Patient Scheduling Software: What to Check Before You Buy

The right patient scheduling software books straight into the schedule your practice already runs, follows your rules for who may book which visit, and comes from a vendor that signs a business associate agreement (BAA), the HIPAA contract that binds it to safeguard patient information. Before you sign, check one more thing: whether each booking keeps the ad or page it came from, without patient details going to Google or Meta.

Quick answer

1. Book a test visit online and watch it reach your front desk's schedule, then block a slot there and watch it vanish online.
2. Have the vendor set up your three most common visit types while you watch, with separate rules for new and existing patients.
3. Get the 12-month total in writing: setup, the connection to your system, texts and the plan tier that includes the BAA.
4. Sign that agreement before the first patient books, and ask what it switches off.
5. Book through a link that names a test source, as an ad's link would, and find that source in the export; nothing naming the patient or the visit should reach Google or Meta.

Will online bookings land in your schedule by themselves?

Patient appointment scheduling software lets patients pick an open time online without calling (patient self-scheduling) and can send reminders. It comes in three forms: built into your EHR (electronic health record, where the chart lives) or practice management system (PMS, the software that runs the schedule and billing); a separate product that connects to one of them; or a general booking tool that connects to neither, so someone retypes each booking into the real schedule.

With a separate product, you are mostly buying the connection. Ask whether it is two-way, reading open times from your PMS and writing each booking back. Then ask whether it works in real time or on a delay. During a delay, the website and the desk can fill the same slot. Ask which visit types, providers and locations it carries, and whether a returning patient's online booking attaches to the existing chart or creates a duplicate.

Which patients can book which visits online?

Self-scheduling works when its rules match how your desk books by phone. List what the desk asks before offering a time: new or existing patient, reason for the visit, insurance plan, provider, location, any referral. Each answer should narrow the times shown. A visit that needs a human, such as a procedure, should end in a request the desk confirms.

Ask whether each visit type can have its own length and providers, and whether insurance is asked before any time appears, so a patient on a plan you do not take never books. Bring one awkward rule to the demo, such as new patients only on Tuesday mornings with one doctor, and have the vendor build it while you watch.

What happens between the booking and the visit?

Reminders should go out at times you choose, by text or email, and let patients confirm or cancel by replying. Ask to see the default wording. Acuity Scheduling's HIPAA guide says its email and text notifications may contain PHI (protected health information, HIPAA's term for patient information that can identify someone) by default, including client names, email addresses, appointment types and times, and that the account holder is responsible for changing them (Acuity, checked 2026-10-04). I cover what to send and when in a separate guide.

When a patient cancels, the waitlist should offer the freed slot by text without the desk calling around. The desk and the website should also book from one calendar. Ask whether staff book in the same screen, whether the desk can text a booking link to a caller, and what an after-hours caller is offered.

What will it cost over 12 months?

A quote may be per provider, per location, a flat rate or part of an EHR subscription. Its monthly price can leave out setup, the EHR connection, texts and the plan tier with the BAA. Acuity's pricing page, for example, lists signing a BAA only on its Premium plan (Acuity, checked 2026-10-04). Run every quote through two lines:

• 12-month cost = (monthly fee + add-ons + usage) × 12 + one-time fees
• Cost per online booking = 12-month cost ÷ online bookings expected in 12 months

Illustrative: every number below is made up for an imaginary three-provider dermatology practice, and none comes from a client.

B's $300 headline price is really $518 a month. At the 1,800 online bookings a year this practice expects, A costs $6,400 ÷ 1,800 = $3.56 per booking and B costs $6,216 ÷ 1,800 = $3.45. B is $184 cheaper in the first year only. Without the setup fee, A's second year costs $450 × 12 = $5,400 against B's $6,216.

A fourth provider lifts A's first year to $600 × 12 + $1,000 = $8,200, while B's fee holds and only its texts grow. Only A keeps each booking's source. Weigh that next to the price.

Will the vendor sign a business associate agreement?

HHS defines a business associate as an outside person or company that creates, receives, maintains or transmits PHI on behalf of a practice that HIPAA covers, and its examples include a third-party AI chatbot on a provider's patient portal that handles appointment scheduling (HHS, checked 2026-10-04). HIPAA lets a practice share PHI with such a vendor once it gives written assurances, in a business associate agreement, that it will safeguard the information.

Sign before the first patient books, and ask what the agreement switches off. A HIPAA-enabled Acuity account, for example, loses the Reserve with Google integration, which lets people book from Google Search and Maps, and calendar syncing with Office 365, Outlook.com, Live.com, Exchange and iCloud (Acuity, checked 2026-10-04).

A general tool may rule patient data out. Calendly's customer terms ask customers to warrant that their data contains no protected health information (Calendly, checked 2026-10-04), and its community manager wrote in July 2026 that Calendly does not currently offer a BAA (Calendly, checked 2026-10-04). Your compliance officer or healthcare attorney decides, agreement in hand, whether a tool may hold patient bookings.

Can it tell you which ad or page each booking came from?

This is the part I work on. For a medical practice in New York City, I set up patient conversion tracking that connects its bookings to Google Ads. Two questions decide it: does the scheduler keep each booking's source, and what does it send to ad platforms?

A UTM tag is a label at the end of a link, such as utm_source=google, that names where a click came from. Google describes adding them to links in ads and referrals to see which campaigns send traffic (Google, checked 2026-10-04). The scheduler should save that tag, or the ad's click id (a code Google adds to an ad's link on each click), with the appointment and let you export bookings by source. Acuity, for example, documents a hidden intake form question filled in from a value you add to the booking link, with a report and a spreadsheet export by source (Acuity, checked 2026-10-04). That export holds patient names, so it stays inside the practice; only counts by source leave.

Google says HIPAA-regulated entities must not expose PHI to Google Analytics and offers no BAA for it (Google, checked 2026-10-04). It also requires page addresses, path and parameters, to be free of personal information such as email addresses (Google, checked 2026-10-04). That rules out the Google tag on a confirmation page whose address carries a patient's name or email. Meta's Business Tools Terms rule out data that "include or are based, directly or otherwise, on health information" (Meta, checked 2026-10-04).

So ask what the built-in connections send. Acuity's Google Analytics connection sends the appointment type's name with each finished booking (Acuity, checked 2026-10-04), so a visit type named after a condition travels with it. What may cross to an ad platform, and what never does is where I draw that line.

The other half of the answer is whether the patient arrived, and that status has to come back out of your PMS. Here is how appointment status leaves an EHR.

What should you test and ask in the demo?

Run these with the vendor sharing the screen, on your system or a test copy of it.

Then ask the vendor these questions, and get the answers in writing:

• Which EHR or PMS versions, visit types and locations does the connection support, and how often does it sync?
• What is the 12-month total for your providers and locations, with setup, connection, texts and the BAA plan?
• Will you sign the BAA before go-live, and what does it switch off?
• What do your Google and Meta connections send on each booking, field by field?
• Who fixes a booking that never reached the schedule, and how fast?
• Can you export every appointment, with its source, if you leave?