Not every tool on a HIPAA compliant scheduling software shortlist signs a BAA, and Acuity's own guide says its HIPAA features alone aren't enough. A booking tool fits a practice only when its vendor signs a business associate agreement (BAA, a contract to protect patient data) for your plan. After that, your setup decides whether reminders, calendar sync and ad tags carry patient details elsewhere.
Is Calendly HIPAA compliant? By its own pages, no. Its customer terms have you warrant that your data holds no protected health information, and its community manager wrote in July 2026 that it does not currently offer a BAA.
Quick answer
- Ask each vendor for the BAA itself, and price the plan that carries it.
- By their own pages: Calendly, no BAA; Acuity, a BAA on Premium; Square, Zoho and Google, a BAA with limits; SimplyBook.me, a BAA named only on its security page; Microsoft Bookings, unclear.
- List what the HIPAA setting switches off before you promise patients a feature.
- Leave symptoms and diagnoses out of booking questions unless the vendor covers those fields.
- Book a test visit yourself and read the email, the calendar entry and the page address.
Seven tools, as their own pages describe them
The order is arbitrary. Each row comes from the vendor's own pages. Where a page is silent, the cell says so.
| Tool | BAA? | Plan and listed price | Catch |
|---|---|---|---|
| Calendly | No, its staff say | No plan lists one | Terms ask you to warrant no PHI in your data |
| Acuity | Yes | Premium, $55 a month billed annually, $69 monthly | HIPAA mode ends Outlook and iCloud sync; more in my Acuity guide |
| SimplyBook.me | Its security page lists concluding a BAA among its HIPAA duties; its HIPAA help page doesn't mention one | HIPAA feature on Standard and up; the pricing page shows the price in your region | Locks out its own support staff; no Zapier or API |
| Square Appointments | Yes, in Square's BAA | BAA page names no plan or price | Square Buyer Services, such as Square Go, sit outside it |
| Zoho Bookings | Template from Zoho's legal team | Premium plan | Only fields you mark are protected |
| Google Calendar | Yes, accepted in the Admin console | Workspace accounts; Calendar is on Google's list | Appointment schedules not named; add-ons and third-party apps excluded |
| Microsoft Bookings | BAA for Microsoft's listed services | Comes with Microsoft's data protection terms | Bookings is not named in the service list |
Square's agreement applies when you use Square Appointments, Invoices or other features Square marks as HIPAA-enabled. It adds that "Not all Services are HIPAA-enabled" and leaves the fit to you, and it does not name text messages, so ask about reminders.
Jane and SimplePractice are not in the table; ask them the questions at the end.
In Canada, where PIPEDA applies, a practice stays responsible for personal information it sends a vendor for processing. For a vendor outside Canada, the privacy commissioner expects comparable protection through contractual or other means, so a US BAA is not the test there.
Fields the setting does not protect
A reason-for-visit field you mark is protected, unless it is a multi-line box; name, email and phone are not. Ask any vendor which fields its HIPAA setting covers, as well as whether it signs a BAA.
Four leaks a BAA does not stop
- Calendar sync. Google's page says third-party applications, including add-ons, are not covered by its BAA. A booking tool that writes visits into an uncovered calendar sends patient details somewhere the BAA does not reach.
- Reminders. Acuity's guide says its email and text notifications may contain PHI by default, including client names, appointment types and times. The rules for what a text may carry are in HIPAA text messaging.
- Intake questions. A reason-for-visit box puts health details into the booking itself. I have built Calendly event types, and their custom questions are where such a box gets added.
- Ad tags. A Google Ads or Meta tag on the booking or confirmation page can pass appointment details to the ad platform, which your booking vendor's BAA does not cover.
HHS's tracking bulletin says a tag on a no-login scheduling page may collect an email address or a reason for seeking care that a visitor types or selects. It treats a tracking vendor that receives PHI on a practice's behalf as a business associate, which needs a BAA.
In AHA v. Becerra (N.D. Tex., June 20, 2024), a federal court vacated only the part of the bulletin saying an IP address plus a visit to a public page about health conditions or providers is enough to trigger HIPAA.
The site's host and its own forms are a different problem, taken up in HIPAA website hosting.
Book yourself and read what comes back
Your own phone is enough to audit your current tool.
- Open your booking page on your phone and book a test visit under a made-up name.
- Read the page address in the browser bar. Names or visit types should not appear in it.
- Open the confirmation email. Note whether it shows the visit type, the provider or a form answer.
- Open the calendar entry the booking created, on every calendar that syncs. Check who can see it.
- Wait for the reminder and read it on the lock screen.
If a stranger could read it over a patient's shoulder, change the setting or ask the vendor.
One year, two setups, made-up numbers
Questions for the sales rep
- Tell me which products and features your BAA names, including reminders and the booking page.
- Say which form fields are protected and which are not.
- Say who at your company can open my account, and whether I can turn that off.
Prices and rules checked on 2026-10-30.
Tags
Frequently asked questions
Is Calendly HIPAA compliant?
By Calendly's own words, not for patient information. Its customer terms, effective August 5, 2026, have you warrant that your data holds no protected health information. A Calendly community manager wrote on July 17, 2026 that it does not currently offer a BAA and has no firm date to share for one.
Is Google Calendar HIPAA compliant?
Google signs a BAA for Workspace accounts once an administrator accepts it in the Admin console, and Google's HIPAA list names Google Calendar among the covered services. A free personal Gmail calendar is not a Workspace account. Google's HIPAA pages do not mention appointment schedules, its booking page feature, so ask Google before relying on it.
Where do I actually get the BAA?
It depends on the vendor. Zoho sends its template when you ask its legal team by email, Google offers its BAA in the Admin console, Microsoft's comes with its data protection terms, and Acuity has you sign it in its settings on the Premium plan. Ask for the document itself and read which products it names.
Does the BAA cover the Google or Meta tag on my booking page?
No. A BAA binds the scheduling vendor, not the advertising tools on your own pages. HHS's tracking bulletin treats a tracking vendor that receives protected health information on a practice's behalf as a business associate that needs its own BAA. A 2024 federal court ruling, AHA v. Becerra, vacated only the bulletin's part on an IP address plus a visit to a public page about health conditions or providers.
Can a Canadian clinic use a US booking tool?
Where PIPEDA applies, the clinic stays responsible for personal information it sends any vendor for processing. For a vendor outside Canada, the privacy commissioner expects comparable protection through contractual or other means and openness that data may go to another jurisdiction. Ontario and three other provinces have their own health privacy laws, so check which law covers your clinic.
Written by
Marketing Analytics & Conversion Tracking Engineer, US and Canada, run remotely
- Media buyer on Google Ads and Meta Ads from October 2023 to September 2025, nearly $700K in spend.
- Set up patient conversion tracking for a New York medical practice (anonymized).
- Upwork Top Rated Plus, 5.0 from 20 reviews.