Which marketing tools sign a BAA? 40 tools checked (2026)
40 ad, analytics, CRM, email, form, chat, scheduling and payment tools checked on their own sites: who signs a HIPAA BAA, on which plan, and who does not.
Written for growth, marketing and operations leads at telehealth and DTC health brands choosing tools that may touch patient data
Of the 40 marketing tools we checked, 26 say on their own website that they sign a HIPAA business associate agreement (BAA), usually only on a top plan or a paid add-on. The other 14 either say they do not sign one or forbid health data in their terms. That second group includes the ad platforms themselves (Meta, TikTok, LinkedIn), Google Analytics, Klaviyo, Calendly and Tally. Google, counted among the 26, signs one for Local Services Ads only.
Every row below comes from the vendor’s own help center, legal page, pricing page or HIPAA page, read on October 23, 2026. Where we could not find the vendor’s own statement, we left the tool out rather than guess.
What is a BAA, and when do you need one?
A business associate agreement is the contract HIPAA requires between a covered entity (a provider, health plan or clearinghouse) and a vendor that handles protected health information (PHI) on its behalf. HHS defines a business associate as a person or entity that performs functions or services for a covered entity that involve access to protected health information.
For marketing tools, the HHS Office for Civil Rights is direct. Its guidance on online tracking technologies says that when a tracking vendor receives PHI from a regulated entity, the vendor is a business associate and a BAA is required. In June 2024 a federal court (American Hospital Association v. Becerra) vacated one part of that guidance: the part that treated an IP address plus a visit to a public, unauthenticated health page as PHI. Booking pages, symptom checkers and intake forms still collect PHI, and that is where most telehealth marketing tools sit.
Three things a BAA does not do:
- It does not make a tool “HIPAA compliant.” No agency certifies software. A BAA is one requirement; how you configure and use the tool is the rest.
- It does not cover every feature. Many BAAs below exclude AI features, add-ons or specific products.
- It does not decide whether you may use PHI for marketing. That is a separate Privacy Rule question for your counsel.
If you are not a HIPAA covered entity (many cash-pay DTC brands are not), other rules such as the FTC Health Breach Notification Rule and state health privacy laws may still apply. Our HIPAA-ready intake playbook walks through both cases.
How to use this list
Work through four questions for each tool in your stack:
- Does it receive PHI? An email address collected on an intake or booking page, a form answer about a condition, a payment tied to a treatment. If the tool never sees any of it, it may not need a BAA.
- Are you a covered entity or a business associate? If not, HIPAA may not apply to you directly, but your clinical partner’s obligations may still flow down to you by contract.
- Is a BAA available on the plan you will actually buy? The most common surprise in this list is a BAA that exists only on Enterprise.
- What exactly is sent? For tools that will not sign (ad platforms above all), the fix is to stop sending them PHI, not to find a workaround.
“Not for PHI” in the tables means the vendor’s own terms forbid sending health information, even if they never use the word BAA. Treat it the same as “no BAA.”
The 40 tools at a glance, by category
| Category | Signs a BAA | No BAA or health data forbidden |
|---|---|---|
| Ads | Google (Local Services Ads only) | Meta, TikTok, LinkedIn |
| Analytics and data | Mixpanel, Amplitude, PostHog, Twilio Segment, Freshpaint | Google Analytics, Matomo Cloud |
| CRM, email and SMS | HubSpot, Salesforce, Keap, GoHighLevel, Braze, Customer.io, Twilio, Paubox | Klaviyo, Attentive, Twilio SendGrid |
| Forms and intake | PathwAI, Jotform, Typeform, Formsort, Google Forms | Tally, Paperform |
| Chat and support | Intercom, Zendesk, Front | Tidio |
| Scheduling and video | Cal.com, Acuity Scheduling, Zoom | Calendly |
| Payments | Square | PayPal (Invoicing), Authorize.Net |
All rows were checked on October 23, 2026. Plans change: confirm with the vendor before you sign.
Ads
| Tool | BAA? | Plan or condition |
|---|---|---|
| Google Ads | Only for Local Services Ads | Google says health advertisers who have not signed a BAA with Google cannot use Local Services Ads. Standard Google Ads is not on Google’s list of BAA-covered services. |
| Meta (Pixel, Conversions API) | Not for PHI | Meta’s Business Tools Terms say you will not share data that includes or is based on health information. |
| TikTok Ads | Not for PHI | TikTok’s ads help center says not to use the TikTok Pixel on pages where you may share personal health information. |
| LinkedIn Ads | Not for PHI | LinkedIn says the Insight Tag should not be installed on pages that collect sensitive data, including pages offering specific health services. |
The practical consequence: no major ad platform will take PHI from an intake page. You still need conversions to optimize campaigns, which is why health brands send them server-side through a vendor that signs a BAA, strips PHI and passes on only hashed identifiers for visitors who consented. Our guide to HIPAA-compliant attribution tools compares the vendors that do this.
