Conditional Piwik PRO offers a BAA on the Enterprise plan and during the 30-day Business free trial; the main exclusion is the paid Business plan after the trial (verdict date 2026-10-28).
Whether you can put PHI-adjacent analytics data into Piwik PRO depends on your plan, your hosting region and a countersigned BAA, not on the product name.
Short answer
Piwik PRO signs a BAA on Enterprise (from EUR 366/month billed annually) and during the free Business trial. After the trial, the paid Business plan has no BAA. Customizing the BAA terms is possible only on paid Enterprise. US HIPAA-eligible Azure hosting is an Enterprise option.
In the wording this site uses: BAA available on Enterprise for the Piwik PRO Analytics Suite; trial-only on Business. See Is it HIPAA compliant? All vendors for how other vendors compare on the same terms.
Which plans include a BAA
A BAA (business associate agreement) is the contract that lets a vendor handle PHI for a covered entity. Definitions for BAA and PHI are in the HIPAA glossary (BAA, PHI).
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Enterprise | Available | Through sales | From EUR 366/month billed annually (plan price) |
| Business (30-day free trial only) | Available during the trial | Downloadable BAA that you countersign | Not published by the vendor |
| Business (paid, beyond trial) | Not available | Not published by the vendor | Not published by the vendor |
What the BAA covers and what it excludes
Covered:
- Piwik PRO Analytics Suite on Enterprise: analytics, tag manager, consent manager and customer data platform.
Excluded or limited:
- The paid Business plan after the trial has no BAA.
- Business uses EU-only hosting. US HIPAA-eligible Azure hosting is an Enterprise option.
- BAA scope can be customized only on paid Enterprise. On other plans you sign the standard document.
For a clinic's marketing owner, the practical result is this: a trial BAA lets you test on the Business plan, but moving to paid Business ends the BAA. Plan the move to Enterprise before any production traffic is tied to PHI.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | EU (Germany, Netherlands, Sweden), US, Hong Kong, UAE; private cloud |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
Data residency: EU (Germany, Netherlands, Sweden), US, Hong Kong and UAE, plus a private cloud option.
"Not published by the vendor" means the evaluator should ask Piwik PRO directly. It does not mean the control is absent.
How to use Piwik PRO with PHI
Compliance depends on the signed BAA, configuration and policies, not on the vendor alone. A checklist for the customer side:
- Sign the BAA before any PHI is collected, and file the countersigned copy in your vendor inventory.
- Confirm your plan and hosting region match what the BAA covers (for US data, the Enterprise Azure option).
- Configure the tag manager so tags collect only what is needed. For example, keep appointment-type URLs, patient-portal paths and intake-form field values out of analytics events unless your privacy officer has approved them.
- Set up the consent manager to match your privacy notice and your own policies.
- Manage user access and offboarding, so a departed marketing contractor loses access the same day.
- Document analytics use in your policies and staff training.
- Re-verify scope if the plan, region or contract changes.
For general practice beyond this vendor, see the HIPAA guides.
Alternatives with a BAA
These vendors publish BAA terms. Facts only, in no particular order:
- ActiveCampaign: conditional, BAA from Enterprise.
- Constant Contact: conditional, BAA on all plans on request.
- GoHighLevel: conditional, any plan with the HIPAA Compliance add-on.
- HubSpot: conditional, Marketing Hub Enterprise. See Is HubSpot HIPAA compliant?
For a related analytics check, see Is Google Analytics HIPAA compliant? Browse more by category in HIPAA-compliant software by category.
Sources
- Piwik PRO Pricing — Pricing page, checked 2026-10-28. "Piwik PRO signs a BAA in the Enterprise plan, making it a suitable option for organizations that must comply with HIPAA."
- Piwik PRO Pricing — Pricing page, checked 2026-10-28. "Global hosting options: EU-operated servers, US HIPAA-compliant Azure, public or private cloud."
- How to make your website compliant with HIPAA | Piwik PRO help center — Help article, checked 2026-10-28. "Customizing the BAA or the scope of the offer is only possible with the paid Piwik PRO Enterprise plan."
- Piwik PRO Business plan – Piwik PRO — Vendor page, checked 2026-10-28. "HIPAA compliance ensured by customizable business associate agreement (BAA)"
- Analytics for healthcare | HIPAA-compliant marketing analytics platform – Piwik PRO — Vendor page, checked 2026-10-28. "Data encryption at rest and in transit"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-28. Future updates appear in Recent changes in vendor HIPAA status.
Does Piwik PRO sign a BAA?
Yes, on the Enterprise plan for the Piwik PRO Analytics Suite, and during the 30-day Business free trial. Enterprise starts from EUR 366/month billed annually and is arranged through sales.
Is a BAA available on the paid Business plan?
No. The Business plan has a downloadable BAA to countersign only during the free trial. After the trial, the paid Business plan has no BAA.
Can the Piwik PRO BAA be customized?
Only on paid Enterprise. Other plans use the standard document.
Can Piwik PRO host data in the US for HIPAA use?
US HIPAA-eligible Azure hosting is an Enterprise option. Business uses EU-only hosting. Piwik PRO also lists EU (Germany, Netherlands, Sweden), US, Hong Kong and UAE regions and a private cloud, but region choice does not replace a signed BAA.