S
No BAAIs Squarespace HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
Squarespace says Acuity is its only feature designed for HIPAA obligations, its BAA does not cover other features, and PHI should not be kept or sent through Squarespace outside Acuity. Based on that, don’t use it with patient data.
| Plan or product | BAA |
|---|---|
| Squarespace website features, including contact forms and form blocks | Not covered |
What the BAA leaves out
- Form blocks, which Squarespace says cannot be part of a HIPAA-compliant solution
- All Squarespace features other than Acuity Scheduling
What the vendor says to do
- Squarespace recommends linking to an external compliant service or Acuity to collect patient information
Proof from the vendor
- Acuity Scheduling and HIPAA (Squarespace Help)Acuity is the only feature designed for HIPAA; BAA excludes other features; no PHI outside Acuity
- Form blocksForm blocks cannot be used in a HIPAA-compliant solution; Acuity recommended instead
- Terms of ServiceSection 7.4 bars PHI unless the account is HIPAA-enabled and a separate BAA is signed
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.