HIPAA-Compliant Scheduling: Acuity, Calendars and Booking Software Checked

A scheduling tool or calendar can hold patient information only when two things are true. First, the vendor has signed a Business Associate Agreement (BAA) that covers the plan and features you use. Second, you have set the tool up correctly. Acuity Scheduling, Google Calendar and Outlook can meet that test on specific paid plans with a signed BAA. Personal calendars and most free tiers cannot. The sections below check each tool, show where each BAA stops, and mark every vendor fact for verification against an official source.

Quick answer: is Acuity Scheduling HIPAA compliant?

Acuity Scheduling, which Squarespace owns and also offers under the Squarespace Scheduling name, can be used with PHI only if your plan includes its HIPAA features and a signed BAA. Confirm which plan qualifies on Acuity's official help pages. Without that plan and BAA, do not enter patient information.

To use Acuity with PHI, you typically need to:

• Be on a qualifying plan. Check Acuity's current plan page for which tier includes HIPAA features.
• Turn on HIPAA features in the account, as Acuity's help pages describe.
• Execute the BAA through the process Acuity specifies, and keep a signed copy.

Turning on HIPAA mode can change how parts of the product work, in areas such as reminder content, intake form fields, integrations and payment options. Check Acuity's current list of affected features before you switch. If the front desk relies on a disabled integration, find that out before go-live, not after.

Squarespace website plans are a separate product with separate terms. If your booking page sits on a Squarespace site, also read Squarespace and HIPAA.

Even with the BAA signed, compliance depends on your practice. That includes what staff type into appointment notes, who has access, and which services the scheduler connects to.

What makes a scheduling or calendar tool usable with PHI

Why appointment details are PHI

An appointment record links a person to a healthcare event. A patient's name plus an appointment date, provider or appointment type is individually identifiable health information when a covered entity holds it (45 CFR 160.103).

Here is a simple example. "J. Rivera, Tue 9:30, Dr. Chen, suboxone intake" tells anyone reading it something sensitive. Even "J. Rivera, Tue 9:30" can reveal health information when the calendar belongs to a single-specialty fertility clinic.

The BAA test

A vendor that creates, receives, stores or transmits PHI for you is a business associate. You need a signed BAA with that vendor before PHI goes in (45 CFR 164.502(e) and 164.504(e)). The BAA has to cover the specific product, plan and features you use. A BAA for a vendor's enterprise tier does not cover a staff member's free account with the same vendor.

Technical safeguards to look for

The Security Rule sets technical safeguards (45 CFR 164.312). In a scheduler, those safeguards show up as:

• Unique user logins with role-based permissions. For example, front desk staff see the schedule while billing sees only what it needs.
• Audit logs that show who created, viewed, changed or cancelled appointments.
• Encryption in transit and at rest.
• Automatic logoff and two-factor authentication.

Where data leaks in practice

Most scheduling exposures happen at the edges of the tool, not in its core:

• Reminders. Reminder texts and emails that include the appointment type, sent to a shared family phone or work inbox.
• Calendar invites. Invites forwarded or synced to staff members' personal accounts.
• Integrations. Connections that copy bookings into spreadsheets, CRMs or automation tools that have no BAA.
• Payments. Embedded payment forms that pass the service name to a processor.

Popular scheduling and calendar tools checked

Vendor terms change, so confirm every row against the vendor's official HIPAA or BAA page before you rely on it. The source column names where to check, and you should note the date you checked.

Tool	BAA available	Minimum plan	Price note	Key limits under HIPAA	Source, date checked
Acuity Scheduling / Squarespace Scheduling	Confirm on Acuity's HIPAA help page	Confirm current qualifying plan	See vendor pricing	Check which reminder, intake form, integration and payment features change in HIPAA mode	Acuity's official HIPAA help page
Calendly	Confirm current position with Calendly	Confirm with vendor	See vendor pricing	Confirm covered features and excluded integrations before any patient use	Calendly's official HIPAA or security page
Google Calendar (Google Workspace)	Yes, under Google's Workspace BAA, when Calendar is listed as a covered service	Qualifying Workspace editions; confirm current list	See vendor pricing	Check whether Appointment schedules and add-ons are in scope; consumer accounts are not covered	Google Workspace HIPAA/BAA page
Outlook calendar (Microsoft 365)	Yes, under Microsoft's BAA for eligible business plans	Confirm qualifying plans	See vendor pricing	Check whether Bookings and third-party add-ins are in scope	Microsoft HIPAA/BAA documentation
Healthcare-specific schedulers	Varies by vendor	Varies by vendor	See vendor pricing	Confirm BAA scope and audit log availability per vendor	Each vendor's official HIPAA page
Personal Google Calendar	No BAA	Not applicable	Free	Do not use with PHI	Google consumer account terms
iCloud Calendar	No BAA	Not applicable	Free	Do not use with PHI	Apple consumer terms

