Best HIPAA compliant scheduling tools
3 tools compared. Checked 6 Nov 2026.
A booking can show who is seeing which provider, and often why. Treat appointment data as patient data.
Where to start
Start with Acuity Scheduling on Premium, where each account can sign the BAA. If you run your practice on SimplePractice, use its scheduling. Don’t use Calendly for patient bookings, because Calendly says it doesn’t offer a BAA.
| Tool | Result | Where the BAA applies |
|---|---|---|
| SSimplePractice | BAA available | Accepted at trial signup |
| AAcuity Scheduling | On some plans | Premium, Powerhouse or Enterprise |
| CCalendly | No BAA | Calendly says it doesn’t offer one |
SimplePractice
BAA availableSimplePractice says customers agree to its BAA by ticking a box when creating a trial account, with no new signature needed on upgrading to a paid account.
See the full SimplePractice result and proofAcuity Scheduling
On some plansSquarespace lets Acuity accounts on the Powerhouse or Premium plan sign its standard BAA per account, and offers custom BAAs only on Enterprise at extra cost.
Covered: Premium, on the current pricing page; Powerhouse, named in Acuity’s help articles but not sold on that page; Enterprise, for individualized BAAs.
Left out: Other Squarespace features, including the form block, and more.
See the full Acuity Scheduling result and proofCalendly
No BAACalendly says it does not currently offer a BAA, that it is not designed for HIPAA use, and that PHI should not be submitted to it.
Left out: Calendly’s AI features such as Notetaker and Callie should not process regulated data, per Calendly.
See the full Calendly result and proofBefore you choose
- Confirm the BAA covers your exact plan and every feature you’ll use.
- Get the BAA signed before any patient data goes in.
- Turn on the settings the vendor requires, and train your staff on them.
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm before you sign. PHI means protected health information, which includes patient data.