Of seven scheduling and calendar vendors listed here, two sign a BAA with a named plan (SimplePractice, Jane App), four sign one conditionally (Square, Google Calendar, Acuity Scheduling, Vagaro), and one publishes no BAA (Calendly). Each answer is "BAA available on plan X for service Y," not a vendor-wide status, so check the plan you will actually use.
Summary: how many scheduling vendors sign a BAA
The table covers seven vendors:
- Yes (2): SimplePractice and Jane App.
- Conditional (4): Square, Google Calendar, Acuity Scheduling and Vagaro. A BAA exists, but it depends on the plan, an admin action or the use case.
- No (1): Calendly.
- Unknown (0): every vendor in the table has a published BAA position, positive or negative.
The BAA route differs by vendor. Some build the BAA into their terms, some provide it on request, some let an admin accept it in settings, and one publishes none. The "How to obtain" column shows the route for each vendor.
The BAA covers a named product and plan, not the vendor as a whole. A clinic can sign a BAA for one plan and still be exposed through another plan or add-on. For other categories, see HIPAA-compliant software by category.
Disclosure: this directory is published by Chanty, Inc. Chanty is not a scheduling tool and does not appear in this table. No scheduling vendor's placement depends on payment.
Quick answer: which scheduling software signs a BAA, and from which plan
"Conditional" means a BAA exists but depends on the plan, an admin action or the use case.
- SimplePractice: yes. BAA from the Starter plan.
- Jane App: yes. BAA from the Balance plan.
- Square: conditional. BAA on the Free plan, incorporated into Square's General Terms and applying only when Square handles PHI on your behalf.
- Google Calendar: conditional. BAA on paid Google Workspace editions.
- Acuity Scheduling: conditional. BAA from the Premium plan.
- Vagaro: conditional. BAA for med spa and wellness customers; the plan is not specified.
- Calendly: no. No BAA published.
Comparison table
| Vendor | Verdict | BAA from plan | How to obtain | Pricing from | Encryption at rest | Audit log | SSO | SOC 2 | Last verified |
|---|---|---|---|---|---|---|---|---|---|
| SimplePractice | Yes | Starter | Part of the terms: the published BAA is entered into automatically at account creation and amends the Terms of Service. | $49/month (Starter, billed monthly; promo $24.50/month for first 3 months) | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| Jane App | Yes | Balance | On request: email Jane to request a copy of the standard BAA (per Terms of Use, Privacy Compliance section). | CAD $59/month (Balance plan, first practitioner included) | Yes | Yes | Not published by the vendor | Yes | 2026-10-28 |
| Square | Conditional | Square Free | No request or signature: the HIPAA Business Associate Agreement is incorporated into Square's General Terms of Service and applies when you are a HIPAA Covered Entity or Business Associate and use the Services in a way that causes Square to create, receive, maintain or transmit PHI on your behalf. | $0/month (Square Free) | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-19 |
| Google Calendar | Conditional | Google Workspace paid editions (Business Starter and above, Enterprise, Education, Nonprofits) | Self-serve: super administrator accepts the HIPAA Business Associate Amendment in Admin console > Account settings > Legal and compliance > Security and Privacy Additional Terms, after confirming covered-entity status. | €6.80/user/month (Business Starter, regional price shown on pricing page; US list price differs) | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| Acuity Scheduling | Conditional | Premium (formerly Powerhouse) | In Acuity, open Scheduling Page, then Settings; below the Account Language dropdown click the BAA link, review the BAA, submit the required information and click Submit. The signed BAA can be viewed and downloaded from the same settings page. Custom BAAs are available on an Enterprise plan for an additional cost. | $55/month (Premium, billed annually; $69/month billed monthly) | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-19 |
| Vagaro | Conditional | Medical spa / wellness customers (plan not specified on vendor pages) | Per Vagaro's med spa article, provided as part of its HIPAA compliance features; per the Enterprise agreement, executed with Vagaro before activating E-Prescription. Vendor support article on HIPAA-compliant notifications (BAA signed in-app) could not be fetched. | Not published by the vendor | Yes | Yes | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| Calendly | No | — | — | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-19 |
Notes on the pricing column:
- The Google Calendar figure is a regional price, not a US list price.