Analytics and data
| Tool | BAA? | Plan or condition |
|---|---|---|
| Google Analytics | No | Google says it does not offer BAAs for Google Analytics and makes no representation that it satisfies HIPAA. |
| Mixpanel | Yes | Enterprise plan. Mixpanel says its BAA helps Enterprise Plan customers maintain HIPAA compliance. |
| Amplitude | Yes | Plan not stated; Amplitude says it can enter a BAA and directs healthcare buyers to sales. |
| PostHog | Yes | PostHog Cloud on the Boost, Scale or Enterprise package. Self-hosting, the managed reverse proxy and PostHog AI are not covered. |
| Twilio Segment | Yes | Business tier, with a HIPAA-eligible workspace. |
| Freshpaint | Yes | Plan not stated publicly. Freshpaint describes its tracking layer as BAA- or DPA-covered. |
| Matomo Cloud | No | Matomo says its Cloud service is not HIPAA compliant. Self-hosted Matomo needs no BAA with Matomo, only with your host. |
Product analytics vendors are the easiest group to get a BAA from, but almost never on a self-serve plan. Budget for the tier before you design your tracking around one.
CRM, email and SMS
| Tool | BAA? | Plan or condition |
|---|---|---|
| HubSpot | Yes | Enterprise subscriptions, after a super admin turns on sensitive data for health information. The BAA is part of HubSpot’s Sensitive Data Terms. |
| Salesforce | Yes, for listed services | Health Cloud and Marketing Cloud Engagement are HIPAA covered services. Some Marketing Cloud features, such as Einstein features in Marketing Cloud Next, are excluded. |
| Keap | Yes | Turn on HIPAA security controls, then sign Keap’s standard BAA. CustomerHub and third-party apps are not covered. |
| GoHighLevel | Yes | HIPAA add-on, which GoHighLevel prices at US$297 a month and says cannot be cancelled once bought. Each sub-account must be switched on. |
| Braze | Yes | Only on an instance purchased as HIPAA-eligible. Braze’s BAA bars PHI that contains diagnoses or test results. |
| Customer.io | Yes | Premium and Enterprise plans, arranged through your account rep. |
| Twilio (SMS, Voice) | Yes | Security Edition or Enterprise Edition, and only for Twilio’s HIPAA-eligible products. |
| Paubox | Yes | Paubox says every account includes its BAA. |
| Klaviyo | No | Klaviyo’s acceptable use policy lists protected health information as prohibited data. |
| Attentive | No | Attentive’s content policy prohibits protected health information. |
| Twilio SendGrid | No | Twilio says it cannot sign BAAs for SendGrid. |
This is where most telehealth stacks quietly break. The email and SMS tools that DTC brands already use for their non-health products (Klaviyo and Attentive among them) are often the ones that will not take PHI. A common pattern: send treatment-specific messages from a BAA-covered tool, and keep the consumer-marketing tool for messages that carry no health information. Ask your counsel where that line sits for your program.
Forms and intake
| Tool | BAA? | Plan or condition |
|---|---|---|
| PathwAI | Yes | Enterprise plan. Builds intake, eligibility and checkout flows, with a built-in Data Platform for server-side conversions. |
| Jotform | Yes | Gold or Enterprise plan, for covered entities that turn on HIPAA features. |
| Typeform | Yes | Growth Custom or Enterprise plans only, not Growth Flow or lower. |
| Formsort | Yes | Formsort says it signs a BAA with enterprise clients. |
| Google Forms | Yes | As part of Google Workspace, once an administrator accepts Google’s BAA. Forms is covered under Drive. |
| Tally | No | Tally says it does not offer a HIPAA-compliant healthcare offering. |
| Paperform | No | Paperform says it does not sign BAAs or claim HIPAA compliance. |
The intake form is the page where PHI enters your funnel, so it is the one tool that must carry a BAA. It is also where ad pixels most often sit by accident. If you are comparing form builders on more than the BAA, see the best HIPAA-compliant form builders.
Chat and support
| Tool | BAA? | Plan or condition |
|---|---|---|
| Intercom | Yes | Expert plan. |
| Zendesk | Yes | Requires the Advanced Compliance add-on and specific security settings. |
| Front | Yes | Front says it signs BAAs for customers whose annual contract meets a threshold it does not publish. Some features, such as native email sending and tags, are excluded. |
| Tidio | No | Tidio’s terms say it is not a HIPAA business associate. |
Chat widgets on intake pages are easy to forget. A patient who types “I was just diagnosed with…” into a support chat has sent PHI to that vendor.
Scheduling and video
| Tool | BAA? | Plan or condition |
|---|---|---|
| Cal.com | Yes | Included on Enterprise and on Organizations with 15 or more users. Cal.com says smaller teams can add a BAA for $300 a month. |
| Acuity Scheduling | Yes | Premium or Powerhouse plan. The BAA covers Acuity only, not the rest of Squarespace. |
| Zoom | Yes | Zoom says it has a standard BAA it enters when customers require it. |
| Calendly | No | Calendly says it is not designed for HIPAA compliance and PHI should not be submitted to it. |
A booking confirmation that links a person to a type of appointment is PHI in most telehealth programs. Pick the scheduler before you pick the booking flow around it.
