendo under their BAAs (Mixpanel; PostHog; Amplitude). Then keep condition and treatment names out of event names, URLs and properties.
Is Mixpanel HIPAA compliant?
Mixpanel says its standard BAA helps “our Enterprise Plan customers maintain their HIPAA compliance,” and tells customers to contact a sales representative “To see if you qualify for a BAA” (Mixpanel). See our Mixpanel verdict.
Does Amplitude sign a BAA?
Yes. Amplitude says it “can enter a Business Associates Agreement to help you maintain your HIPAA compliance,” and that its AI features “are covered under our BAAs” (Amplitude).
Does PostHog sign a BAA?
Only for PostHog Cloud on the Boost, Scale or Enterprise package, and PostHog says its AI features and managed reverse proxy are not covered by BAAs (PostHog).
Can I use Fullstory on a patient portal?
Fullstory provides a BAA but says it “continues to prohibit customers from using Fullstory’s services to collect health data” (Fullstory). On portal screens that show health details, block or mask those elements, or choose a tool that accepts health data under its BAA.
Do I still need a BAA if I only track button clicks?
Often, yes. HHS defines a tracking technology as code that gathers information about users or their actions, and says tracking on logged-in portals “generally” has access to PHI such as an IP address (HHS). If clicks on a portal or app offered by a covered entity are tied to an identifier, treat the vendor as a business associate.
Does a BAA with my analytics vendor cover Meta or Google Ads?
No. Fullstory describes a BAA as “a legally binding document between a HIPAA-covered entity and a contractor or vendor” (Fullstory), so it binds only the vendor that signs it. Curve Compliance sends ad conversions server-side under its own BAA and strips PHI before data reaches an ad platform.
Talk to Curve Compliance
Book a call. Want app sign-ups and bookings measured in Meta and Google Ads without health data in the events? Curve Compliance sends conversions server-side from your website and web app, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.