Conditional Vagaro states that a BAA is available for medical spa and wellness customers and that one must be signed for the Mid-Market Enterprise subscription's E-Prescription Service. No vendor page maps the BAA to standard plans or prices, and HIPAA notifications are limited to US businesses. Verified 2026-10-28. See all vendor checks in Is it HIPAA compliant? All vendors.
Short answer
Vagaro says it provides a BAA as part of its HIPAA features for med spa customers. The Mid-Market Enterprise agreement requires a BAA to be executed with Vagaro before the E-Prescription Service is activated.
No Vagaro page states which standard plans include the BAA, or what it costs. A vendor search snippet says HIPAA-compliant notifications are for US businesses only.
A practice that wants to put PHI into Vagaro should get the BAA in writing, with the plan and features it covers, before any PHI enters the system.
Which plans include a BAA
A business associate agreement (see the HIPAA glossary) is the contract that allows a vendor to handle PHI on a covered entity's behalf. Vagaro's published statements point to two routes:
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Medical spa / wellness customers (plan not specified on vendor pages) | Provided, per Vagaro's med spa article | Vagaro states it provides a BAA as part of its HIPAA features | Not published by the vendor |
| Mid-Market Enterprise subscription | Required for E-Prescription | BAA must be executed with Vagaro before the E-Prescription Service is activated | Not published by the vendor |
No other plans are listed with a BAA or an exclusion. For any plan not named above, the status is unknown.
What the BAA covers and what it excludes
Covered, per Vagaro statements (Vagaro's med spa software):
- Charting / SOAP notes
- Forms
- Messaging
- E-Prescription
Excluded or limited:
- Non-US businesses. HIPAA-compliant notifications are described as US-only in a vendor search snippet.
Vagaro's support article on HIPAA-compliant notifications and in-app BAA signing could not be retrieved, so the signing process and the US-only wording are unconfirmed.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
How to use Vagaro with PHI
Controls and a BAA are only part of the picture. Compliance depends on the signed BAA, your configuration and your policies, not on the tool alone. For a wider walkthrough, see the HIPAA guides.
- Get the BAA signed first. For example, a med spa should not start charting SOAP notes or sending intake forms until the signed agreement is on file.
- Confirm in writing which plan and features the BAA covers. Vagaro publishes no plan mapping, so ask for it.
- Use only the features named in the vendor statements: charting / SOAP notes, forms, messaging and E-Prescription. Keep PHI out of anything not named.
- Configure user access. Give front-desk staff, providers and contractors only the access their roles need, and remove access at offboarding.
- Review audit logs on a set schedule.
- Confirm US-business eligibility for HIPAA notifications before relying on them.
- Set staff policies and training for what may be entered in messages and forms.
Under the Mid-Market Enterprise terms, Vagaro states that the customer remains solely responsible for compliance with HIPAA, state privacy laws and DEA rules for e-prescriptions.
Alternatives with a BAA
These scheduling tools have BAA terms published by their vendors. Check each vendor's current terms before relying on them.
- Acuity Scheduling: conditional, BAA from the Premium plan (formerly Powerhouse).
- Google Calendar: conditional, covered under paid Google Workspace editions.
- Jane App: yes, BAA from the Balance plan.
- SimplePractice: yes, BAA from the Starter plan.
- Square: conditional, BAA on Square Free.
Browse more options in HIPAA-compliant software by category.
Sources
- HIPAA Compliance For Med Spas: What Spa Directors Need to Know in 2026 — Vendor page, checked 2026-10-28. "Vagaro provides a BAA as part of its HIPAA compliance features for medical spa customers. […] Vagaro meets all of these security and compliance requirements for med spa workflows, including a signed BAA."
- Vagaro – Mid-Market Enterprise Subscription Agreement — Terms, checked 2026-10-28. "Customer must execute a Business Associate Agreement with Company prior to activating the E-Prescription Service. Customer remains solely responsible for compliance with HIPAA, applicable state health information privacy laws, and DEA regulations governing electronic prescriptions under 21 CFR Part 1311."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Does Vagaro sign a BAA?
Vagaro states that it provides a BAA for medical spa customers as part of its HIPAA features. For the Mid-Market Enterprise subscription, the BAA must be executed before the E-Prescription Service is activated. The in-app signing process is unconfirmed.
Which Vagaro plan includes the BAA?
Not published by the vendor. The med spa article does not name a standard plan, and no price or extra cost is stated. The only plan named is the Mid-Market Enterprise subscription, for E-Prescription. Ask Vagaro to confirm your plan in writing.
Does the Vagaro BAA cover E-Prescription?
Vagaro requires a BAA for the Enterprise E-Prescription Service before activation. That is a requirement for using the service, not a statement of what the BAA covers. Confirm the covered features with Vagaro. The customer remains responsible for HIPAA, state privacy laws and DEA rules.
Are Vagaro's HIPAA features available to businesses outside the US?
A vendor search snippet describes HIPAA-compliant notifications as available to US businesses only. The underlying support article could not be retrieved, so treat non-US use as not supported until Vagaro confirms otherwise.