Which cookie consent platforms will sign a HIPAA BAA?

ConsentStack, Cookiebot (through its parent Usercentrics), and OneTrust all state that they will sign a Business Associate Agreement. ConsentStack publishes the agreement and the price ($79 per month on the Business plan), and you accept it yourself in the dashboard. Cookiebot asks you to contact its team. OneTrust signs one when you select its HIPAA hosting environment. Osano and CookieYes publish no BAA offer, and Termly's Terms of Use state you may not use its services if your interactions are subject to HIPAA.

Do I need a BAA for a cookie consent tool?

Only if the tool receives protected health information on your behalf. A consent platform that stores pseudonymous consent records is usually not a business associate. Many healthcare teams still require a signed BAA from every vendor in the page, because HHS guidance treats online tracking technologies that receive PHI as requiring one, and because the review is easier to pass with the agreement in hand than with an argument about architecture.

Is a BAA on its own enough to make a healthcare website HIPAA compliant?

No. A BAA covers the relationship with one vendor. Your analytics, advertising, CRM, and scheduling tools each need their own arrangements, and a consent banner is not a substitute for HIPAA authorization where authorization is required. The agreement on this page covers the consent layer ConsentStack operates for you and nothing beyond it.

Does ConsentStack receive protected health information?

Not in the ordinary course of providing the service. ConsentStack stores hashed visitor identifiers, consent choices, timestamps, location at the country and state or region level, device and browser metadata, page URLs without their query strings, and banner interaction data. It stores no names, email addresses, dates of birth, medical record numbers, health plan identifiers, or any clinical, diagnostic, or treatment information. Section 2 of the agreement below states this, and section 5 commits us to a 30-day notice and an amended agreement before that could ever change.

HIPAA Business Associate Agreement (BAA)

ConsentStack signs a Business Associate Agreement (BAA) with customers on the Business plan ($79 per month). There is no enterprise contract to negotiate and no sales call to book. Put your site on the Business plan, then accept the BAA in your dashboard in the site’s HIPAA Compliance settings. You get the executed agreement as a PDF right away.

The full standard template is published below, alongside our Data Processing Agreement and Sub-Processors list, so you can review the exact terms before you commit.

One honest note on scope: this agreement covers the consent layer ConsentStack operates for you. Your analytics, CRM, and other vendors still need their own BAAs. For how healthcare and wellness teams use ConsentStack, see ConsentStack for healthcare.

Which consent platforms will sign a BAA

We are not the only consent platform that will sign a Business Associate Agreement. Two of the largest will. What none of them publish is the agreement itself or what it costs, so the only way to find out is to start a sales conversation and ask.

Every row below quotes the vendor’s own page rather than our reading of it, and links to the source so you can check it. Read this before you talk to any of us.

Platform	Will they sign a BAA?	What their own page says	Price published?
ConsentStack	Yes, published	The full agreement is on this page. It is signed on the Business plan at $79 per month, and you accept it in your dashboard, with no sales call and no enterprise contract to negotiate.	Yes, $79/mo
Cookiebot (Usercentrics)	Yes, on request	“Usercentrics is prepared to execute BAAs with covered entities. Contact our team to initiate the process.” Cookiebot, HIPAA compliance page	No
OneTrust	Yes, with the HIPAA hosting option	“OneTrust will agree to sign a business associate agreement (BAA) when the HIPAA hosting environment is selected.” OneTrust support, HIPAA hosting option	No
Osano	Not published	No BAA offer or terms published. HIPAA appears on their site only in educational articles about the law.	No
CookieYes	Not published	No BAA offer or terms published. HIPAA appears on their site only in educational articles about the law.	No
Termly	No, excluded by their terms	“The Services are not tailored to comply with industry-specific regulations (including Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management Act (FISMA), etc.), so if your interactions would be subjected to such laws, you may not use these Services.” Termly, Terms of Use section 1	No

All rows read on August 28, 2026. “Not published” means we searched that vendor’s indexed pages for HIPAA and BAA terms and found only educational articles about the law, with no offer to sign one. It does not mean they would refuse if you asked, and it is not a claim about their security or their product.

