Search this site
HIPAA website guide

HIPAA-compliant scheduling software · vendor pages read October 19, 2026

HIPAA-compliant scheduling software: which booking tools sign a BAA, and how to put one on a practice website.

Acuity signs a business associate agreement on its Premium plan, Setmore on Pro, and Square's agreement names Square Appointments. Google Calendar appointment schedules are covered once a Google Workspace administrator accepts Google's amendment. SimplePractice's agreement starts the day the account opens, and Jane signs on request. Microsoft and Zoom sign agreements but do not name Bookings or Scheduler in what they publish about HIPAA. Calendly's terms forbid protected health information.

Every line below is quoted from the vendor's own help page, terms or pricing page as it read on October 19, 2026, with a link. The agreement covers the scheduler, not the website page it sits on, so the second half of this guide is about the booking button itself. General information, not legal advice.

See the scheduler tableHow we build practice sites
A clinic receptionist points to a date in a desk calendar while a patient leans on the front counter.
Illustrative photo · Pavel Danilyuk on Pexels (Pexels License)

Tool by tool

Which scheduling tools sign a business associate agreement, on which plan.

Seven general schedulers and two practice-management systems with built-in online booking. The third column is what each vendor itself says to watch, and it is usually where a covered scheduler still leaks.

Scheduling tools, whether each offers a business associate agreement, the plan it needs, and what the vendor says to watch
ToolAgreement offered?Plan it needsWhat the vendor says to watch
Acuity Scheduling (Squarespace)Yes. A separate BAA is signed inside each Acuity account.Premium. Acuity's pricing page lists "Sign BAA for HIPAA compliance" on Premium only ($55 a month billed annually, $69 monthly); Starter and Standard do not. Its help page also names a Powerhouse plan, which the pricing page does not show.Email and text notifications "may contain Protected Health Information (PHI) by default," and confirmation emails carry a calendar file with "the client's name, appointment type, and appointment time."
SetmoreYes, on the paid plan. The plan comparison lists "HIPAA: Signed BAA" for Pro and "No" for Free.Pro, $5 per user a month on annual billing. The Free plan has no agreement.The same comparison lists a Google Analytics (GA4) integration on both plans. Google says it does not offer BAAs for Google Analytics, so that switch stays off on any booking page a patient uses.
Square AppointmentsYes. Square's HIPAA BAA (last updated March 16, 2026) names Square Appointments.No plan named. The agreement applies "when you use Square Appointments, Invoices, or other features that have been explicitly identified as HIPAA-enabled by Square."Data patients enter through Square Buyer Services, "whether related to appointment bookings, payment information, transaction history, or user preferences," is processed by Square "as an independent controller, not as a Business Associate."
Google Calendar appointment schedulesCovered for Google Workspace customers whose administrator accepts Google's Business Associate Amendment. Google Calendar is on Google's covered-services list.A Google Workspace or Cloud Identity account with the amendment accepted by an administrator. Google's help pages describe no agreement route for a personal Google account, although appointment schedules work on one."Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services." The booking page's title "is visible to anyone who has the link."
Microsoft BookingsMicrosoft's BAA comes by default through its Data Protection Addendum, but Bookings is not named in the in-scope list. Its data sits in Exchange Online, which is.A Microsoft 365 subscription that includes Bookings: "A3, A5, E1, E3, E5, F1, F3, Business Basic, Business Standard, Business Premium, Teams Essentials, Teams Premium."Text-message reminders: "SMS messages are currently available in North America, and a Skype or Twilio account are used for SMS delivery."
Zoom SchedulerZoom signs a BAA on paid plans. Scheduler is not named in what Zoom publishes about HIPAA.Zoom's healthcare pricing page: "To enable HIPAA compliance, select a paid plan and establish a BAA agreement." The same page lists Scheduler ("Unlimited booking pages") under the Business, Business Plus and Enterprise plans, priced through sales.Zoom's HIPAA Compliance Guide lists "scheduler" among Zoom Workplace tools, and names Meetings, Team Chat, Phone and Contact Center as audited under SOC 2 + HITRUST. Scheduler is not in that list.
SimplePracticeYes, from the moment the account is created. The agreement is part of the Terms of Service.Every plan. The BAA "is made and entered into at the date and time your SimplePractice account is created." Plans listed at $49, $79 and $99 a month; the "Appointment request widget" for a website is listed on the $99 Plus plan.Starter lists "Online appointment requests"; appointment reminders start on Essential ($79). Match the plan to the booking route you actually want on the site.
JaneYes, on request. Jane's Terms of Use: "we will, upon request, enter into our standard Business Associate Agreement."Any plan; online booking is a core feature on all three ($59, $79 and $99 a month). The Balance plan is "Limited to 20 appointments / month."The agreement is not automatic: someone at the practice has to request it, and the practice should file the countersigned copy.
CalendlyNo. Calendly's Customer Terms forbid protected health information in Calendly.None. No plan on Calendly's pricing page mentions HIPAA or a BAA.Customer Terms, effective August 5, 2026: the customer warrants that "the Customer Data does not contain: (x) protected health information or information subject to Health Insurance Portability and Accountability Act ('HIPAA') compliance."

