Is Squarespace website forms HIPAA compliant?
No, Squarespace states its contact form features, including the form block, cannot be part of a HIPAA compliant solution, and its addendum covers Acuity Scheduling and nothing else.
Applies to Squarespace website forms and form blocks. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
If you keep using it anyway
- Remove every question from your Squarespace forms that could reveal a condition, symptom, medication, reason for visit, insurance or treating provider.
- Collect patient information through an external service that will sign an agreement and link to it from your Squarespace pages: Squarespace's own recommendation.
- If you use Acuity Scheduling, its addendum is available on the Powerhouse or Premium plans, with custom agreements on Enterprise at extra cost.
- Disable the Squarespace Email Campaigns integration before making an Acuity account HIPAA-enabled: Squarespace makes you responsible for turning it off.
Does Squarespace website forms sign a business associate agreement?
Squarespace does not offer one. Not applicable to Squarespace forms. For Acuity only: Scheduling Page → Settings → the addendum link below Account Language → review and submit.
What this means in practice
Squarespace answers this more plainly than most vendors, and the answer is no. Its guidance states that other parts of the platform, including contact form features like the form block, cannot be used as part of a HIPAA compliant solution, and that your addendum does not cover other Squarespace features. Acuity Scheduling is described as the only Squarespace feature currently designed to offer services consistent with HIPAA obligations.
That leaves a common and awkward arrangement: a practice website on Squarespace with an Acuity account attached. The addendum stops firmly at Acuity's boundary. Squarespace tells you directly not to maintain or transmit patient information through Squarespace outside Acuity, and to link to an external compliant service for anything else you need to collect.
Enabling HIPAA on Acuity also removes conveniences your front desk may depend on. The Email Campaigns integration becomes unavailable and you must disable it yourself first, client form answers stop appearing in email notifications, and calendar syncing with Outlook, Exchange and iCloud stops.
How organizations get this wrong
- Adding a reason-for-visit or symptom field to a Squarespace form block, which Squarespace says cannot form part of a compliant solution.
- Assuming the Acuity addendum stretches across the website, when Squarespace states plainly that it does not.
- Leaving Email Campaigns connected: Squarespace makes you responsible for disabling it before Acuity can be HIPAA-enabled.
- Embedding a third-party form and never signing an agreement with that form vendor, which moves the gap rather than closing it.
What the agreement does not cover
- Contact form features including the form block, which Squarespace says cannot be used as part of a compliant solution.
- Every Squarespace feature other than Acuity Scheduling.
- Squarespace Email Campaigns, unavailable on HIPAA-enabled Acuity accounts.
Use instead
Named inside Drive on Google's Included Functionality list, so intake falls under the Workspace amendment
Purpose-built intake on a published tier with the agreement signed in-product
The one Squarespace product that does offer an addendum, if booking and intake are what you need
You just found one. What else is in your stack?
If Squarespace website forms was a surprise, the rest of your tools are worth checking the same way.
Sources
- Acuity Scheduling and HIPAA: Squarespace. Published January 20, 2026. Read July 29, 2026.
Squarespace can change these terms at any time. If something here no longer matches what Squarespace tells you, tell us.