Is Squarespace website forms HIPAA compliant?
No — Squarespace states its contact form features, including the form block, cannot be part of a HIPAA compliant solution, and its addendum covers Acuity Scheduling and nothing else.
Applies to Squarespace website forms and form blocks. Last reviewed against Squarespace's own documentation. Next review January 18, 2027.
Reviewed by Margaret O'Brien — HIPAA Privacy Officer.
If you keep using it anyway
- Remove every question from your Squarespace forms that could reveal a condition, symptom, medication, reason for visit, insurance or treating provider.
- Collect patient information through an external service that will sign an agreement and link to it from your Squarespace pages — Squarespace's own recommendation.
- If you use Acuity Scheduling, its addendum is available on the Powerhouse or Premium plans, with custom agreements on Enterprise at extra cost.
- Disable the Squarespace Email Campaigns integration before making an Acuity account HIPAA-enabled — Squarespace makes you responsible for turning it off.
Does Squarespace website forms sign a business associate agreement?
Squarespace does not offer one. Not applicable to Squarespace forms. For Acuity only: Scheduling Page → Settings → the addendum link below Account Language → review and submit.
What this means in practice
Squarespace answers this more plainly than most vendors, and the answer is no. Its guidance states that other parts of the platform, including contact form features like the form block, cannot be used as part of a HIPAA compliant solution, and that your addendum does not cover other Squarespace features. Acuity Scheduling is described as the only Squarespace feature currently designed to offer services consistent with HIPAA obligations.
That leaves a common and awkward arrangement: a practice website on Squarespace with an Acuity account attached. The addendum stops firmly at Acuity's boundary. Squarespace tells you directly not to maintain or transmit patient information through Squarespace outside Acuity, and to link to an external compliant service for anything else you need to collect.
Enabling HIPAA on Acuity also removes conveniences your front desk may depend on. The Email Campaigns integration becomes unavailable and you must disable it yourself first, client form answers stop appearing in email notifications, and calendar syncing with Outlook, Exchange and iCloud stops.
How organizations get this wrong
The specific mistakes we see with Squarespace website forms, not generic advice.
- Adding a reason-for-visit or symptom field to a Squarespace form block, which Squarespace says cannot form part of a compliant solution.
- Assuming the Acuity addendum stretches across the website, when Squarespace states plainly that it does not.
- Leaving Email Campaigns connected — Squarespace makes you responsible for disabling it before Acuity can be HIPAA-enabled.
- Embedding a third-party form and never signing an agreement with that form vendor, which moves the gap rather than closing it.
What the agreement does not cover
- Contact form features including the form block, which Squarespace says cannot be used as part of a compliant solution.
- Every Squarespace feature other than Acuity Scheduling.
- Squarespace Email Campaigns, unavailable on HIPAA-enabled Acuity accounts.
Use instead
Listed on merit. We take no payment for placement and use no affiliate links.
Named inside Drive on Google's Included Functionality list, so intake falls under the Workspace amendment
Purpose-built intake on a published tier with the agreement signed in-product
The one Squarespace product that does offer an addendum, if booking and intake are what you need
You just found one. What else is in your stack?
If Squarespace website forms was a surprise, it is rarely the only one. Most small organizations are running fifteen to thirty tools and have written agreements with a handful of them. A vendor register tracks which of yours touch patient information, which have a signed agreement, when each expires and who owns it — and exports as part of the evidence pack when a client asks.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Squarespace’s own published documentation, read on the date shown.
- Acuity Scheduling and HIPAA — Squarespace. Published January 20, 2026. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Squarespace’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.