Some notes on reading the table:

• Acuity / Squarespace Scheduling. Confirm that the BAA covers the product your account actually runs on.
• Calendly. Check Calendly's current official statement on HIPAA and BAAs, not a third-party blog.
• Google and Microsoft calendars. Coverage depends on the business edition and on how an admin configures it. See the next section.
• Healthcare-specific schedulers. Practice management tools used by therapists and outpatient clinics often bundle scheduling with intake and billing. List a vendor here only after confirming its BAA terms in writing.

For other categories, see more popular tools checked for HIPAA.

HIPAA-compliant calendars for staff and providers

A patient booking tool and an internal staff calendar are different systems. Both often hold PHI. A provider's Outlook calendar showing "New pt eval, M. Okafor" is PHI just as much as the Acuity booking that created it.

Google Workspace and Microsoft 365 calendars

Business editions of both suites can be used under their BAAs. The details are in Google Calendar and the Workspace BAA and Outlook calendar under Microsoft 365. After the BAA is in place, an admin should check:

• External sharing defaults. Can calendars be shared outside your domain, and with how much detail?
• External invites. Do event titles and descriptions go to outside guests?
• Event detail visibility. Can coworkers see full details, or only free/busy?
• Add-ons and Marketplace apps connected to calendars. Each one is a separate vendor.

Minimal-detail entries for private practice therapy

Many therapists and small practices adopt a written policy for calendar titles, for example:

• Use initials or a client code, never a full name.
• Leave out diagnosis, service type and session notes.
• Keep clinical details in the EHR, not the calendar.

This reduces exposure if a screen is visible or a calendar is shared by mistake. It does not remove the need for a BAA. See the FAQ below.

Check your sync targets

A covered scheduler that syncs to an uncovered calendar breaks the chain. A common case is a provider who connects Acuity or the practice EHR to a personal iCloud or Gmail calendar so appointments show on their phone. Ask every provider which calendars their work schedule syncs to, and remove personal targets.

Free HIPAA-compliant scheduling software: what to know

Free tiers of scheduling tools often do not include a BAA. Before using any free plan with patient data, confirm in the vendor's own terms that a BAA covers that exact plan.

Free tiers also tend to hide costs once you need HIPAA features:

• Per-provider or per-calendar pricing that grows with each new clinician.
• SMS reminder charges billed per message or as an add-on.
• HIPAA add-ons priced separately from the base plan.
• Payment processing. Collecting deposits or no-show fees at booking adds another vendor to check. See payment tools and HIPAA.

The rule of thumb is simple. No signed BAA means no PHI, whatever the price. A free tool used only for non-patient bookings, such as internal staff meetings or vendor demos, is a different matter. Make sure staff know which tool is for which purpose.

Checklist: evaluating any HIPAA scheduling tool

Use these questions for any booking tool, calendar or scheduling feature inside a larger product.

BAA and scope

• Will the vendor sign a BAA?
• On which plan?
• Which features does it cover, specifically reminders, intake forms, payments, integrations and AI features?
• Get the answer in writing.

Audit trail

• Can you see who viewed, created, changed or cancelled an appointment, and when?

Reminder controls

• Can you edit email and SMS templates to remove appointment type, provider specialty and location details?
• Do you record patient preferences and consent for text reminders?

Integrations and AI scheduling assistants

• List every connected service: calendars, video, payments, automation, AI booking assistants.
• Confirm that each one is covered by its own BAA, or by the scheduler vendor's BAA if the vendor states that explicitly.
• Video visit links are a frequent gap. See video visit tools and HIPAA.