Every row was read on October 19, 2026 on the vendor's own page; the sources for each tool are linked in the cards below. Prices and plan names change, and Acuity's changed between October 13 and October 19, 2026. The vendor page is the record.

What each agreement reaches

The same nine tools, with the vendor's own words on where the agreement stops.

A signed agreement is the start. Each vendor also names what it turns off, what it leaves to the practice, and what it handles as its own business rather than yours.

A laptop screen showing a week view in a calendar app with colored appointment blocks from Tuesday to Friday.
Illustrative photo · Ahmed on Pexels (Pexels License). A synced calendar is a second copy of every booking.

Acuity Scheduling (Squarespace)

Agreement: Yes. A separate BAA is signed inside each Acuity account.

Acuity's help page, last updated September 30, 2026: "You must make each Acuity account HIPAA-enabled. An account only becomes HIPAA-enabled when a separate BAA is entered into for that specific account." Once enabled, Acuity turns off calendar syncing with Office 365, Outlook.com, Live.com, Exchange and iCloud, the Squarespace Email Campaigns integration, invoices and Reserve with Google, and logs users out after four hours of inactivity. Third-party integrations such as Google Calendar or Stripe remain the practice's call: "It's also your responsibility to enter any new contractual agreements necessary." Squarespace adds that the BAA "doesn't cover other Squarespace features."

Acuity Help Center: Acuity Scheduling and HIPAA (updated September 30, 2026) (read October 19, 2026) Acuity Scheduling pricing

Setmore

Agreement: Yes, on the paid plan. The plan comparison lists "HIPAA: Signed BAA" for Pro and "No" for Free.

Of the Setmore pages read on October 19, 2026, only the pricing page mentions HIPAA (setmore.com/health returned a 404), and there it is a plan-table row, not a help article. Ask Setmore for the agreement text before the first patient books, and keep the signed copy with the date and plan.

Setmore pricing (plan comparison, Customer management rows) (read October 19, 2026) Google Analytics Help: HIPAA and Google Analytics

Square Appointments

Agreement: Yes. Square's HIPAA BAA (last updated March 16, 2026) names Square Appointments.

Square adds that "Whether a Service supports HIPAA compliance depends on how it is configured and used" and that "Not all Services are HIPAA-enabled." In plain terms: the seller-side appointment book is inside the agreement, while what a patient does in Square's consumer-facing services is not. Ask Square in writing which booking surface your patients will use.

Square: HIPAA Business Associate Agreement (last updated March 16, 2026) (read October 19, 2026)

Google Calendar appointment schedules

Agreement: Covered for Google Workspace customers whose administrator accepts Google's Business Associate Amendment. Google Calendar is on Google's covered-services list.

Google's HIPAA services list (Workspace section last updated August 31, 2025) includes "Google Calendar" alongside Gmail, Meet and Drive. Appointment schedules are a Calendar feature: "Share a link to your booking page or embed it on your website." Google's Calendar help says creating one needs "A personal Google Account or Workspace account," and that some features need "an eligible Google Workspace or Google One subscription." Only the Workspace route comes with an agreement an administrator can accept.

Google Cloud: HIPAA compliance, Google Workspace supported services (read October 19, 2026) Google Workspace Admin Help: HIPAA compliance (updated October 13, 2026) Google Calendar Help: Learn about appointment schedules Google Calendar Help: Create an appointment schedule

Microsoft Bookings

Agreement: Microsoft's BAA comes by default through its Data Protection Addendum, but Bookings is not named in the in-scope list. Its data sits in Exchange Online, which is.

