Is Calendly HIPAA compliant?
No, Calendly's customer terms specifically forbid putting patient information into the service and Calendly does not offer a business associate agreement, so it should not be used to book patients or collect their details.
Applies to Calendly scheduling. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
If you keep using it anyway
- If you keep Calendly for non-patient scheduling only, delete every intake question that could reveal a health condition, reason for visit, medication, insurance or treating provider.
- Do not connect Calendly to a calendar whose event titles or descriptions pair patient names with a reason for visit.
- Do not connect Calendly to your EHR, practice management system or any patient database.
Does Calendly sign a business associate agreement?
Calendly does not offer one. Not applicable. Calendly's terms prohibit patient information rather than offering an agreement to permit it.
What this means in practice
This one is stronger than a simple absence of an agreement. Calendly's customer terms require you to warrant that your data does not contain protected health information or information subject to HIPAA. In other words, by using Calendly you are actively promising there is no patient information in it. A practice booking patients through Calendly is not merely unprotected; it is contradicting the terms it agreed to, and no plan tier, including Enterprise, changes that.
The security accreditations Calendly publishes cause a lot of the confusion. SOC 2, ISO 27001 and PCI describe how well Calendly runs its infrastructure. None of them is a statement about HIPAA, and none creates an agreement with your practice.
If you want to keep Calendly for something legitimate, such as vendor meetings or interviews, then strip it back properly: remove any question that could reveal a condition, a reason for visit, a medication, insurance or a treating provider; do not connect it to a calendar whose event titles pair patient names with why they are coming in; and keep it away from your clinical systems entirely.
How organizations get this wrong
- Keeping a reason-for-visit question on the booking form because the clinician finds it useful preparation before the appointment.
- Connecting Calendly to a practice calendar whose event titles already pair a patient's name with what they are being seen for.
- Buying middleware advertised as making Calendly safe for patient bookings, which creates no agreement between your practice and Calendly.
- Pointing at Calendly's SOC 2 and ISO 27001 badges as evidence of coverage when Calendly makes no HIPAA representation anywhere.
What the agreement does not cover
- Every Calendly plan, including Enterprise; no agreement is offered on any tier.
- Calendly's Customer Terms require you to warrant that your data does not contain protected health information or information subject to HIPAA.
- Calendly's security pages list SOC 2, ISO 27001 and PCI accreditations of its infrastructure but make no HIPAA representation.
- Third-party middleware marketed as making Calendly compliant does not create an agreement between your practice and Calendly.
Use instead
Google Calendar appointment scheduling
Calendar is named on Google's Included Functionality list, so booking falls under the Workspace amendment
Purpose-built scheduling that offers an agreement on a specific plan tier
You just found one. What else is in your stack?
If Calendly was a surprise, the rest of your tools are worth checking the same way.
Sources
- Customer Terms and Conditions: Calendly. Published June 1, 2026. Read July 29, 2026.
- Calendly Platform Security and Compliance: Calendly. Read July 29, 2026.
- Your privacy and security: Calendly. Read July 29, 2026.
Calendly can change these terms at any time. If something here no longer matches what Calendly tells you, tell us.