Conditional A BAA is available on Square Free, Plus and Premium for HIPAA-enabled services such as Square Appointments and Square Invoices; the main exclusion is Square Buyer Services and any service Square has not identified as HIPAA-enabled. Verdict date: 2026-10-19. This is one of our all vendor HIPAA checks, built only on Square's own BAA page, General Terms and help article.
Short answer
Square's BAA is accepted automatically through the General Terms of Service. It applies when a Covered Entity or Business Associate uses HIPAA-enabled services, such as Appointments or Invoices, with PHI.
Not every Square service is HIPAA-enabled. Data collected through Buyer Services (Square Go, Profile, Pay and Local Offers, including customer-facing appointment bookings) is processed by Square as an independent controller, outside the BAA.
So "Square" as a whole is not a yes. A clinic can have a BAA for the staff-side use of Appointments while the client-facing booking flow sits outside it.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Square Free | Available | No request or signature. The BAA is incorporated into the General Terms and applies when you are a Covered Entity or Business Associate and Square creates, receives, maintains or transmits PHI on your behalf. | Not published by the vendor |
| Square Plus | Available | Same as above | Not published by the vendor |
| Square Premium | Available | Same as above | Not published by the vendor |
Square lists Appointments from $0/mo per location on Square Free. No plan is excluded from the BAA in the sources the vendor pages.
What the BAA covers and what it excludes
Covered:
- Square Appointments
- Square Invoices
- Other features Square explicitly identifies as HIPAA-enabled
Excluded:
- Services not identified as HIPAA-enabled.
- Buyer Services (Square Go, Profile, Pay, Local Offers). Square acts as an independent controller for this data.
- PHI sent without encryption, unless the customer documents under the HIPAA Security Rule that encryption is not reasonable.
Square's help article states that use of Buyer Services by your customers does not create a Business Associate relationship.
In practice, a med spa that stores treatment notes in a HIPAA-enabled service is in different territory from a client who books through Square Go and types symptoms into a booking field. The first falls within the BAA's scope. The second is Buyer Services data.
Security controls the vendor publishes
In the sources the vendor pages, Square does not publish a status for the controls below.
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Absence of publication is not a finding that the control is absent. It means we cannot cite a vendor source for it.
How to use Square with PHI
Compliance depends on the BAA, your configuration and your policies. Using Square does not make a practice HIPAA compliant. Checklist:
- Confirm you are a Covered Entity or Business Associate (see the HIPAA glossary). The BAA applies only in that case.
- Use only services Square identifies as HIPAA-enabled, such as Appointments and Invoices.
- Keep PHI out of Buyer Services flows and out of customer-facing booking fields.
- Encrypt PHI in transit, or document under the Security Rule why that is not reasonable.
- Manage staff access: add users deliberately and remove them at offboarding.
- Keep your own written policies and staff training. See the HIPAA guides.
Alternatives with a BAA
Listed alphabetically; order does not reflect payment or preference. Verdicts and plans come from each vendor's own page.
- Acuity Scheduling: conditional; BAA on Premium (formerly Powerhouse). See Is Acuity Scheduling HIPAA compliant?
- Google Calendar: conditional; Google Workspace paid editions.
- Jane App: yes; BAA on Balance.
- SimplePractice: yes; BAA on Starter.
- Vagaro: conditional; medical spa and wellness customers, plan not specified.
For more options, see HIPAA-compliant scheduling software and HIPAA-compliant payments tools.
Sources
- HIPAA Business Associate Agreement (last updated March 16, 2026) — BAA page, checked 2026-10-19. "Not all Services are HIPAA-enabled."
- HIPAA Business Associate Agreement (last updated March 16, 2026) — BAA page, checked 2026-10-19. "Square Appointments, Invoices, or other features that have been explicitly identified as HIPAA-enabled by Square."
- HIPAA Business Associate Agreement (last updated March 16, 2026) — BAA page, checked 2026-10-19. "Use of Square Buyer Services by your customers does not create a Business Associate relationship between you and Square."
- General Terms of Service — Terms, checked 2026-10-19. "If you are subject to HIPAA as a Covered Entity or Business Associate (as defined in HIPAA) and use the Services in a manner that causes us to create, receive, maintain, or transmit Protected Health Information on your behalf, then you agree to the HIPAA Business Associate Agreement (“HIPAA BAA”)."
- Comply with Square's HIPAA requirements | Square Support Center – United States — Help article, checked 2026-10-19. "then you agree to the HIPAA Business Associate Agreement"
- Appointments Pricing & Plans | Square — Pricing page, checked 2026-10-19. "$0/mo. per location"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Does Square sign a BAA on the free plan?
A BAA is available on Square Free, Plus and Premium. It is incorporated into the General Terms and applies when you are a Covered Entity or Business Associate using HIPAA-enabled services with PHI. Whether any extra cost applies is not published by the vendor.
Is Square Appointments HIPAA compliant?
Square Appointments is one of the services named as HIPAA-enabled under Square's BAA. That means a BAA is available for it on Square Free, Plus and Premium. It does not by itself make your practice compliant: configuration, access management and policies remain your responsibility.
Are customer-facing online bookings through Square Go covered by the BAA?
No. Data collected through Buyer Services, including Square Go and customer-facing appointment bookings, is processed by Square as an independent controller outside the BAA. Keep PHI out of booking fields in those flows.
Do I have to request or sign a BAA with Square?
No. The BAA is accepted automatically through the General Terms of Service and applies when you are a Covered Entity or Business Associate and Square creates, receives, maintains or transmits PHI on your behalf using HIPAA-enabled services.