Online appointment booking for doctors comes in three forms: a request form your staff confirm, real-time scheduling from your own calendar, and booking through a marketplace. Each puts patient information somewhere, so each raises the same HIPAA question: who holds the data, and have they signed a Business Associate Agreement (BAA)? This explainer separates the options, shows where booking belongs on your site and Google listing, and covers what Canadian clinics should check.
In short: Start with what your schedule can safely handle. A HIPAA-compliant appointment request form works for nearly every practice. Real-time booking suits simple, predictable visit types and needs a vendor that signs a BAA and connects reliably to your practice management system. Marketplaces can bring new patients, but they share the relationship and hold the data.
Demand is steady on both sides of the border: "online appointment booking for doctors" draws 590 searches a month in the US and 720 in Canada (CPC $11.30), and "online scheduling for doctors" 50 (Google Ads Keyword Planner data via DataForSEO, 12-month average to Sep 2026).
A note on our role: Medfy does not provide scheduling software. Medfy builds the practice's website with HIPAA-compliant appointment request forms, and its first-party analytics counts calls, forms, bookings and directions, including clicks through to the booking tool you already use.
Appointment requests vs real-time online scheduling
| Item | Appointment request form | Real-time online scheduling |
|---|---|---|
| What the patient does | Picks a service and preferred times, then waits for a call or message | Picks an open slot and gets an instant confirmation |
| Who controls the calendar | Your staff | Rules you set in the scheduling tool |
| Best for | Visits needing triage, referrals or insurance checks | Routine visit types with fixed lengths |
| Main risk | Slow follow-up loses the patient | Wrong visit type or double booking if rules are loose |
Many practices use both: real-time booking for cleanings, follow-ups or annual physicals, and a request form for new consults. Our appointment request form template lists the fields to include and the ones to leave out.
How booking tools connect to your practice management system
Your practice management (PM) system or EHR (electronic health record) holds the real schedule. A booking tool connects to it in one of three ways:
- Two-way sync. The tool reads open slots and writes new appointments directly into the PM system. Least staff work, but it depends on a maintained integration.
- One-way or partial. The tool reads availability, but staff copy confirmed bookings into the PM system. Workable if volume is low.
- No connection. The tool keeps its own calendar. Staff block time in two places, and double bookings follow.
Ask any vendor which of these it offers for your specific PM system and version, who fixes it when it breaks, and how quickly cancellations sync back.
Marketplace booking vs booking on your own website
Marketplaces list many practices and let patients book across them. Booking on your own site keeps patients with you.
| Item | Marketplace | Your own website |
|---|---|---|
| New-patient reach | Patients who browse the marketplace | Patients who find your site through search, your Google listing and referrals |
| Who owns the patient relationship | Shared with the marketplace | Your practice |
| Data | Stored by the marketplace under its terms and your agreement | Stored by your chosen vendor under your BAA |
| Cost model | Varies by marketplace | Your scheduler's subscription |
A marketplace can make sense for a new practice filling a schedule. Read the data terms closely. Ontario's privacy commissioner, for example, advises clinics not to use service providers that require patients to accept terms allowing their information to be used for purposes unrelated to the clinic's care (IPC guidance, 2021 (opens in a new tab)). Comparing options? See our roundup of Zocdoc alternatives for practices.
HIPAA questions to ask any scheduling vendor
A scheduling vendor that creates, receives, stores or transmits patient information for you is a business associate. Under 45 CFR 164.502(e) (opens in a new tab), you need its written assurances, the BAA. Then ask:
- Will you sign a BAA for the plan we'd use? Get it signed before the first patient books.
- What do reminders contain? Texts and emails should confirm a time, not a diagnosis or visit reason.
- Can we limit intake fields? Collect the minimum at booking; gather clinical details later in a secure system.
- Who on our team can see bookings? Look for role-based access and an audit log.
- Are there ad or analytics pixels on the booking pages? There shouldn't be.
- Where is the data stored, and what happens to it if we leave?
Vendor terms change, so check each one on its official site. For one popular tool, see our dated check: is Calendly HIPAA compliant.
Canadian clinics: where scheduling data is stored
Canadian clinics answer to PIPEDA (the federal private-sector privacy law) or a provincial law. The Office of the Privacy Commissioner notes that Ontario, New Brunswick, Newfoundland and Labrador and Nova Scotia have health privacy laws (opens in a new tab) declared substantially similar to PIPEDA for health information. In Ontario that law is PHIPA (the Personal Health Information Protection Act).
Two points matter for a scheduler. Under the OPC's cross-border processing guidelines (opens in a new tab), your clinic stays accountable for information a vendor processes, must use contracts to get comparable protection, and should tell patients if their information may be processed outside Canada. Under PHIPA, a clinic remains responsible for what its agents do with personal health information, per the IPC guidance cited above. Ask where data is hosted and put the answer in your privacy notice. Our guide to marketing a clinic in Canada covers the wider rules.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Measuring online bookings by marketing channel
Count bookings by where the patient came from: Google search, your Google listing, ads, AI assistants or referrals. Three practical steps:
- Track the booking-button click on your site, without sending patient details to any ad platform.
- Compare with completed bookings in your scheduler each week.
- Check your listing's numbers. Our guide to Google Business Profile insights shows where to find calls, website clicks and booking clicks.
Medfy's first-party analytics counts calls, forms, bookings and directions by source, so you can see which channels send patients to your booking tool. To see how your site handles booking today, run a free marketing audit; it checks online booking and the trust signals patients look for. The medical website design guide covers the rest of the site.
Frequently asked questions
Should my practice offer online booking?
Most practices benefit from at least an online appointment request, because patients look for one outside office hours. Real-time self-scheduling suits practices with predictable visit types and a scheduling system that can publish open slots safely. If your visits need triage, insurance checks or referrals first, start with a request form your staff follow up on, then add real-time booking for simple visit types.
Is online appointment scheduling HIPAA compliant?
A scheduling tool isn't compliant or non-compliant on its own. It holds patient information, so the vendor must sign a Business Associate Agreement for the plan you use, and you must configure it sensibly: minimum fields, access limited to staff who need it, and reminder messages without clinical details. Check each vendor's current BAA terms on its official site before any patient books through it.
What is the difference between appointment requests and real-time booking?
An appointment request is a form: the patient asks for a time and your staff confirm by phone or message. Real-time booking shows open slots from your schedule and lets the patient pick one, confirmed instantly. Requests give your team control over triage and insurance checks; real-time booking is faster for patients but depends on accurate schedule rules and a working connection to your system.