Conditional A BAA is available on Premium (formerly Powerhouse), and Enterprise can get a custom BAA. HIPAA-enabled accounts lose several features, and the BAA does not cover other Squarespace products. Last verified 2026-10-19.
Acuity Scheduling is owned by Squarespace, Inc. This directory is published by Chanty, Inc.; Acuity is not a Chanty product, and its verdict follows the vendor's own published terms. For other vendors, see Is it HIPAA compliant? All vendors.
Short answer
Acuity Scheduling offers a BAA on the Premium plan. You sign it yourself from the Scheduling Page settings. Enterprise customers can request a custom BAA at additional cost. Starter (formerly Emerging) and Standard (formerly Growing) have no BAA, so neither plan should hold PHI.
Once an account is HIPAA-enabled, these are unavailable: Acuity invoices, certain calendar syncs, Reserve with Google, and the Squarespace Email Campaigns integration. The BAA covers the HIPAA-enabled Acuity Scheduling account, not Acuity as a product on every plan.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Starter (formerly Emerging) | Not available | Not applicable | Not published by the vendor |
| Standard (formerly Growing) | Not available | Not applicable | Not published by the vendor |
| Premium (formerly Powerhouse) | Included | Self-serve: Scheduling Page > Settings, BAA link below the Account Language dropdown | None for the BAA. Premium is $55/month billed annually or $69/month billed monthly |
| Enterprise | Custom BAA | Not published by the vendor | Additional cost; amount not published by the vendor |
On Premium, the signed BAA can be viewed and downloaded from the same settings page. Keep a copy in your vendor file.
What the BAA covers and what it excludes
Covered
- Acuity Scheduling, in an account where HIPAA has been enabled.
Excluded or unavailable in a HIPAA-enabled account
- Acuity invoices.
- Calendar syncing with Office 365, Outlook.com, Live.com, Exchange and iCloud.
- Reserve with Google.
- The Squarespace Email Campaigns integration.
- Many third-party integrations.
- Other Squarespace features and products.
The Squarespace help article states that the BAA doesn't cover other Squarespace features:.
If you searched for a Squarespace scheduling BAA, note that the BAA is for Acuity Scheduling, not the wider Squarespace platform. A clinic with a Squarespace website, email or other Squarespace tools cannot assume they are covered. See Is Squarespace HIPAA compliant? for those products.
A practical example is a therapy practice that reminds clients through Acuity and syncs to an iCloud calendar. After HIPAA is enabled, that sync stops working. Front-desk staff then need a separate, approved way to see the schedule.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Absence from the pages checked is not evidence that a control is missing. It means a privacy or security officer must ask the vendor for it in writing.
How to use Acuity Scheduling with PHI
The BAA is one part of the arrangement. The organization is responsible for the rest:
- Move to Premium or Enterprise before any PHI enters the account.
- Sign the BAA in Scheduling Page > Settings and keep the downloaded copy.
- Confirm the account is HIPAA-enabled, not just on the right plan.
- Avoid the excluded features and any third-party integration that has not been reviewed. Each integration touching PHI needs its own BAA with that vendor.
- Limit what intake forms and appointment fields collect. Ask for what scheduling needs, not full clinical histories.
- Manage user access and remove former staff promptly.
- Train staff and set policies on what may be typed into appointment notes.
Compliance depends on the signed BAA, your configuration and your organization's policies, not on the vendor alone.
Alternatives with a BAA
These scheduling options are listed for comparison, not ranked. Check each page for its BAA starting plan and exclusions.
- Is Google Calendar HIPAA compliant?: conditional.
- Is Jane App HIPAA compliant?: yes.
- Is SimplePractice HIPAA compliant?: yes.
- Is Square HIPAA compliant?: conditional.
- Is Vagaro HIPAA compliant?: conditional.
For the wider list, see HIPAA-compliant scheduling software.
Sources
- Acuity Scheduling and HIPAA — Help article, checked 2026-10-19. "You must be on the Powerhouse or Premium plan to enable HIPAA-related services and enter into a BAA with Squarespace."
- Acuity Scheduling and HIPAA — Help article, checked 2026-10-19. "custom BAAs are available on an Enterprise plan for an additional cost"
- Acuity Scheduling and HIPAA — Help article, checked 2026-10-19. "Calendar syncing with Office 365, Outlook.com, Live.com, Exchange, and iCloud isn't available."
- Acuity Scheduling and HIPAA — Help article, checked 2026-10-19. "Your Business Associate Addendum (BAA) doesn't cover other Squarespace features."
- Acuity Scheduling Pricing Plans & Features — Pricing page, checked 2026-10-19. "Enable HIPAA compliance with a signed Business Associate Agreement (BAA)."
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-19. Later updates appear on Recent changes in vendor HIPAA status.
FAQ
Is Acuity Scheduling HIPAA compliant?
Conditionally. A BAA is available on Premium (formerly Powerhouse), and Enterprise can get a custom BAA. Starter and Standard have no BAA. Even with a BAA, the HIPAA-enabled account loses several features, and your own configuration and policies determine whether PHI is handled properly.
Which Acuity Scheduling plan includes a BAA and how do I sign it?
Premium includes the BAA. In the Scheduling Page, open Settings and use the BAA link below the Account Language dropdown. The signed BAA can be viewed and downloaded from that same page. Premium is $55/month billed annually or $69/month billed monthly. Enterprise customers can get a custom BAA at additional cost; the process is not published by the vendor.
What features are unavailable in a HIPAA-enabled Acuity account?
- Acuity invoices.
- Calendar syncing with Office 365, Outlook.com, Live.com, Exchange and iCloud.
- Reserve with Google.
- The Squarespace Email Campaigns integration.
- Many third-party integrations.
Does the Acuity BAA cover my Squarespace website or other Squarespace products?
No. The BAA applies to the HIPAA-enabled Acuity Scheduling account. The vendor's help article says it doesn't cover other Squarespace features. Your website, email campaigns and other Squarespace products need separate review; see Is Squarespace HIPAA compliant?.