Microsoft: the HIPAA BAA "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA." The Office 365 in-scope list (page updated July 29, 2025) names Exchange Online, Microsoft Teams, Forms and SharePoint Online, and does not name Bookings. Microsoft's Bookings documentation says "All Bookings data is stored within the Microsoft 365 platform and in Exchange Online" and that each Bookings calendar "creates a corresponding mailbox in Exchange." That is a strong argument, not a listing; ask Microsoft to confirm Bookings in writing, and decide on SMS separately.

Microsoft Learn: HIPAA and HITECH, in-scope services (updated July 29, 2025) (read October 19, 2026) Microsoft Learn: Bookings overview, data and compliance Microsoft Learn: Bookings FAQ

Zoom Scheduler

Agreement: Zoom signs a BAA on paid plans. Scheduler is not named in what Zoom publishes about HIPAA.

Zoom's trust page: "Zoom helps customers enable HIPAA compliant programs by executing a Business Associate Agreement (BAA) and safeguarding protected health information (PHI)." Before Scheduler takes patient bookings, get Zoom to confirm in writing that your signed agreement covers Scheduler on your plan.

Zoom: Healthcare plans and pricing (read October 19, 2026) Zoom Trust Center: Compliance with HIPAA (links the HIPAA Compliance Guide)

SimplePractice

Agreement: Yes, from the moment the account is created. The agreement is part of the Terms of Service.

SimplePractice's pricing FAQ describes the product as "HIPAA compliant and HITRUST certified." HITRUST is a private security framework, and Microsoft's own HIPAA page notes there is "no certification standard" HHS approves for HIPAA compliance. The agreement is the part a practice can hold the vendor to, and it is published on SimplePractice's site for review before sign-up.

SimplePractice Business Associate Agreement (read October 19, 2026) SimplePractice pricing (solo practice plans)

Jane

Agreement: Yes, on request. Jane's Terms of Use: "we will, upon request, enter into our standard Business Associate Agreement."

Jane's terms: "If a Subscriber is subject to the Health Insurance Portability and Accountability Act of 1996 ('HIPAA'), we will, upon request, enter into our standard Business Associate Agreement ('BAA') with the Subscriber." Jane's pricing page lists "HIPAA Compliance" under Security & Stability on every plan, and SMS appointment reminders on Practice and Thrive.

Jane Terms of Use, Privacy Compliance (read October 19, 2026) Jane pricing

Calendly

Agreement: No. Calendly's Customer Terms forbid protected health information in Calendly.

The same section lets Calendly "immediately suspend or terminate your access to the Services" on a breach of that warranty. Calendly's security page and pricing page, read October 19, 2026, do not mention HIPAA. Calendly stays useful for meetings that carry no patient information, such as vendor or referral-partner calls; patient booking belongs on a tool that signs.

Calendly Customer Terms and Conditions (effective August 5, 2026), section 13 (read October 19, 2026)

The question asked most

Is Calendly HIPAA compliant? No, by Calendly's own terms.

Calendly's Customer Terms and Conditions, effective August 5, 2026, make the customer promise that "the Customer Data does not contain: (x) protected health information or information subject to Health Insurance Portability and Accountability Act ('HIPAA') compliance." If that promise is broken, Calendly may "immediately suspend or terminate your access to the Services." Neither Calendly's pricing page nor its security page mentions HIPAA or a business associate agreement.

So a practice that books patients through Calendly is using it against Calendly's terms, with no agreement in place, and a patient's name tied to an appointment is the kind of information the HHS tracking bulletin treats as needing one. Calendly still works for meetings that carry no patient information. For patient booking, the tools in the table above that sign are the replacement, and the switch is a website change too: every "Book now" button and embed has to point at the new tool.

Calendly Customer Terms and Conditions, section 13 (read October 19, 2026) HHS OCR: Use of Online Tracking Technologies

The website side

Six places a booking can leak around a covered scheduler.

A scheduler's agreement covers the scheduler. Everything around it on the practice site, in the patient's inbox and on the staff calendar is a separate decision. These six come from the vendors' and HHS's own pages.