- The SimplePractice figure includes a promotion.
- The Jane App figure is in Canadian dollars.
Where a control is blank in the vendor's published material, the cell reads "Not published by the vendor." A dash means no plan applies.
Vendors that do not sign a BAA
Calendly: verdict no. Calendly publishes no BAA.. Until that changes, patient names, visit reasons and appointment details should not go into Calendly events or booking forms.
General-purpose booking tools often prohibit PHI in their terms. A tool built for sales demos or consulting calls usually has no healthcare terms to point to. It may still look fine on a front-desk screen, because the product works the same way whether or not the vendor accepts PHI.
Free plans are generally excluded from BAAs, and that applies to most vendors in this category. Square Free is a conditional case. Its BAA is incorporated into the General Terms and applies only when Square handles PHI on your behalf.. For the general rule, see free plans and BAAs.
What counts as HIPAA-compliant scheduling software
An appointment calendar holds names, appointment times and often the reason for a visit. For a covered entity, that is PHI. Term definitions are in the HIPAA glossary.
A scheduling tool can touch PHI only when these conditions are met:
- The vendor signs a BAA that covers the scheduling product.
- The BAA covers the plan you actually use.
Typical exclusions:
- General-purpose booking tools whose terms prohibit PHI.
- Free plans that sit outside the BAA.
- Reminder add-ons such as SMS or email notifications, unless the BAA names them.
A signed BAA is necessary but not sufficient. The clinic still configures roles, decides what goes in appointment titles and notes, manages user access and offboarding, secures devices, and trains staff. A BAA does not make an organization HIPAA compliant.
How to choose scheduling software for PHI
- Confirm the BAA names the exact product and plan you will use, and keep a copy. A therapist on a Starter-level plan and a clinic on a premium plan may be in different positions with the same vendor.
- Check how the BAA is obtained. It may be built into the terms, provided on request, or accepted by an admin in settings. Find out who at your practice must accept it and when.
- Check whether reminders, SMS and email notifications and integrations are inside the BAA. Reminders carry appointment details out of the scheduling tool, so confirm they are in scope before you turn them on. See appointment reminders and HIPAA.
- Look for an audit log, encryption at rest, SSO and SOC 2 wherever your risk assessment requires them. Use the table columns, and treat "Not published by the vendor" as unconfirmed.
- Check data residency options if the location of stored data matters to you.
- Keep PHI out of appointment titles and notes on any plan without a BAA. A front desk that types "follow-up, anxiety medication" into a calendar event on a non-BAA plan has created the problem.
- Record the vendor, the plan and the verification date in your vendor inventory.
For the agreement itself, read the business associate agreement guide.
Related guides and categories
- Business associate agreement guide
- Appointment reminders and HIPAA
- HIPAA-compliant video conferencing: for telehealth appointments booked through a scheduler
- HIPAA-compliant software by category
FAQ
Is there a free HIPAA-compliant scheduling tool that signs a BAA?
Only one conditional case in the table. Square's BAA is incorporated into its General Terms and applies when Square handles PHI on your behalf, with the Free plan listed. The other BAA routes start on paid plans: Starter, Balance, paid Workspace editions or Premium. Vagaro's plan is not specified.
Can I use Google Calendar for patient appointments?
Conditionally. A BAA is available on paid Google Workspace editions, so it depends on the edition you use. Without the BAA, do not put PHI in event titles, descriptions or invitations.
How do I get a BAA from Acuity Scheduling?
The BAA is available from the Premium plan, and the verdict is conditional because it depends on that plan.. Get a copy and confirm it names the scheduling product you use.
Does Calendly sign a BAA?
No. Calendly's verdict in the table is "no," and no BAA is published. Do not use it for appointments that include PHI.
Do appointment reminders fall under the scheduling vendor's BAA?
Do not assume so. A BAA covers the services it names, and the table does not show reminders or SMS as in scope for any vendor.. Read the BAA text before turning reminders on.