Is Calendly HIPAA Compliant? Scheduling Tools for Medical PracticesWhat Calendly's own security page says, why a booking is patient data, and two scheduling options with a documented BAA.

No. Calendly's public security page does not mention HIPAA or a Business Associate Agreement (BAA), so a medical practice should not use it for patient bookings. We checked the page on October 9, 2026. This guide explains what we found, why a booking counts as patient data, and which scheduling tools document a BAA.

Calendly and HIPAA at a glance

• Calendly's security page lists five certifications: SOC 2 Type 2, SOC 3, CSA STAR, PCI, and ISO/IEC 27001.
• The page does not mention HIPAA or a BAA.
• HIPAA Journal reports that Calendly will not sign a BAA with covered entities.
• Acuity Scheduling signs a BAA on its Premium and Powerhouse plans.

What does Calendly say about HIPAA?

Calendly's security page says nothing about HIPAA. It lists SOC 2 Type 2, SOC 3, CSA STAR, PCI compliance, and ISO/IEC 27001. Those are security certifications. None of them is a BAA, and none replaces one.

HIPAA Journal reports that Calendly will not sign a BAA. It quotes Calendly's help center: "Calendly should not be used for collecting Protected Health Information." We could not load that help article directly, so we cite HIPAA Journal for the quote. A practice that wants certainty should ask Calendly support for its BAA position in writing.

Is an appointment booking protected health information?

Yes, in most cases. A booking joins a person's name and contact details to a healthcare provider and a visit date. HHS guidance on online tracking names appointment scheduling as an example of a website feature that collects identifiable health information. A "reason for visit" field adds more.

Which scheduling tools document a BAA?

We confirmed two options on the vendors' own pages on October 9, 2026.

Many practice management and EHR systems also include patient scheduling under their own BAA. Check your current system before you add a separate tool.

What changes when Acuity is HIPAA-enabled?

Acuity turns off several features once the BAA is signed. Its help center lists them.

• Email notifications no longer include client form answers.
• Calendar sync with Office 365, Outlook.com, Exchange, and iCloud is unavailable.
• Reserve with Google is not enabled.
• The invoices feature is not enabled.
• Users are logged out after four hours of inactivity.

Each Acuity account needs its own BAA. A practice with three Acuity accounts signs three.

How should a practice move off Calendly?

1. 1

   Find every Calendly link

   Search the website, email signatures, social profiles, and the Google Business Profile for calendly.com links.

2. 2

   Choose a tool with a BAA

   Use your EHR's scheduler, Acuity on an eligible plan, or Google Calendar inside a Workspace account with the BAA accepted.

3. 3

   Sign the BAA before going live

   Save a dated copy with your compliance records.

4. 4

   Replace the links

   Swap every patient-facing Calendly link for the new booking link on the same day.

5. 5

   Keep Calendly for non-patient use only

   State in the practice's written policy that Calendly is for staff, vendor, and sales meetings only.

Scheduling is one of several website features that collect patient data. Our HIPAA compliant website checklist covers the rest.

How Webpatch helps

Webpatch is a technology company that works with healthcare practices. We build websites and manage their security, HIPAA compliance, SEO, and AEO. We are not a law firm, and this is not legal advice. If you want your booking setup reviewed, contact Webpatch.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.