  • The confirmation email and the text reminder

    Acuity says its notifications may contain PHI by default, "including client names, email addresses, appointment types, and appointment dates and times," and that removing it is the practice's job. HHS's own advice for phone messages is the same idea: leave "only its name and number and other information necessary to confirm an appointment, or ask the individual to call back." A reminder that names the specialty or the reason for the visit tells whoever sees the lock screen why the patient is going.

    Acuity: Remove PHI from email and text notifications HHS FAQ 198: leaving messages for patients

  • Trackers on the booking page

    HHS's tracking bulletin gives this exact case: a patient makes an appointment through a covered clinic's website, the site's third-party tracker sends the appointment details and IP address to its vendor, "the tracking technology vendor is a business associate, and a BAA is required." Google says it "does not offer Business Associate Agreements" for Google Analytics. An analytics or ad pixel on the page that hosts the booking widget sits outside the scheduler's agreement.

    HHS OCR: Use of Online Tracking Technologies Google Analytics Help: HIPAA and Google Analytics

  • The calendar it syncs to

    Acuity switches off syncing with Office 365, Outlook.com, Live.com, Exchange and iCloud once an account is HIPAA-enabled, because a synced calendar copies each booking into another vendor's system. A scheduler covered by one agreement that writes every appointment into a personal calendar has moved the PHI to a vendor with no agreement.

    Acuity: More protections for HIPAA-enabled accounts

  • Integrations and SMS carriers

    Acuity leaves third-party integrations such as Google Calendar or Stripe to the practice, including "any new contractual agreements necessary." Microsoft Bookings sends texts through "a Skype or Twilio account." Each of those is a separate vendor with its own answer, and the scheduler's agreement does not reach them.

    Acuity: Third-party integrations and HIPAA Microsoft Learn: Bookings FAQ (SMS)

  • The questions on the booking form

    HHS lists the "reason for seeking health care typed or selected by an individual" as information a tracker on a scheduling page can pick up. The fewer questions the public booking form asks, the less there is to leak: name, contact details, appointment type in neutral words, and the time. Clinical intake belongs after booking, on a covered form.

    HHS OCR: Use of Online Tracking Technologies

  • Patient-side accounts the vendor runs for itself

    Square processes data from its consumer services "as an independent controller, not as a Business Associate." Before choosing a tool whose patients sign in to the vendor's own app or marketplace, ask which side of that line your booking flow sits on.

    Square: HIPAA Business Associate Agreement, section 1(b)

Before you choose

Six questions, in order, before a practice picks a scheduler.

The tool is question three. The first two decide how much the tool has to protect, and the last three decide whether the website keeps it protected.

  1. 01

    Is the practice a covered entity?

    HHS: a covered entity includes "a health care provider who conducts certain billing and payment related transactions electronically." The four questions in the HIPAA-compliant website guide settle this first, and the guide covers the FTC rule for health sites that are not covered entities.

    Covered-entity question in the website guide
  2. 02

    What will the booking form ask?

    Name, phone, email, appointment type and time is a booking. Symptoms, medications and insurance numbers are intake. Decide the list before choosing the tool, because it decides how much the tool and its integrations can see.

  3. 03

    Which tool signs, on which plan, and who signs for the practice?

    Use the table above, then read the vendor's agreement for your plan. Record the date it was signed, the plan, and who signed. Acuity requires Premium (or Powerhouse) for its HIPAA services, so a plan downgrade is a compliance event.

  4. 04

    What do the confirmations and reminders say?

    Edit every template so it confirms a time and a place, not a reason. Turn off calendar-file attachments where the vendor allows it, and decide whether texts go out at all.

  5. 05

    Where else does each booking go?

    List the calendar sync, the payment processor, the video tool and the SMS carrier. Each one is a vendor with its own answer.

  6. 06

    Link or embed, and what runs on that page?

    Pick the route from the comparison above, then list every script on the page that holds the button or the embed. That list is the part of the scheduler decision that lives on the website.

    Page-type table in the website guide

HHS on the cloud vendors behind all of this: a provider that stores a practice's electronic PHI is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." Encryption is not a substitute for the agreement.

HHS: Guidance on HIPAA and cloud computing

Scheduling questions practice owners ask

Short answers, each one traceable to a vendor or HHS page above.

01

What is HIPAA-compliant scheduling software?

