Conditional A BAA is available only for Acuity Scheduling on Premium (Powerhouse), and Squarespace websites, Forms and all other features are excluded. Verified 2026-10-19.
Short answer
Squarespace offers a BAA for Acuity Scheduling on the Premium (Powerhouse) plan, for HIPAA-enabled Acuity accounts. The BAA is entered into separately for each account. It is not part of a Squarespace website subscription.
Squarespace websites and Squarespace Forms must not be used for PHI. A clinic that builds its site on Squarespace can publish a public site, but patient intake, symptom questionnaires and contact forms that collect health details are outside the BAA. Acuity Scheduling has its own entry: see the Acuity Scheduling HIPAA record. For other tools, browse all vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Acuity Premium (Powerhouse) | Yes | Open the BAA link below the language dropdown in Acuity settings, review it and submit your information. Each account is HIPAA-enabled separately. | None stated. Plan pricing from $55/month billed annually, $69/month billed monthly. |
| Acuity Enterprise | Yes, custom BAA | Custom agreement | Extra cost; amount Not published by the vendor |
| Acuity Starter | No | Not applicable | Not applicable |
| Acuity Standard | No | Not applicable | Not applicable |
| Website plan: Basic | No | Not applicable | Not applicable |
| Website plan: Core | No | Not applicable | Not applicable |
| Website plan: Plus | No | Not applicable | Not applicable |
| Website plan: Advanced | No | Not applicable | Not applicable |
Upgrading a website plan does not add a BAA. The only route is Acuity Scheduling on Premium (Powerhouse) or a custom Enterprise agreement.
What the BAA covers and what it excludes
Covered:
- Acuity Scheduling, in an account that has been HIPAA-enabled.
Excluded:
- Squarespace websites
- Squarespace Forms
- All Squarespace features other than Acuity Scheduling
Are Squarespace forms HIPAA compliant? Squarespace Forms are not covered by the BAA, so they should not collect PHI. A form asking "reason for visit," medication names or insurance details belongs in a tool that has signed a BAA for that service.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Unpublished is not the same as absent. It means a reviewer cannot rely on these controls from public documents and should request evidence directly before approving any use beyond the BAA scope.
How to use Squarespace with PHI
Squarespace is usable with PHI only through a HIPAA-enabled Acuity Scheduling account. A practical checklist for a clinic:
- Sign the BAA before any PHI enters Acuity. Do not start with a trial of real patient bookings.
- Enable HIPAA on each Acuity account separately. A second location or provider with its own account needs its own enablement.
- Keep PHI off the Squarespace website, Squarespace Forms and every other feature. Link from the site to the scheduling page instead of embedding health questions in a site form.
- Configure access and offboarding. Give front-desk staff only the access they need and remove departing staff the same day.
- Train staff and set policies, for example that clinical details are never typed into a website contact form or its notification emails.
- Review the vendor's help article and terms periodically, since plan names and BAA scope can change.
Compliance depends on the signed BAA, your configuration and your policies, not on the platform alone. If the site itself must handle PHI, compare HIPAA-compliant website builders. Definitions of BAA and PHI are in the HIPAA glossary (BAA, PHI).
Alternatives with a BAA
These website options have a conditional status. Each page gives the plan and service scope.
- Bubble: conditional, on Dedicated Enterprise (HIPAA add-on). See Is Bubble HIPAA compliant?
- GoDaddy: conditional, for Microsoft 365 email on plans GoDaddy represents as HIPAA-compliant. See Is GoDaddy HIPAA compliant?
- Wix: conditional, on the Business plan. See Is Wix HIPAA compliant?
Sources
- Acuity Scheduling and HIPAA — Help article, checked 2026-10-19. "Acuity is the only Squarespace feature currently designed to offer services consistent with HIPAA obligations. Your Business Associate Addendum (BAA) doesn't cover other Squarespace features."
- Acuity Scheduling and HIPAA — Help article, checked 2026-10-19. "You must be on the Powerhouse or Premium plan to enable HIPAA-related services and enter into a BAA with Squarespace."
- Terms of Service — Squarespace — Terms, checked 2026-10-19. "unless your Account for such Services is designated as HIPAA-enabled"
- Acuity Scheduling Pricing Plans & Features — Pricing page, checked 2026-10-19. "Premium $55/ month … Sign BAA for HIPAA compliance"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Is Squarespace HIPAA compliant?
Not as a general property of the platform. A BAA is available for Acuity Scheduling on Premium (Powerhouse), and Squarespace websites, Forms and other features are excluded from it. The verdict is conditional.
Does Squarespace sign a BAA, and on which plan?
Yes, for Acuity Scheduling only. Premium (Powerhouse) includes access to the BAA, with no extra cost stated. Enterprise offers a custom BAA at an extra cost that is not published by the vendor. Starter, Standard and the website plans (Basic, Core, Plus, Advanced) do not include one.
Are Squarespace forms HIPAA compliant?
Squarespace Forms are not covered by the BAA. Do not use them to collect PHI such as symptoms, diagnoses or insurance details.
Do I need to enable HIPAA separately for each Acuity account?
Yes. Each account is HIPAA-enabled separately. You open the BAA link below the language dropdown in Acuity settings, review the agreement and submit your information for that account. The BAA is not automatic.