Payments
| Tool | BAA? | Plan or condition |
|---|---|---|
| Square | Yes | Square says its BAA applies when it acts as your business associate, including Square Appointments and Invoices. |
| PayPal | No, for Invoicing | PayPal’s Invoicing terms say you will not use it in a way that has PayPal handle PHI. |
| Authorize.Net | No | Authorize.Net says it does not handle HIPAA information and that payment processing is exempt under Section 1179 of HIPAA. |
Payment processors are a special case. Section 1179 of HIPAA exempts ordinary payment processing, which is why many processors neither sign a BAA nor need one. The exemption does not cover what you put in the description, invoice line or metadata: “Semaglutide, month 2” on a charge is health information sent to the processor. Keep line items generic and keep treatment details in your BAA-covered systems.
How we checked
We started from the tools telehealth and DTC health brands most often run, across seven categories: ads, analytics, CRM and messaging, forms, chat, scheduling and payments. For each, we looked for a statement on the vendor’s own site (help center, legal terms, HIPAA page or pricing page) and recorded the plan or condition attached to the BAA.
We dropped tools when we could not find or open the vendor’s own statement. That removed, among others, Heyflow, Fillout, Mailchimp, Hotjar, Heap, Microsoft Advertising and Stripe from this version. Some of them may sign a BAA; we could not confirm it on their site this week. We also left out Feathery, which says it is HIPAA compliant but did not mention a BAA on the pages we read.
We did not use third-party summaries or vendor case studies. A BAA that exists only on a plan you will not buy is listed with that plan, because that is what you will pay for.
How to do it in PathwAI
PathwAI sits in two rows above: the intake form and the layer that replaces ad pixels. The goal is that the one tool collecting PHI is also the one that decides what leaves.
- Build the flow. Describe the program to the AI agent and it drafts the eligibility, intake, consent and checkout steps on the visual canvas. Your team reviews and approves it; nothing publishes without that approval. Consent is its own step, timestamped and stored with the intake data.
- Run it on your domain. Flows run on your own domain or embedded on your site, with no third-party ad pixels on the page.
- Send conversions without PHI. The Data Platform sends conversions server-side to Meta, Google Ads, TikTok and Microsoft Ads. Email and phone are SHA-256 hashed, PHI such as date of birth and condition is stripped first, and only visitors who consented are sent.
- Pass the record on. Integrations push intake data to tools such as HubSpot, Healthie or a webhook. Choose the fields each one receives, and check that each has its own BAA.
- Sign the BAA. PathwAI signs a BAA on the Enterprise plan. Read our BAA and the HIPAA overview before your demo.
Checklist before you add a tool
- You know whether the tool will receive PHI, including emails or phone numbers collected on intake or booking pages.
- The vendor’s own site says it signs a BAA on the exact plan or add-on in your quote.
- The features you plan to use are inside the BAA (check exclusions for AI features and add-ons).
- The BAA is signed before any PHI flows, not after launch.
- Ad pixels and chat widgets are off intake, booking and checkout pages unless their vendor has signed.
- Payment descriptions and metadata carry no treatment names.
- Counsel has reviewed any marketing use of PHI.
Frequently asked questions
Does Meta or Google sign a BAA for ads?
No, not for standard ads. Meta’s terms forbid sending health information through its business tools, and Google does not list Google Ads or Google Analytics among its BAA-covered services. Google signs a BAA for Local Services Ads only. Health brands send conversions through a BAA-covered layer that strips PHI first.
Is a tool HIPAA compliant if it signs a BAA?
Not on its own. The BAA makes the vendor contractually responsible for protecting PHI. You still have to configure the tool correctly, stay inside the features the BAA covers and limit who can see the data.
Do I need a BAA with Stripe or my payment processor?
Section 1179 of HIPAA exempts ordinary payment processing, and Authorize.Net, for example, relies on it. The exemption is narrow: keep treatment names out of charge descriptions and metadata, and ask your counsel how it applies to your setup.
Which email tools sign a BAA?
Among the tools we checked: HubSpot (Enterprise), Salesforce Marketing Cloud Engagement, Braze (HIPAA-eligible instance), Customer.io (Premium and Enterprise), Keap, GoHighLevel (paid add-on) and Paubox (every account). Klaviyo, Attentive and Twilio SendGrid do not take PHI.
How often does this change?
Often. Vendors move BAAs between plans and add or drop exclusions. Treat this list as a starting point dated October 23, 2026, and get the current BAA from the vendor before you sign.
PathwAI publishes this list and is one of the tools in it. Details for other vendors come from their own websites as of October 23, 2026 and can change; confirm them with each vendor before you sign.