A
On some plansIs Acuity Scheduling HIPAA compliant?
Checked 6 Nov 2026 from 4 vendor sources
Squarespace lets Acuity accounts on the Powerhouse or Premium plan sign its standard BAA per account, and offers custom BAAs only on Enterprise at extra cost. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Starter | Not covered |
| Standard | Not covered |
| Premium, on the current pricing page | Covered |
| Powerhouse, named in Acuity’s help articles but not sold on that page | Covered |
| Enterprise, for individualized BAAs | Covered |
What the BAA leaves out
- Other Squarespace features, including the form block
- Office 365, Exchange and iCloud calendar sync
- Squarespace Email Campaigns integration
- Invoices feature
- Reserve with Google
- Many third-party integrations, which the customer must evaluate and contract for separately
How to get the BAA
In Acuity, open the scheduling page settings, select the BAA link, review the agreement and submit the required information; for a custom BAA, use the Enterprise inquiry form.
What the vendor says to do
- Confirm the account is on a qualifying plan
- Disable calendar syncing and integrations that do not support HIPAA
- Open the BAA link in Acuity’s scheduling page settings, review it and submit the required details
- Review what PHI appears in emails and texts and adjust notification settings
- Consider asking Acuity to disable the ICS calendar attachment
- Repeat for each Acuity account, since each needs its own BAA
Proof from the vendor
- Acuity Scheduling and HIPAA (Squarespace Help)Powerhouse or Premium, Enterprise custom BAAs, BAA scope; last updated 20 January 2026
- Acuity Scheduling and HIPAA (Acuity Help)Steps, restricted features, customer responsibilities
- Acuity Scheduling Pricing Plans & FeaturesSign BAA listed for Premium only among Starter, Standard and Premium
- The Acuity Scheduling Enterprise planIndividualized BAAs on Enterprise through an inquiry form
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.