If you work at one of these companies and this is out of date, tell us at [email protected] and we will correct the row and re-date it.

Common questions

Which cookie consent platforms will sign a HIPAA BAA?: ConsentStack, Cookiebot (through its parent Usercentrics), and OneTrust all state that they will sign a Business Associate Agreement. ConsentStack publishes the agreement and the price ($79 per month on the Business plan), and you accept it yourself in the dashboard. Cookiebot asks you to contact its team. OneTrust signs one when you select its HIPAA hosting environment. Osano and CookieYes publish no BAA offer, and Termly's Terms of Use state you may not use its services if your interactions are subject to HIPAA.
Do I need a BAA for a cookie consent tool?: Only if the tool receives protected health information on your behalf. A consent platform that stores pseudonymous consent records is usually not a business associate. Many healthcare teams still require a signed BAA from every vendor in the page, because HHS guidance treats online tracking technologies that receive PHI as requiring one, and because the review is easier to pass with the agreement in hand than with an argument about architecture.
Is a BAA on its own enough to make a healthcare website HIPAA compliant?: No. A BAA covers the relationship with one vendor. Your analytics, advertising, CRM, and scheduling tools each need their own arrangements, and a consent banner is not a substitute for HIPAA authorization where authorization is required. The agreement on this page covers the consent layer ConsentStack operates for you and nothing beyond it.
Does ConsentStack receive protected health information?: Not in the ordinary course of providing the service. ConsentStack stores hashed visitor identifiers, consent choices, timestamps, location at the country and state or region level, device and browser metadata, page URLs without their query strings, and banner interaction data. It stores no names, email addresses, dates of birth, medical record numbers, health plan identifiers, or any clinical, diagnostic, or treatment information. Section 2 of the agreement below states this, and section 5 commits us to a 30-day notice and an amended agreement before that could ever change.

The agreement we sign

Last updated: October 21, 2026

This HIPAA Business Associate Agreement ("HIPAA BAA") is entered into between the legal entity named when this HIPAA BAA is accepted in the ConsentStack dashboard ("you" or "your") and ConsentStack LLC, a California limited liability company ("ConsentStack," "we," "our," or "us"), and is incorporated into the terms governing your use of ConsentStack's services (the "Agreement"). Together with the Agreement, this HIPAA BAA addresses the applicability of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and their implementing regulations at 45 C.F.R. Parts 160 and 164 (collectively, the "HIPAA Rules") to the Services.

1. Definitions

Capitalized terms not defined in this HIPAA BAA have the meanings set forth in HIPAA or the Agreement.

"Protected Health Information" or "PHI" means "protected health information" as defined in 45 C.F.R. § 160.103.

"Individual" will have the same meaning as the term "individual" in 45 C.F.R. § 160.103, and will include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g).

"Covered Site" means the site in your ConsentStack account for which this HIPAA BAA is accepted.

"Services" means ConsentStack's consent management platform, including the consent banner SDK, dashboard, and related APIs, as provided for the Covered Site.

2. Scope and Data Architecture

(a) ConsentStack's Services are purpose-built for consent management. The platform does not collect, store, or transmit PHI in the ordinary course of providing the Services. The Services store only pseudonymous consent records consisting of: hashed visitor identifiers, consent choices, timestamps, location at the country and state or region level (derived from the IP address by our infrastructure provider; the IP address itself is not stored), browser, operating system and device type (derived from the browser's user agent, which is not itself stored), the page URL stored without its query string or fragment, and banner interaction data. To detect trackers and count visitors, the Services also store the names of cookies and storage items, the addresses of third-party scripts, the addresses of the pages on which they were seen (without query strings or fragments), and hashed visitor identifiers. If you import consent from a previous consent platform, the record also keeps that platform's consent identifier as it was issued. If you turn on the option that makes location details available to your own page code, the visitor's estimated city, postal code, coordinates, and time zone are returned to the visitor's browser and are not stored. The platform does not store names, email addresses, dates of birth, medical record numbers, health plan identifiers, or any clinical, diagnostic, or treatment information.

