Last verified: October 2026, against Calendly's and Squarespace's own terms and pages. General information, not legal advice — confirm with your compliance officer or attorney.
Is Calendly HIPAA compliant? Not for patient appointments. Calendly's customer terms make you promise your data contains no protected health information (PHI), and none of its security or help pages mention a business associate agreement (BAA). Acuity Scheduling, the Squarespace scheduler many practices use instead, takes the opposite approach: its Premium plan includes a signed BAA. The details below show where each stands and what to do with the booking link already on your website.
Short answer for Calendly and Acuity Scheduling
Short answer (verified October 2026): Calendly is not covered for patient bookings. Its Customer Terms (opens in a new tab) (effective August 5, 2026) have you warrant that your data "does not contain: (x) protected health information" or information subject to HIPAA. Its security page (opens in a new tab) lists SOC 2, SOC 3, CSA STAR, PCI and ISO/IEC 27001, with no HIPAA program or BAA.
Short answer (verified October 2026): Acuity Scheduling can be covered on Premium. Acuity's pricing page (opens in a new tab) lists "Sign BAA for HIPAA compliance" on Premium only. Squarespace's Terms of Service (opens in a new tab), which cover acuityscheduling.com, allow PHI only when "your Account for such Services is designated as HIPAA-enabled" and you "enter into a separate business associate agreement with Squarespace."
Why a booking link creates PHI
PHI is health information that identifies a person. A booking at a named practice usually carries four pieces: a name, a time, the type of practice and often a reason. Together they show that a specific person is seeking care from you, which is health information. A booking with a fertility clinic or a therapist reveals more than a booking with a dentist, but all of them count. See what counts as PHI for the details.
The booking also doesn't stay in the scheduler:
- Calendar sync copies the event, often with the patient's answers, into Google or Outlook calendars. Google covers Calendar under its BAA only when your Workspace admin has accepted it; see Google Workspace and HIPAA.
- Confirmation and reminder emails pass through the scheduler's email system and land in inboxes.
- Automations forward bookings to sheets, CRMs and chat channels. Each hop needs coverage; see Zapier and PHI.
Calendly: plans, terms and what's covered
Calendly's customer warranty sits in Section 13 of its terms and applies whether you sign up as an individual or for a company. We found no plan-level exception in that section. Calendly's platform security article (opens in a new tab) (updated September 25, 2026) adds that Calendly "is not intended to be used by users to collect sensitive personal information."
Its security and compliance help section (opens in a new tab) covers SOC 2, ISO/IEC 27001, GDPR and CCPA. None of those is a substitute for a BAA.
What Calendly is still good for at a practice: meetings that aren't with patients. Vendor demos, job interviews, staff one-to-ones and calls with referral partners don't involve PHI.
Acuity Scheduling: plans, BAA and settings
| Acuity plan | BAA available? |
|---|---|
| Starter | No |
| Standard | No |
| Premium | Yes: "Enable HIPAA compliance with a signed Business Associate Agreement (BAA)" |
Squarespace's terms also note that end-user data "includes data submitted via form blocks, client booking intake forms and similar features," so intake questions inside Acuity are part of what the BAA must cover.
What we couldn't confirm: Acuity's help center blocked our requests, so we couldn't read which notifications, integrations or features change once an account is HIPAA-enabled. Before you rely on it, ask Acuity to confirm in writing how the BAA is signed, which features are restricted, and whether your connected calendar and email tools are covered.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Booking questions to remove from any non-covered tool
If an uncovered scheduler is live for patients today, strip it down while you move. Remove:
- Reason for visit, or event types named after a treatment ("Botox consult")
- Symptoms, or "anything we should know?" free-text boxes
- Insurance member ID and group number
- Date of birth
- Referring provider, medications or allergies
- File uploads such as referral letters or photos
Keep name, phone or email, and the time. That reduces what's exposed. It doesn't make patient bookings in an uncovered tool compliant, because the booking itself still identifies someone seeking care.
Safer setups: request forms, EHR scheduling, minimal fields
- Book inside your EHR or practice-management system if it offers online scheduling under the BAA you already have.
- Use a request form. The patient asks for a time, and staff confirm by phone or secure message. Our appointment request form guide shows the fields.
- Use a covered scheduler such as Acuity Premium with the BAA signed, and keep its questions minimal.
Weighing self-booking against request forms is covered in online booking for doctors.
Medfy does not provide online booking software. Its HIPAA-compliant website forms send appointment requests into the patient CRM and inbox, under the BAA Medfy signs with your practice, and its analytics count clicks to your own booking tool. Read how Medfy handles patient data, check your current booking pages with a free marketing audit, or compare other vendors in HIPAA-compliant software.
Frequently asked questions
Will Calendly sign a BAA?
We found no BAA offer on Calendly's security, help or legal pages in October 2026. Its Customer Terms go the other way: customers warrant that their data contains no protected health information or HIPAA-regulated information. If a Calendly sales rep offers a BAA, get it in writing along with an amendment to that warranty, and have your compliance officer or attorney review both.
Is Acuity Scheduling HIPAA compliant?
Acuity can be used with patient data on its Premium plan, which lists 'Sign BAA for HIPAA compliance.' Squarespace's terms allow protected health information only in an account designated as HIPAA-enabled, with a separate BAA signed. Starter and Standard plans don't include the BAA. Confirm the settings that change once HIPAA is enabled with Acuity, and review the setup with your compliance officer or attorney.
Is it a HIPAA violation to use Calendly for patient appointments?
It creates a real risk. A patient booking at your practice is protected health information, and Calendly's terms say your data must not contain it, so there's no BAA covering the disclosure. Whether a specific use is a reportable violation depends on the facts. Move patient bookings to a covered tool and ask your compliance officer or attorney about anything already collected.
What booking information is safe to collect without a BAA?
For patient appointments, strictly none: a name and a time at a medical practice can identify someone seeking care. Uncovered schedulers fit meetings that aren't with patients, such as vendor demos, interviews or referral-partner calls. If one is already live for patients, strip it to name, contact and time while you switch, and confirm the plan with your compliance officer or attorney.