Access management

• Are there role-based permissions, 2FA and SSO?
• Can you remove a departing front desk employee's access the same day?
• Are shared logins prohibited?

Setting up online scheduling safely in your practice

1. Sign the BAA before entering real patient data. Save a copy in your vendor inventory with the plan name and date signed.

2. Configure before launch. Strip PHI from reminder templates, limit intake form fields to what scheduling needs, and set staff roles so each person sees only what their job requires.

3. Run a test booking end to end. Use a fake patient and follow it through:

   • The booking confirmation email
   • The 24-hour reminder text
   • The calendar event on the provider's phone
   • Any integration that receives it

   Check what each one shows.

4. Write a one-page staff policy. Cover what goes in appointment titles, what goes in notes (usually nothing clinical), what reminders may say, and which calendars may sync.

5. Review quarterly. Check user access, connected integrations and reminder templates. Record changes in your security risk analysis (45 CFR 164.308(a)(1)(ii)(A)).

Coordinating schedule changes across your team

The scheduling tool handles bookings. Staff still coordinate around them all day:

• A same-day cancellation that opens a slot for a waitlisted patient
• A provider calling out sick and the front desk reshuffling three rooms
• A reminder that a no-show needs a follow-up call before noon

In many practices, that coordination happens in personal texts and group chats. Those messages often name patients and are not covered by any BAA.

Chanty is internal team chat for staff. Front desk, clinic managers and providers can discuss schedule changes in a shared channel and turn a message like "call back Tuesday's no-show" into a task with an owner and a deadline. A signed BAA is available from the Business plan. Chanty does not book appointments, send reminders or message patients. It runs alongside your scheduling system. See HIPAA-compliant chat for staff.

FAQ

Is Acuity Scheduling HIPAA compliant?

Acuity can be used with PHI only if your plan includes its HIPAA features, those features are turned on and a BAA is executed. Confirm the qualifying plan and BAA process on Acuity's official help page. No tool is compliant by itself. Your configuration, access controls and staff practices also count.

Does Acuity Scheduling sign a BAA, and on which plan?

Check Acuity's official help page for whether a BAA is offered, which plan qualifies and how it is executed, and note the date you checked. Do not enter PHI on any plan without a BAA.

Is Squarespace Scheduling the same as Acuity for HIPAA purposes?

Confirm that your Squarespace Scheduling account falls under the same HIPAA terms, plan and BAA as Acuity before relying on either name. Squarespace website plans are separate, and a scheduling BAA does not automatically cover your website or forms.

Is Calendly HIPAA compliant?

Check Calendly's current official statement on HIPAA and BAAs before using it with patient information. If Calendly does not sign a BAA for your plan, do not use it for patient bookings.

Is Google Calendar HIPAA compliant?

Google Calendar can be used with PHI under Google Workspace when it is listed in Google's BAA covered services, you use a qualifying edition and the BAA is accepted. Personal Google accounts are not covered.

Is there free HIPAA-compliant scheduling software?

A BAA on a vendor's paid tier does not necessarily extend to its free tier, so check the terms for the exact plan you would use. Without a signed BAA, a free tool should not hold patient information.

Are appointment reminders by text or email allowed under HIPAA?

Reminders are generally permitted. Keep content minimal and respect patient preferences about how they are contacted. Leave appointment type and specialty out of reminder text.

Do I need a BAA for a calendar that only shows patient initials?

Usually, yes. Initials combined with dates, times and a provider's name can still identify a patient, especially in a small practice (see HIPAA's de-identification standard, 45 CFR 164.514). Minimal-detail entries reduce risk but do not replace a BAA. Confirm with your privacy officer.

Are AI scheduling assistants HIPAA compliant?

Only if the vendor states in writing that the AI feature is covered by its BAA. Many AI booking features send data to separate model providers. Treat each AI assistant as its own vendor to verify.

Does a scheduling tool need an audit trail for HIPAA?

The Security Rule requires audit controls that record and examine activity in systems containing ePHI (45 CFR 164.312(b)). In practice, look for a log showing who viewed, created, changed or cancelled appointments, and ask each vendor whether your plan includes one.