Is Acuity Scheduling HIPAA compliant?
Yes, if you are on the Premium or Powerhouse plan and enter the agreement from your scheduling settings — but it covers Acuity only, and turning HIPAA mode on permanently disables invoices.
Applies to Acuity Scheduling. Last reviewed against Squarespace's own documentation. Next review December 19, 2026.
Reviewed by Dr. Rachel Foster, MD — Pediatrician and small practice owner.
What you must do
- Be on the Premium or Powerhouse plan. Custom agreements are available on Enterprise for an additional cost.
- Before enabling, disable calendar syncing with Office 365, Outlook.com, Live.com, Exchange and iCloud.
- Before enabling, disable the Squarespace Email Campaigns integration if active.
- Enter the agreement in-product: Scheduling Page → Settings → the agreement link below the Account Language dropdown → review your obligations → submit.
- After enabling, review notification settings to control what patient information appears in client emails and texts.
- Contact Acuity support to disable calendar file attachments on confirmation and rescheduling emails.
- Evaluate every third-party integration you connect — Google Calendar, Stripe and others — and put any additional agreements in place before you start using them.
- Expect to be logged out after four hours of inactivity.
- Do not maintain or transmit patient information anywhere in Squarespace outside Acuity.
Does Acuity Scheduling sign a business associate agreement?
Yes. Squarespace offers one. Premium or Powerhouse. Custom agreement on Enterprise for an additional cost. Self-serve in Acuity: Scheduling Page → Settings → the agreement link below the Account Language dropdown → review → submit.
What this means in practice
Acuity is one of the few scheduling tools that will sign, on Premium or Powerhouse, and you enter the agreement yourself from your scheduling settings. But switching on HIPAA mode is a one-way decision with real product consequences, so do the preparation before you press it, not afterwards.
The headline consequence is that Acuity invoices are disabled once HIPAA mode is on, along with the Reserve with Google integration. A practice billing clients through Acuity invoices needs somewhere else to send bills from first. Before enabling, you must also disable calendar syncing with Office 365, Outlook.com, Live.com, Exchange and iCloud, and turn off the Squarespace Email Campaigns integration. Afterwards, contact Acuity support to stop calendar file attachments riding along on confirmation and rescheduling emails.
The boundary that catches Squarespace customers is that the agreement covers Acuity and nothing else in Squarespace. A website contact form block asking visitors what they would like help with sits outside it entirely. Third-party integrations, including Google Calendar and Stripe, need their own agreements before you start using them.
How organizations get this wrong
The specific mistakes we see with Acuity Scheduling, not generic advice.
- Enabling HIPAA mode without realising Acuity invoices switch off permanently, leaving the practice with no way to bill from the system it was using.
- Leaving a Squarespace website contact form asking visitors to describe their problem, which sits outside Acuity and outside the agreement.
- Keeping an Outlook, Exchange or iCloud calendar sync running, when all such syncs must be disabled before the agreement is entered.
- Forgetting to ask Acuity support to remove calendar file attachments from confirmation and rescheduling emails sent to clients.
What the agreement does not cover
- All other Squarespace features. Acuity is the only one designed for this, and the agreement does not cover the rest.
- Squarespace website contact form blocks and the Email Campaigns integration.
- Acuity's invoices feature and the Reserve with Google integration, both disabled once HIPAA mode is on.
- Google Docs uploads on intake forms — uploads are restricted to local devices.
- Third-party integrations generally, including Google Calendar and Stripe.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
Google Calendar appointment scheduling
Covered by the Workspace amendment without losing invoicing
Built for clinical practices, so scheduling, intake and notes sit under one agreement
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Acuity Scheduling, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Squarespace’s own published documentation, read on the date shown.
- Acuity Scheduling and HIPAA — Acuity Scheduling (Squarespace). Published January 20, 2026. Read July 29, 2026.
- Acuity Scheduling and HIPAA — Squarespace. Published January 20, 2026. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Squarespace’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.