Is Squarespace HIPAA Compliant for Private Practice Booking Pages?

Short answer: A regular Squarespace website is not covered by Acuity’s HIPAA business associate agreement (BAA). Squarespace says its BAA applies to HIPAA-enabled Acuity Scheduling, not other Squarespace features. If you use Acuity to handle protected health information (PHI), you must meet its plan and account requirements, configure privacy settings, and assess any integrations. A HIPAA-enabled Acuity account does not by itself make your practice HIPAA compliant.

Is the Squarespace website covered by Acuity’s HIPAA business associate agreement?

No. Squarespace says its Acuity BAA does not cover other Squarespace features, and PHI should not be maintained or transmitted through Squarespace outside of Acuity. Embedding an Acuity booking page on a Squarespace site does not extend that BAA to the site’s forms, contact features, or other tools. Squarespace’s Acuity and HIPAA guidance explains the scope of its agreement.

Keep any PHI collection within the specific Acuity account for which the BAA has been completed. Treat website hosting, forms, analytics, and other connected features as separate services: do not assume they are covered just because your booking calendar is HIPAA-enabled. HIPAA obligations depend on your practice’s role and how you use and disclose health information; the HHS overview of covered entities and business associates explains who must comply and when a written business associate contract is required.

Which Acuity plans and agreements are required for HIPAA-enabled scheduling?

Squarespace currently identifies the Powerhouse and Premium plans as eligible for HIPAA-enabled Acuity and its BAA. You must enter into the BAA through the relevant Acuity account; Squarespace says each account needs its own agreement. Complete this step before using that account to maintain or transmit PHI. Check Squarespace’s current plan and setup requirements before subscribing or configuring an account.

To enable the account, Squarespace directs customers to Acuity’s Scheduling Page settings, where they can review and submit the BAA. Keep a copy of the signed agreement and confirm the account shows HIPAA-enabled status before adding client information. The agreement sets out the vendor relationship; it is not a certification that your organization is compliant.

How should you configure an Acuity booking page before handling PHI?

First, decide what information you genuinely need to schedule and provide care. Collect as little sensitive information as practical on the booking page, and avoid inviting clients to describe symptoms, diagnoses, medications, or other clinical details in open-ended fields unless you have assessed the workflow and safeguards for that information.

Review access to the account, staff permissions, notifications, and any connected services before accepting bookings. Use the HIPAA Security Rule safeguards and risk-management guidance to inform your assessment: the Security Rule calls for reasonable and appropriate protections for electronic PHI, including identifying and managing risks. Revisit your settings when your tools, staff, or workflows change.

Pay particular attention to appointment notification privacy settings. Acuity says some messages may include client names, email addresses, appointment types, and appointment dates and times by default. Its confirmation and rescheduling emails may also include an ICS calendar attachment with those details; Squarespace says to contact support to disable that attachment. Review the actual messages clients and staff receive, rather than relying on the booking-page settings alone. See Acuity’s notification details and account instructions.

Which Squarespace forms and contact features should private practices avoid?

Do not use standard Squarespace contact forms, newsletter forms, or other non-Acuity Squarespace features to collect PHI. Squarespace states that its Acuity BAA does not cover these features and that users should not maintain or transmit PHI through Squarespace outside Acuity. Squarespace’s HIPAA guidance describes that limitation.

A general inquiry form can be limited to non-sensitive logistics—such as a request for a callback—if you clearly tell people not to include health details. Avoid prompts that ask for a reason for treatment or other information that could reveal a person’s health. If you need to collect clinical information, use a workflow and service that your practice has assessed for that purpose, with the required agreements and safeguards in place.

What client information can appointment emails and texts reveal?

A reminder that seems routine can reveal a client’s relationship with a provider, especially when the sender name, appointment type, or message content identifies a specialty or service. Acuity warns that notifications can contain client names, email addresses, appointment types, and appointment times. It also notes that email sender and reply-to fields may show the client’s name and email address if notifications remain enabled. Review Acuity’s description of default notification content.

HIPAA does not categorically prohibit appointment reminders. HHS says they are part of treatment and may be sent without an authorization, while advising providers to reasonably safeguard privacy and limit information disclosed in messages. Use neutral wording where appropriate, review which details appear in email and text, and account for shared devices, inboxes, and calendar access. HHS guidance on appointment reminders and its guidance on limiting information in messages provide further context.

How should practices assess third-party integrations with Acuity?

Make a third-party integration risk assessment before connecting calendars, payment processors, analytics, or other tools. Determine what information each integration can access, receive, or transmit; whether PHI could flow through it; how the vendor uses and protects that information; and what contractual terms apply. Do not assume that an integration is covered by Acuity’s BAA.

Squarespace warns that many third-party integrations do not support HIPAA and places responsibility on the practice to decide whether an integration is acceptable, configure or limit its use, and arrange any additional agreements needed before using the third-party service. Read Squarespace’s guidance on third-party integrations. If you cannot establish an appropriate basis and safeguards for a connection that may handle PHI, leave it disconnected or change the workflow so PHI is not sent to it.

What HIPAA responsibilities remain with the practice?

A BAA and a HIPAA-enabled Acuity account address only part of your responsibilities. Your practice must determine whether it is a covered entity, follow applicable Privacy, Security, and Breach Notification Rule requirements, and use appropriate safeguards for PHI across its systems and operations. HHS explains that covered entities and business associates have HIPAA obligations, and that the Security Rule requires administrative, physical, and technical safeguards for electronic PHI. HHS guidance on covered entities and business associates and its Security Rule summary outline these duties.

In practice, that means assessing risks, setting and documenting policies, limiting access to people who need it for their roles, training your workforce on your organization’s procedures, and preparing to respond to security incidents. HIPAA does not make Squarespace or Acuity responsible for your complete compliance program; Squarespace says the organization remains responsible for its controls, settings, and compliance practices. Review the responsibilities Squarespace assigns to Acuity customers.

In summary, use Acuity only after meeting its plan and BAA requirements, keep PHI out of regular Squarespace features, review notifications and integrations, and maintain the safeguards your practice needs. The platform can support a compliant workflow, but your practice remains responsible for assessing and managing it.

FAQs

Does Squarespace’s BAA cover the regular website?

No. Squarespace says its Acuity BAA does not cover other Squarespace features. Do not use regular Squarespace website features to maintain or transmit PHI under Acuity’s agreement. Squarespace’s HIPAA guidance explains the agreement’s scope.

Can a standard Squarespace contact form collect PHI?

Not under Acuity’s BAA. Squarespace says the agreement does not cover its other features, including regular website functions. Keep standard forms limited to non-sensitive logistics, and direct clients not to include health details.

Does HIPAA-enabled Acuity make a private practice compliant?

No. HIPAA-enabled Acuity and a signed BAA do not make the practice compliant on their own. Your practice must also configure the account appropriately, assess risks, manage access and notifications, evaluate integrations, and meet its other applicable HIPAA responsibilities.

Can appointment notifications disclose client information?

Yes. Depending on the settings, appointment emails and texts may reveal names, contact details, appointment types, or appointment dates and times; calendar attachments may contain similar details. Review and adjust the notification settings. HHS permits appointment reminders but advises providers to reasonably safeguard privacy and limit the information disclosed.