No Calendly offers no Business Associate Agreement (BAA) on any plan, including Enterprise, and its Customer Terms require that Customer Data contain no protected health information (PHI). Last verified 2026-10-19.
Short answer
Calendly does not sign a BAA on any plan, and it states that it is not currently designed for HIPAA compliance. The Customer Terms exclude PHI from Customer Data. A Calendly community team member says a BAA is not offered and gives no roadmap date. This answers the "Calendly HIPAA compliant BAA 2025" variants: no BAA exists, and no dated plan to add one has been published.
For a patient-facing booking page, a clinic needs a scheduler that signs a BAA. See Is it HIPAA compliant? All vendors for other tools.
Which plans include a BAA
A BAA is the contract in which a vendor agrees to safeguard PHI it handles for a covered entity. See the HIPAA glossary (BAA, PHI) for definitions.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | Not available | Not applicable; no BAA is offered | Not published by the vendor |
| Standard | Not available | Not applicable; no BAA is offered | Not published by the vendor |
| Teams | Not available | Not applicable; no BAA is offered | Not published by the vendor |
| Enterprise | Not available | Not applicable; no BAA is offered | Not published by the vendor |
Calendly's help article states: "Business Associate Agreements are not applicable."
What the BAA covers and what it excludes
Covered: nothing, because no BAA is offered.
Excluded:
- All scheduling and booking features. The Customer Terms prohibit PHI in Customer Data.
- Calendly Notetaker.
- Calendly AI Assistant and other AI features.
On Notetaker, the vendor's FAQ addresses HIPAA non-compliance directly:. Do not record or transcribe patient conversations with it.
Security controls the vendor publishes
On the pages checked on 2026-10-19, Calendly published none of the following.
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Published controls, where a vendor has them, do not substitute for a BAA when PHI is involved.
How to use Calendly with PHI
Calendly cannot be used with PHI. If your practice uses it for non-clinical scheduling, such as vendor calls or staff meetings, keep PHI out entirely. HIPAA compliance depends on a signed BAA, configuration and policies, and Calendly offers no BAA. Checklist:
- Keep PHI out of booking form fields, event names, event descriptions and invitee notes. "Follow-up for diabetes management" is PHI when attached to a named patient.
- Do not use Notetaker or AI Assistant for any call that involves patient information.
- Review which intake questions invitees see and remove any that ask for health details.
- Train front-desk staff not to paste patient details into confirmation messages or reschedule notes.
- Route anything clinical, including patient appointment booking, to a tool that signs a BAA.
- Record the decision, "Calendly: no BAA, no PHI", in your vendor inventory.
Removing names or using initials does not make Calendly acceptable for PHI. For policy templates and risk-analysis help, see the HIPAA guides.
Alternatives with a BAA
Verdicts and starting plans are taken from each vendor's own entry. The order below does not imply a ranking. For a full comparison, see HIPAA-compliant scheduling software.
- Is Acuity Scheduling HIPAA compliant?: conditional; BAA from the Premium plan (formerly Powerhouse).
- Google Calendar: conditional; BAA through paid Google Workspace editions. See Is Google Workspace HIPAA compliant?.
- Jane App: yes; BAA from the Balance plan.
- SimplePractice: yes; BAA from the Starter plan.
- Square: conditional; BAA from Square Free.
Sources
- AI at Calendly | Calendly Help — Help article, checked 2026-10-19. "Calendly is not currently designed for HIPAA compliance, and therefore PHI should not be submitted to Calendly."
- AI at Calendly | Calendly Help — Help article, checked 2026-10-19. "Therefore, Business Associate Agreements are not applicable."
- Frequently asked questions about Calendly Notetaker | Calendly Help — Help article, checked 2026-10-19. "Calendly does not currently comply with HIPAA, GLBA, or similar health and financial regulations."
- Customer Terms and Conditions (effective August 5, 2026) — Terms, checked 2026-10-19. "the Customer Data does not contain: (x) protected health information or information subject to Health Insurance Portability and Accountability Act"
- BAA/HIPAA compliance | Calendly Community (reply by Allie M, Community Manager, July 17, 2026) — Vendor page, checked 2026-10-19. "as it stands today it isn't intended for collecting Protected Health Information, and we don't currently offer a BAA."
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status for other vendors.
FAQ
Does Calendly sign a BAA?
No. Calendly's help article says "Business Associate Agreements are not applicable," and a community team member states that a BAA is not offered. No roadmap date has been published.
Is there a Calendly plan, including Enterprise, that includes a BAA?
No. No plan, including Enterprise, includes a BAA, and Calendly publishes no price or process for obtaining one.
Can I use Calendly Notetaker or the AI Assistant with patient information?
No. Both fall outside any BAA because none exists. Calendly's Notetaker FAQ addresses HIPAA non-compliance directly. Keep patient information out of Notetaker and the AI Assistant.
What do Calendly's Customer Terms say about protected health information?
The Customer Terms, effective August 5, 2026, require that Customer Data contain no PHI. Putting PHI in booking forms, event details or notes would breach those terms.
Can I use Calendly for appointment reminders if no PHI is in them?
The sources checked do not address this. Whether a reminder reveals PHI depends on its content and recipient, since the fact that someone is a patient of a given clinic can itself be PHI.