It is scheduling software whose vendor signs a business associate agreement with the practice and keeps patient booking data under that agreement. No software is HIPAA compliant on its own: Microsoft and Zoom both note there is no HHS-approved HIPAA certification, and the practice still sets up notifications, integrations and access. On October 19, 2026, Acuity (Premium), Setmore (Pro), Square Appointments, Google Calendar under a Google Workspace agreement, SimplePractice and Jane each published a route to a signed agreement; Calendly's terms forbid protected health information.

02

Is Calendly HIPAA compliant?

No. Calendly's Customer Terms, effective August 5, 2026, require the customer to warrant that its data does not contain protected health information or information subject to HIPAA, and let Calendly suspend or terminate access on a breach. Calendly's pricing and security pages do not mention HIPAA or a business associate agreement. It can still book meetings that carry no patient information.

03

Is Google Calendar HIPAA compliant for appointment booking?

Google Calendar is on Google's list of Workspace services covered by its Business Associate Amendment, so appointment schedules can be used for patient booking once a Google Workspace administrator accepts that amendment. Google says customers who have not signed it must not use PHI in Workspace. Appointment schedules also work on a personal Google account, and Google's help pages describe no agreement for that route.

04

Is Microsoft Bookings HIPAA compliant?

Microsoft offers its HIPAA business associate agreement by default through its Data Protection Addendum, and Bookings stores its data in Exchange Online, which is on Microsoft's in-scope list. Bookings itself is not named on that list as of October 19, 2026, and its text reminders go through a Skype or Twilio account. Ask Microsoft to confirm Bookings in writing and decide on SMS separately.

05

Is Acuity Scheduling HIPAA compliant?

Acuity signs a business associate agreement per account on its Premium plan, which its pricing page listed at $55 a month billed annually or $69 monthly on October 19, 2026. Acuity says enabling the HIPAA features alone is not enough: notifications may contain PHI by default, confirmation emails attach a calendar file with the client's name and appointment type, and third-party integrations need their own agreements.

06

Does Square Appointments sign a BAA?

Yes. Square's HIPAA Business Associate Agreement, last updated March 16, 2026, applies when a practice uses Square Appointments or other features Square identifies as HIPAA-enabled. It also says data patients provide through Square's consumer-facing Buyer Services is handled by Square as an independent controller, not as a business associate.

07

Can I embed a scheduler on my practice website?

Yes; Google Calendar and Setmore both document an embed or website widget. The scheduler's agreement covers the scheduler, not the page around it. HHS's tracking bulletin treats a third-party tracker that sees an appointment booked on a covered clinic's website as a business associate that needs an agreement, and Google offers none for Google Analytics. Put the embed on a page with no analytics or ad tags, or link out to the vendor's booking page.

08

What should an appointment reminder say?

As little as confirms the appointment. HHS's guidance on phone messages suggests leaving only the practice's name and number and the information needed to confirm an appointment, or asking the patient to call back. In a scheduler, that means editing the email and text templates to drop the appointment type, provider specialty and any form answers.

09

Do I need a BAA if my booking form only asks for a name and phone number?

If the practice is a covered entity, usually yes. A name and phone number tied to an appointment request relates to the person's future health care, and HHS's tracking bulletin uses an appointment made through a clinic's website as its example of information that requires an agreement with the vendor that receives it. HHS also says a cloud vendor that stores that data is a business associate even if the data is encrypted.

10

How much does HIPAA-compliant scheduling software cost?

On the vendor pages read October 19, 2026: Setmore Pro is $5 per user a month on annual billing; Acuity Premium is $55 a month billed annually or $69 monthly; SimplePractice plans are $49, $79 and $99 a month; Jane plans are $59, $79 and $99 a month. Zoom prices Scheduler's Business plans through sales, and Google and Microsoft depend on the Workspace or Microsoft 365 plan the practice already has. Prices change; the vendor page is the record.

Put the booking button on the site

A practice site built with the scheduler, the reminders and the script list decided together.

Choosing the scheduler is the step just before a site build or rebuild: where the booking button sits, which page holds the embed, what loads on that page, and which vendor agreements the site depends on. That inventory, the per-page script list and the release checks are on the medical and healthcare website design page. The public intake route remains intentionally unavailable while routing and operating boundaries are finalized, so nothing on this site asks for personal or medical information.

Medical & healthcare website designHIPAA-compliant website guide