Acuity Scheduling is one of the few mainstream schedulers that can be used compliantly with health information. But the answer to “is Acuity HIPAA compliant?” is not a plain yes. It is: yes, if you are on the right plan, you enable it deliberately, and you accept the features you lose along the way.
The Direct Answer
Acuity offers HIPAA enablement on its higher-tier plans (Premium and Powerhouse, per Acuity’s own documentation). Compliance is not automatic on any plan: each account must separately enter into a Business Associate Addendum (BAA) with Squarespace through the account settings before it is HIPAA-enabled. Lower-tier plans cannot be HIPAA-enabled at all.
Only Acuity is covered, not the rest of Squarespace. Squarespace’s own documentation is explicit that Acuity is the only Squarespace feature designed for HIPAA obligations. Website form blocks and other Squarespace features are not covered by the BAA and should never collect health information.
Enabling HIPAA turns things off. A HIPAA-enabled Acuity account disables invoicing, calendar syncing with Office 365, Outlook.com, Exchange, and iCloud, the Squarespace Email Campaigns integration, and Reserve with Google. Email notifications also stop including client form answers. Compliance on a general-purpose tool is a trade.
| Feature | Acuity (lower tiers) | Acuity (HIPAA-enabled) | Vibly |
|---|---|---|---|
| BAA available | No | Yes, separate enablement | Yes, for all clients on every plan |
| Compliant by default | No | No, must be enabled per account | Yes, built-in |
| Invoicing while compliant | n/a | Disabled | Included |
| Built for health and wellness coaching | No | No | Yes |
| Forms, payments, video, messaging included | No | No | Yes, all-in-one |
What This Means for Your Practice
If you already run Acuity on a qualifying plan and only need compliant scheduling, enabling HIPAA is a reasonable path: review the BAA in your settings, enter into it, and adjust your notification settings so PHI stays out of emails and texts.
If you are choosing tools now, count the full cost: a top-tier scheduler subscription, the features you lose, and the fact that scheduling is just one of several tools that must each pass the same test. Our HIPAA guide for coaches walks the whole stack.
Vibly includes HIPAA-compliant scheduling with a BAA for every client on every plan, alongside payments, video sessions, secure messaging, and intake forms, from $20/month (see plans). If you are comparing schedulers, we broke down Calendly’s HIPAA status too.
Frequently Asked Questions
Is Acuity Scheduling HIPAA compliant?
It can be. Acuity offers HIPAA enablement on its higher-tier plans, and each account must separately enter into a BAA with Squarespace before handling protected health information. Lower-tier plans cannot be HIPAA-enabled.
Does Acuity sign a BAA?
Yes, on qualifying plans, through a self-serve process in the account settings. The BAA covers Acuity only, not other Squarespace features.
What features does Acuity disable in HIPAA mode?
HIPAA-enabled accounts lose invoicing, calendar syncing with Office 365, Outlook.com, Exchange, and iCloud, the Squarespace Email Campaigns integration, and Reserve with Google, and email notifications stop including client form answers.
Is Acuity HIPAA-compliant out of the box on the right plan?
No. Being on a qualifying plan is not enough; the account owner must review and enter into the BAA before the account is HIPAA-enabled, and is responsible for configuring notifications and integrations compliantly.
