Last verified: October 22, 2026, against Square's HIPAA Business Associate Agreement and Square Support Center articles. General information, not legal advice.
Unlike Stripe and PayPal, whose public pages offered no business associate agreement (BAA) when we checked, Square publishes one, and it's built into Square's terms rather than signed separately. So is Square HIPAA compliant for a practice? The BAA covers Square Appointments, Invoices and features Square explicitly labels HIPAA-enabled. Other parts of Square aren't covered, and Square's own help center tells you to keep health records off customer profiles. People search this about 170 times a month in the US, with clicks costing advertisers around $28.99 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
Short answer from Square's own documentation
Short answer (verified October 2026): Square's HIPAA Business Associate Agreement (opens in a new tab) (last updated March 16, 2026) is "incorporated into the terms governing your use of Square's services." It "applies only to the Services and configurations where Square is acting as your Business Associate, including when you use Square Appointments, Invoices, or other features that have been explicitly identified as HIPAA-enabled by Square." It adds: "Not all Services are HIPAA-enabled, and you are responsible for evaluating whether a particular Service or configuration is appropriate for your use with PHI."
How you come to be bound: Square's help article, Comply with Square's HIPAA requirements (opens in a new tab), says that if you're a covered entity or business associate and your use of Square has it handle "Protected Health Information (PHI) on your behalf, then you agree to the HIPAA Business Associate Agreement." It also says "Square sellers are responsible for determining whether they are subject to HIPAA requirements."
The BAA carves out Square's consumer-facing "Square Buyer Services," such as Square Go and Square Pay. Square handles data from those "as an independent controller, not as a Business Associate."
What HIPAA requires before patient information goes in
For a vendor to "create, receive, maintain, or transmit protected health information" for your practice, HIPAA requires documented "satisfactory assurance" (45 CFR 164.502(e) (opens in a new tab)) in a written contract that meets 45 CFR 164.504(e) (opens in a new tab). Our guide to business associate agreements explains what that contract must include. Square's BAA is that contract for its covered features. Your setup and staff habits are still on you; the BAA itself requires you to use "appropriate safeguards."
How section 1179 fits, in Square's own words
Square's BAA defines PHI to exclude "any information exempt from HIPAA under Section 1179 of the Social Security Act, 42 U.S.C. § 1320d-8." Section 1179, added by HIPAA in 1996, says HIPAA's administrative simplification rules "shall not apply" to an entity "to the extent" it is doing a financial institution's work or "authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments, for a financial institution" (42 U.S.C. 1320d-8 (opens in a new tab)).
Read together: running a patient's card is the payment processing section 1179 describes, which is why Square's BAA leaves exempt information out of its PHI definition. Booking a patient into "post-op wound check" and storing notes about them is not payment processing. That's why Appointments sits under the BAA.
Section 1179 also doesn't cover your practice's side. You remain a covered entity, and what you send with a payment is subject to the minimum necessary standard in 45 CFR 164.502(b) (opens in a new tab).
If your website sends patients to Square booking or payment pages, check the website too: the free marketing audit flags privacy risks such as ad pixels on patient forms.
Which Square plans a BAA can cover
Square's BAA is scoped by feature, not by subscription. It names no plan, and it applies through the general terms, so Square Appointments' entry tier and its paid tiers on the pricing page (opens in a new tab) aren't treated differently in the BAA text.
| Square feature | Under the BAA? | Source |
|---|---|---|
| Square Appointments | Yes, named | BAA |
| Invoices | Yes, named | BAA |
| Other features Square has "explicitly identified as HIPAA-enabled" | Yes | BAA (we found no public list) |
| Card payment processing | Exempt information is outside the BAA's PHI definition | BAA, section 1179 |
| Square Buyer Services (Square Go, Square Profile, Square Pay, Square Local Offers) | No | BAA |
| Files attached to customer profiles | Square says don't upload personal health information | Help center |
If you plan to use a feature not on this list for patient work, ask Square in writing whether it's HIPAA-enabled.
Square Appointments and client notes
Appointments gives you several places to type, and Square's help pages don't say much about who sees each one. The scheduling article (opens in a new tab) mentions "Appointments notes" in the Dashboard, an "internal note for your staff" in the point-of-sale app, and a separate "optional message to your client" when notifying them. It doesn't say whether notes appear in client notifications.
Customer profiles are stricter. Square's file attachments article (opens in a new tab) says: "Do not upload files containing illegal content or sensitive confidential information, including personal health information or payment card information." Access to notes and files follows the "customers permission" you assign in the Dashboard.
Working rules for a practice:
- Name services the way you'd want them read aloud in a waiting room: "New patient visit," not "STI testing."
- Keep clinical notes in the EHR. Use Appointments notes for logistics such as "needs wheelchair access" or "interpreter: Spanish."
- Never attach intake forms, lab results or referrals to a customer profile.
- Grant the customers permission only to staff who book or check in patients.
- Before relying on the client message field, send a test booking to a staff email and read exactly what arrives.
Safe uses and unsafe uses for a practice
Safe: card payments with neutral item names; Invoices for balances, with generic line items; Appointments bookings with logistics-only notes and limited staff permissions.
Risky without checking: any Square feature not named in the BAA or labeled HIPAA-enabled by Square; client messages that might repeat service names; contracts sent at booking.
Unsafe: uploading health records to customer profiles; clinical notes in appointment or customer notes; service names that reveal a diagnosis on confirmations.
Safer setup or alternatives
If Square already runs your front desk, the steps above get you most of the way. If you're choosing now, compare Square against the scheduling and payments built into your EHR, which avoids keeping a second patient list. For payments only, read our Stripe verdict; for booking links, see our Calendly verdict. The HIPAA and marketing software hub lists every tool we've checked.
Medfy doesn't sell Square or provide scheduling software; its analytics count clicks on your own booking link. For what patients type into your website, Medfy's HIPAA-compliant forms and chat use separate, encrypted HIPAA databases in the US or Canada, and Medfy signs a BAA with each practice for its own services. See how Medfy handles patient data.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Will Square sign a BAA?
Yes, without a separate signature. Square's HIPAA Business Associate Agreement, last updated March 16, 2026, is incorporated into the terms for Square's services, and Square's help center says a covered entity agrees to it when its use of Square causes Square to handle PHI on its behalf. It covers Square Appointments, Invoices and other features Square has explicitly identified as HIPAA-enabled.
Is the free version of Square HIPAA compliant?
Square's BAA doesn't name a plan. It's part of the terms governing Square's services and is scoped by feature: Appointments, Invoices and other features Square explicitly calls HIPAA-enabled. So the question is which feature you use, not what you pay. Even under the BAA, Square tells sellers not to upload personal health information as files on customer profiles. Verified October 2026.
Can a practice use Square without patient information?
Mostly, yes. Card payments for visits are the kind of activity HIPAA's payment-processing exception describes, and Square's BAA excludes that exempt information from its definition of PHI. Use neutral item names, keep clinical notes in your EHR, and don't attach records to customer profiles. A booking calendar for a medical practice, though, will usually hold some patient information.
What is a HIPAA-compliant alternative to Square?
If your EHR or practice management system includes scheduling and payments, using it keeps both under a BAA you already have and avoids duplicate patient records. For card payments only, Stripe is a common choice; check what each processor says about BAAs and what details its features store. For online booking, compare scheduling tools on the BAA for your plan.