HIPAA compliant scheduling software? Booking tools that sign a BAA
Online booking and scheduling tools that sign a BAA — on which plans, how you put the agreement in place, and what to keep out of reminders, intake questions and calendar sync.
Online scheduling at a glance
For a HIPAA-covered practice, an identifiable patient booking is PHI — the fact that a named person has an appointment with a provider is health information — so an online booking tool needs a BAA for your plan, reminders that say no more than needed, and care with intake questions, calendar sync and the booking page's trackers. We compare 5 products in Online scheduling. 1 signs a Business Associate Agreement (Google Calendar appointment schedules). 3 sign one only for certain plans or products (Acuity Scheduling, Setmore, Square Appointments). 1 does not (Calendly). Every value links to the vendor's own documentation and shows when it was checked.
| Sign a BAA | Google Calendar appointment schedules |
|---|---|
| Only some plans or products | Acuity Scheduling, Setmore, Square Appointments |
| No BAA | Calendly |
4 more facts
| Products compared | 5 |
|---|---|
| Compared on | BAA without a sales process, BAA on entry-level team plans |
| Commissions | None — no vendor pays us |
| Facts checked since | 2026-10-17 |
Comparison
Alphabetical. No vendor pays us for listings, rankings or referrals — methodology.
| Product | Signs a BAA | BAA without a sales process | BAA on entry-level team plans |
|---|---|---|---|
| Acuity Scheduling | Conditional | Yes | No |
| Calendly | No | Not verified | Not verified |
| Google Calendar appointment schedules | Yes | Yes | Not verified |
| Setmore | Conditional | Not verified | Yes |
| Square Appointments | Conditional | Not verified | Not verified |
Found an outdated or wrong fact? Report it
What to check before you choose
- A BAA on your plan
- Booking tools usually limit the BAA to a higher plan or a separate health offering, sometimes chosen only when the account is created. Sign it before the first patient books (164.502(e)).
- Reminders
- Appointment reminders are permitted for treatment without a HIPAA authorization (164.506). We recommend keeping ordinary email and SMS reminders brief and leaving out clinical details. Use reasonable safeguards, and accommodate reasonable requests to send them somewhere else or another way (164.522(b)).
- Intake questions on the booking page
- Questions asked at booking become part of what the tool stores. Ask only what you need to schedule; collect health history in your EHR or a forms tool under a BAA.
- Calendar sync
- Syncing bookings to a personal or uncovered calendar service copies PHI out of the covered account. Sync PHI only to approved calendar services with appropriate BAA coverage, or switch sync off. For a calendar app on a device, check the device's safeguards and whether it copies events to a personal cloud account (164.312).
- The booking page itself
- Analytics and ad pixels on a booking page can tell an ad platform who booked what — check the page under the online tracking guidance.
Common mistakes
- Using a booking tool whose terms forbid health information.
- Reminder texts that name the condition or other clinical details.
- Syncing patient appointments to a personal phone calendar.
How we compare
- BAA without a sales process
- You can put the BAA in place yourself — it is included in standard terms or accepted in account settings — rather than requesting it and waiting for approval.
- BAA on entry-level team plans
- The BAA is available on the vendor's entry-level business or team plan, not only on enterprise tiers.