(b) Based on this architecture, the parties acknowledge that ConsentStack does not create, receive, maintain, or transmit PHI on your behalf in the ordinary course of providing the Services. Accordingly, ConsentStack is not a Business Associate solely by reason of the Services as currently architected.

3. ConsentStack's Responsibilities

a. Safeguards

We agree to: (i) not use or further disclose data processed on your behalf other than as permitted by this HIPAA BAA, the Agreement, or as required by law; (ii) implement administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of all data processed through the Services; (iii) report to you any confirmed breach of security leading to the unauthorized access, acquisition, use, or disclosure of data processed on your behalf within seventy-two (72) hours of discovery; and (iv) require subcontractors that process data on your behalf to maintain data protection obligations no less protective than those in this HIPAA BAA.

b. Access to Records

We agree to make our internal practices, books, and records relating to the use and disclosure of data processed on your behalf available to the Secretary of the Department of Health and Human Services ("Secretary") for the purposes of determining compliance with the HIPAA Rules. Nothing in this Section will be construed as a waiver of any legal privilege or of any protections for trade secrets or confidential commercial information.

c. Data Return and Deletion

Upon termination of the Agreement, we will return or destroy all data processed on your behalf to the extent feasible. If we determine that returning or destroying the data is infeasible, we will extend the protections of this HIPAA BAA to such data and limit further uses to those purposes that make return or destruction infeasible, for as long as we maintain such data.

d. Cooperation

Upon your request, we will cooperate in responding to requests from Individuals or the Secretary that relate to data processed through the Services, to the extent we possess relevant information.

4. Your Responsibilities

a. No PHI Submission

You will not submit, upload, or otherwise transmit PHI to ConsentStack through the Services, including through dashboard fields, page URLs (for example, by placing patient information in the path of a page's address), API calls, or support communications, unless we have agreed in writing to receive such data.

b. Exported Data

This HIPAA BAA does not apply to data after it has been exported, downloaded, or otherwise extracted from the Services by you or your authorized users. Once you export data from the Services, you are solely responsible for safeguarding that data in accordance with all applicable laws, including the HIPAA Rules.

c. Use of Services with PHI

You are solely responsible for determining whether and how you use the Services in connection with PHI. ConsentStack's consent banners collect only the data elements described in Section 2(a) and are not configurable in a manner that would collect clinical, diagnostic, or treatment information.

5. Material Change in Data Architecture

If we materially change our data architecture in a manner that would result in the creation, receipt, maintenance, or transmission of PHI on your behalf, we will: (i) provide you with at least thirty (30) days' prior written notice; (ii) amend this HIPAA BAA to include the full Business Associate obligations required by 45 C.F.R. § 164.504(e); and (iii) not implement the change until the amended HIPAA BAA is in effect. If you object to such a change, you may terminate the Agreement by providing written notice within thirty (30) days of receiving the change notice.

6. Authority to Terminate for Breach

If you determine that we have violated a material term of this HIPAA BAA, you may terminate this HIPAA BAA and the Agreement in accordance with the Agreement.

7. Effect of Termination

This HIPAA BAA is effective as of the date it is accepted for the Covered Site in the ConsentStack dashboard. It remains in effect until the earliest of (i) the Covered Site no longer having a plan or add-on that includes this HIPAA BAA, (ii) deletion of the Covered Site, or (iii) termination of the Agreement. Upon termination, the obligations in Section 3(a)(iii) (breach notification) and Section 3(c) (data return and deletion) survive.

8. General

You and ConsentStack each agree to this HIPAA BAA electronically when it is accepted in the ConsentStack dashboard, and that acceptance has the same effect as a handwritten signature. The person accepting it on your behalf represents that they are authorized to bind the legal entity named at acceptance.

Any ambiguity in this HIPAA BAA will be resolved consistently with the intent to comply with the HIPAA Rules. A reference to a section of the HIPAA Rules means the section as in effect or as amended. Nothing in this HIPAA BAA confers any rights on any third party. This HIPAA BAA supersedes any pre-existing agreements between the parties relating to HIPAA. To the extent of any conflict between this HIPAA BAA and the Agreement, the terms of this HIPAA BAA will govern.