Is Calendly HIPAA compliant?

No. Calendly's own help center says "Calendly does not currently comply with HIPAA, GLBA, or similar health and financial regulations." In July 2026 a Calendly community manager wrote, on Calendly's forum, that "it isn't intended for collecting Protected Health Information, and we don't currently offer a BAA."

That settles it for a therapist, clinic or med spa that is a HIPAA covered entity. Without a business associate agreement, the contract HIPAA requires with any vendor that holds your patients' information, you shouldn't put client bookings in Calendly. Below is why a booking counts, where the conflicting claims online come from, and four schedulers that do sign a BAA.

Does Calendly sign a BAA on any plan?

Not that Calendly says. Some pages on the first page of Google claim a BAA "may be available" to Enterprise customers, and one page's title says "yes, on eligible plans with a BAA" while its own text says the opposite. None of them links to Calendly saying so. Calendly's pricing page lists Enterprise features such as audit logs and a data deletion API, and nothing about HIPAA.

Go by what Calendly itself says, dated. If you are on Enterprise and your account manager offers a BAA in writing, that changes things for you. Until then, the answer is no.

Why does a booking count as health information?

HHS defines protected health information as identifiable information, "including demographic data", that relates to a person's health or condition, "the provision of health care to the individual", or payment for it. A name and an appointment with a therapist is information about the provision of care.

Take one booking at a therapy practice:

Every row sits in Calendly the moment the client books. Leaving the intake questions off helps, but the name and the appointment type are still there.

Is scheduling an appointment a HIPAA violation?

No. Scheduling is ordinary care. The problem is only where the booking lives. Using a scheduler that holds client information without a BAA is what puts a covered practice out of line.

Calendly is still fine for meetings with no client information in them, such as staff meetings or calls with vendors.

Not every practice is a covered entity. CMS's guide to covered entities says providers "who submit HIPAA transactions, like claims, electronically are covered." A cash-only coach or wellness business may not be. If you aren't sure, ask a healthcare lawyer. This is not legal advice.

Which schedulers sign a BAA?

We read each company's own pages on November 6, 2026.

The prices hide a trap for small teams on Cal.com. Three people on Teams is 3 times $12, which is $36 a month, but the BAA adds $300, so the total is $336. The same practice on Acuity Premium pays $55 to $69. If you also want notes and claims, SimplePractice's Group Plus for three practitioners is $99 plus $74 plus $74, which is $247 a month, with the EHR included.

Where software fits

If your practice keeps its clinical notes in an EHR such as SimplePractice or Jane, use its built-in scheduler, since the BAA already covers it.

If you want booking, intake, client records and invoices in one place next to a separate EHR, dailybuilt is one option. Its Healthcare Edition comes with a BAA on any plan. dailybuilt switches it on for your workspace, and the owner accepts the BAA in the product. Until then, online booking stays closed. Each service can ask its own intake questions. The Healthcare Edition turns off texts, AI features and ad tracking, so reminders go by email. dailybuilt is not an EHR and keeps no session notes. Essentials is $29.99 a month for up to 5 staff; plans are on the pricing page.

For what changes when a practice moves off a scheduling link, see Calendly vs booking software. If you bill clients for insurance after a session, how to make a superbill for therapy covers the receipt.

Questions people ask

Will Calendly sign a BAA?Calendly says it doesn't currently offer one. Its community manager wrote that in July 2026, and its help center says it does not comply with HIPAA.

Does a calendar reminder count as PHI?For a covered practice, usually yes. A reminder that ties a client's name to a therapy appointment is information about the provision of care, which is how HHS defines health information.

What scheduling software is HIPAA compliant?None is compliant on its own, since compliance is about how you use it. What you need is a scheduler that signs a BAA. Acuity on Premium, Cal.com on paid team plans, and EHRs such as SimplePractice and Jane do.

Can I use Calendly if I don't collect any health questions?Not for clients of a covered practice. Their name and the appointment type are still health information, and Calendly offers no BAA. Use it for meetings with no client information.

Is there free HIPAA-compliant scheduling software?None of the tools above has a free plan with a BAA. SimplePractice's BAA applies from the free trial, but the trial ends.