Scheduling software and HIPAA: which tools sign a BAA, and on which plan

If patients book with you online, the scheduling tool holds their names, contact details and often the reason for the visit. We checked what each of the 8 tools in our appointment scheduling ranking says about signing a Business Associate Agreement (BAA), and on which plan. This describes only what each company's own pages say. All were read on Oct 1, 2026.

What a BAA is

The US Department of Health and Human Services puts it this way: "The HIPAA Rules permit a covered entity to disclose PHI to a business associate if the covered entity obtains satisfactory assurances, in the form of a contract or other written arrangement (collectively referred to as a 'business associate agreement,' or BAA), that the business associate will appropriately safeguard the information, among other obligations." (HHS, checked Sep 25, 2026.)

The one tool whose BAA names no plan or fee

• Square Appointments: "This HIPAA BAA applies only to the Services and configurations where Square is acting as your Business Associate, including when you use Square Appointments, Invoices, or other features". The BAA is part of the terms for using Square's services, and its HIPAA help article says a covered entity whose use of Square involves PHI agrees to it. No plan, add-on or fee is named, so nothing on its pages keeps it off Square Plus, the $49-a-month plan we price. The agreement also says not every Square service is HIPAA-enabled, and sellers must check their own setup.

The 5 tools with a BAA on a higher plan, for a fee, or under a separate contract

• Acuity Scheduling: "You must be on the Premium or Powerhouse plan to enable HIPAA-related services and enter into a BAA with Squarespace." The pricing page lists Premium at $49 a month billed yearly or $61 monthly; Starter, the plan we price, doesn't include it. On a HIPAA account, Office 365, Outlook.com, Exchange and iCloud calendar sync are switched off.
• Zoho Bookings: the plan comparison ticks "HIPAA compliance" only for Premium ($9 per user a month billed yearly, $12 monthly), not Basic. Its HIPAA help article says: "You can request our BAA template by sending an email to legal@zohocorp.com".
• Cal.com: "A Business Associate Agreement (BAA) is included at no extra cost with the Enterprise plan and the Organizations plan for 15 users or more." For the Teams plan we price, or Organizations under 15 users, "a BAA can be purchased for an additional $300 per month." Its pricing page ticks "HIPAA compliance" for Teams; we go by the HIPAA page, which charges for the BAA itself.
• Doodle: its BAA template says "This Agreement is incorporated into the Master Services Agreement and the Individual Orders entered into by the Covered Entity and the Business Associate." That is a sales contract, not the self-serve Pro plan, and the pricing page names no HIPAA or BAA for Pro.
• Setmore: its pricing table reads "HIPAA Signed BAA" on Pro, and its help article says a standard BAA comes with a Setmore Health account. But "Opting into Setmore Health may only be done during account creation, and is permanent", existing accounts can't be converted, and Setmore Health turns off classes and reviews. Setmore's Terms of Use also say "Setmore is not currently HIPAA compliant." Because the pages conflict, we don't count it as a BAA on the entry plan.

The 2 tools whose pages offer no BAA

• Calendly: "Calendly does not currently comply with HIPAA, GLBA, or similar health and financial regulations." Its customer terms have customers warrant that their data holds no protected health information, and a staff reply on its community forum says "we don't currently offer a BAA".
• YouCanBookMe: "We are not able to claim that YCBM is HIPAA compliant, mainly because our system relies on creating and holding data on a third-party system". We found no BAA on its pages, and its Terms restrict storing medical data without the person's explicit permission.

One tool we read but don't rank

SimplyBook.me says it "offers HIPAA features on the Standard, Premium, and Enterprise plans", with "a Business Associate Agreement (BAA) available on request." We don't rank it because its pricing page showed Canadian dollars to our US connection.

What else a practice may want on the same plan

A BAA covers the paperwork, not the workflow. Square Plus also has SMS and email reminders and custom booking forms "such as intake forms", per its contracts article. We found no insurance fields named on any of the 8 tools' pages. Zoho's doctors page says you can collect "patient details, and medical information" through a booking page, using custom fields.

Why we have no healthcare list for scheduling

Our rule for healthcare lists is that a tool must sign a BAA on the entry plan we price at no extra cost, and state at least one of intake forms, SMS reminders, or insurance or clinical fields. Only Square Appointments meets it. A list needs at least three tools that qualify, so we haven't published a scheduling list for healthcare practices.

If you prefer another tool, ask its sales team which plan the BAA comes with and what it costs before you put patient information into it. Our method explains how we score the plans themselves.