Last verified: October 2026, against Squarespace's help center and terms. General information, not legal advice.
Is Squarespace HIPAA compliant? For the website itself, no: Squarespace says its form blocks can't be part of a HIPAA-compliant setup, and it signs a business associate agreement (BAA) only for Acuity Scheduling. That still leaves room for a practice to use Squarespace well, as long as patient information goes somewhere else.
Short answer: is Squarespace HIPAA compliant?
Short answer (verified October 2026): Not for website forms or pages. Squarespace's form blocks article (opens in a new tab) answers "No" and says form blocks "can't be used as part of a HIPAA-compliant solution." Its Acuity Scheduling and HIPAA (opens in a new tab) article says Acuity is the only Squarespace feature designed for HIPAA obligations, with a BAA on Acuity's Powerhouse or Premium plans. Keep protected health information (PHI) inside a HIPAA-enabled Acuity account or a separate service that signs a BAA.
Practices ask this a lot for such a narrow question: "is squarespace hipaa compliant" gets about 90 searches a month at a $70.54 cost per click, plus 10 for "squarespace hipaa" (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What Squarespace says about health data and BAAs
Three official statements settle it.
- The terms. Section 7.4 of the Squarespace Terms of Service (opens in a new tab) (effective March 27, 2025) names HIPAA and says you "will be solely responsible for such compliance." It bars using any service to handle "protected health information" unless the account is designated HIPAA-enabled and you sign a separate business associate agreement with Squarespace.
- The form block. The form blocks article (updated September 28, 2026) says submissions over SSL are encrypted, but the blocks still can't be part of a HIPAA-compliant solution. It points to Acuity Scheduling for collecting secure patient information.
- Acuity. The Acuity article (updated January 20, 2026) says the BAA doesn't cover other Squarespace features and that you shouldn't maintain or transmit PHI outside Acuity.
How the Acuity BAA works, as of October 2026:
| Question | What Squarespace says |
|---|---|
| Which plans? | HIPAA-enabling on Acuity's Powerhouse or Premium plans |
| Custom BAA? | Not on those plans; available on an Enterprise plan at extra cost |
| How to sign | In Acuity: Scheduling Page > Settings > the BAA link under Account Language |
| Scope | Each Acuity account is enabled separately, only by a BAA for that account |
| Covers form blocks or member areas? | No. Other Squarespace features aren't covered |
Squarespace's general data privacy overview (opens in a new tab) lists the Acuity article as its only HIPAA resource.
Squarespace forms, scheduling and member areas: the PHI risk
Form blocks. New submissions go to the account email by default. You can add Google Drive, Mailchimp and Zapier as extra storage. If the form has a required email field, the block keeps submissions until you delete them; without one, it keeps each submission for 30 days. Required-email submitters are also added to your Contacts panel. That's at least two or three places holding a patient's message, none covered by a BAA.
Scheduling. HIPAA-enabled Acuity changes several defaults. Email notifications stop including client form answers. Calendar sync with Office 365, Outlook.com, Exchange and iCloud is switched off, as are invoices, Reserve with Google and the Squarespace Email Campaigns integration. Users are signed out after four hours idle.
Some defaults still need your attention. Squarespace says email and text notifications may contain PHI by default, such as client names, appointment types and times, so you must edit them. Confirmation emails attach a calendar file with the client's name and appointment type, which only Squarespace support can turn off. Integrations such as Google Calendar and Stripe are yours to evaluate and contract for. For other schedulers, see scheduling tools and HIPAA.
Member areas. They sit outside the Acuity BAA like every other Squarespace feature. Don't use them for patient portals, intake documents or anything tied to someone's care.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Using Squarespace for a brochure-only practice site
Squarespace is a reasonable home for pages that publish and don't collect: services, provider bios, insurance accepted, hours, directions, a phone number and a link out to booking. Many practices keep exactly that.
To keep it brochure-only:
- Remove form blocks, or replace them with an embedded form that a BAA covers.
- Send "Book now" buttons to HIPAA-enabled Acuity or another scheduler that signs a BAA.
- Don't run a newsletter sign-up that asks about conditions or treatments.
- Check which scripts the site loads, especially on any page with a form or booking widget.
Comparing builders? See is Wix HIPAA compliant for a builder that does offer a site-wide BAA, or the full set of HIPAA checks for website builders.
Adding a HIPAA-ready form service to Squarespace
- Choose a form service that signs a BAA on the plan you'll pay for. Start with HIPAA form builders compared.
- Embed it in place of the form block, using Squarespace's code or embed options on your plan.
- Delete the old form block and its connected storage (Drive, Mailchimp, Zapier) so no copy keeps flowing.
- Set notifications to content-free alerts: "New appointment request" with no answers.
- Check the page's other scripts. Ask the form vendor whether its embed runs in its own frame or injects fields into your page.
- Export and delete old submissions that already contain health details, following your records policy.
Moving a practice site off Squarespace
If you need forms, chat or a patient area on the site itself, moving is cleaner than stacking workarounds. The domain stays yours wherever it's registered; moving the website means changing DNS records, not giving up the name.
Plan three things:
- Keep the domain and change only the records that point the website to its new host. Leave email records alone.
- Map every URL. List Squarespace's current pages and set a redirect for each one that changes, so search rankings and old links carry over.
- Export content first: text, images, blog posts and any form submissions you must retain.
Work through the website migration checklist before switching DNS.
Alternative to rebuilding it yourself: Medfy is not a do-it-yourself builder. It rebuilds your practice's website and hosts it on your own domain, with HIPAA-compliant forms. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada, and Medfy signs a BAA with your practice. You see a free preview of the rebuilt site first: start with a free audit and site preview, or read how Medfy handles patient data.
Frequently asked questions
Does Squarespace sign a BAA?
Only for Acuity Scheduling, as of October 2026. Squarespace's help center says HIPAA-enabling is available on Acuity's Powerhouse or Premium plans, where you sign its standard BAA from the Acuity settings, with custom BAAs on an Enterprise plan for an added cost. That BAA doesn't cover form blocks, member areas or any other Squarespace feature, so keep patient information inside Acuity.
Can I put a contact form on a Squarespace medical website?
Yes, if it's an embedded form from a service that signs a BAA, or if it truly can't receive patient information. Squarespace says its own form blocks can't be part of a HIPAA-compliant solution. Even a 'questions about parking or hours' form invites health details, so add a line asking visitors not to share medical information, or embed a BAA-covered form instead.
Is Acuity Scheduling HIPAA compliant?
Acuity can be part of a HIPAA-compliant setup. As of October 2026, Squarespace says HIPAA features are available on Acuity's Powerhouse or Premium plans once you sign its BAA, and they change defaults such as removing form answers from email notifications. You still need to edit notification text, review integrations like Google Calendar and Stripe, and sign any contracts those vendors require.