Is Acuity Scheduling HIPAA Compliant? Booking Data

Yes, Acuity Scheduling can be HIPAA compliant, but only on specific plan tiers and only for Acuity itself. Squarespace's own documentation states that you must be on the Premium or Powerhouse plan to enable HIPAA-related services and enter into a Business Associate Addendum, and that the addendum does not cover other Squarespace features. Booking data is the trap most practices miss: an appointment type usually names the service, and appointment types travel through URLs, confirmation pages, calendar syncs, and ad pixels. Curve is the HIPAA-compliant tracking layer that keeps that booking signal out of Meta and Google while preserving attribution, with a signed BAA on every plan.

The direct answer, in more detail

Acuity is unusual in the scheduling category because Squarespace has published a clear position rather than leaving it to a sales conversation. The position has three parts, and all three matter.

• Plan gate. HIPAA-related services require the Premium or Powerhouse plan. Custom BAAs are available on enterprise arrangements. Lower tiers do not offer it.
• You enter the BAA yourself, in the product. The addendum is initiated from the Acuity scheduling page settings rather than through a procurement cycle, which is convenient and also easy to skip.
• Scope is narrow and stated bluntly. Squarespace's documentation says your Business Associate Addendum does not cover other Squarespace features, and that you should not maintain or transmit protected health information through Squarespace outside of Acuity.

That third point deserves emphasis because it produces a specific, common failure. A practice runs its website on Squarespace, uses Acuity for booking, and adds a Squarespace form block somewhere for a contact request or a pre-visit question. The Acuity side is covered. The form block is not, and Squarespace says so directly: contact form features cannot be used as part of a HIPAA compliant solution, and you should link out to an external compliant service instead.

What enabling HIPAA actually changes in Acuity

Turning HIPAA on is not a badge. It changes product behavior in ways that surprise teams who enable it mid-flight, so it is better to know before you flip it.

• Notification emails no longer include client form answers.
• Calendar syncing with Office 365, Outlook, iCloud, and Exchange becomes unavailable.
• The Squarespace Email Campaigns integration is disabled.
• Google Docs uploads on intake forms are disabled.
• Invoicing is unavailable.
• Sessions expire after a period of inactivity.

Read that list as a map of where PHI leaks in a scheduling product. Every disabled feature is a path that would have carried appointment or intake content into a system that has not signed anything. The calendar sync restriction is the clearest example. Syncing appointments into a personal Outlook calendar means appointment titles, which usually name the service, land in a mailbox governed by a completely different set of agreements.

Squarespace also states the obvious but important caveat: enabling HIPAA features in Acuity is not by itself compliance. Your own practices and configuration have to hold up too, including how you configure email and text notifications.

Where Acuity is genuinely fine

On a Premium or Powerhouse plan with HIPAA enabled and the addendum entered, Acuity is a reasonable scheduling system for a practice. Appointment booking, intake forms attached to appointment types, reminders, rescheduling, and client records are supported, and the restrictions above exist precisely because Squarespace thought about where the data would otherwise go.

It is also a sensible fit for the practices that pick it: solo providers, small clinics, therapy practices, med spas, and dental offices that want booking to work without an implementation project. That is a real category, and the alternative is often a spreadsheet and a phone.

The limit is the one Squarespace itself draws. Acuity is the HIPAA-eligible island inside a platform that is otherwise not HIPAA-eligible. Everything outside that island, including your marketing site and its tracking, is your problem to solve separately.

What the BAA does and does not cover here

A BAA binds a vendor to safeguard PHI, restrict how it is used, report breaches, and return or destroy data at the end of the relationship. It is a necessary condition for handing PHI to a vendor. It is not a description of your whole compliance posture, and its edges are sharper than most teams assume.

Inside the Acuity addendum: the appointment records, client records, and intake form responses that Acuity holds and processes as part of delivering scheduling.

Outside it:

• The rest of Squarespace. Form blocks, email campaigns, and site features are explicitly excluded.
• Your website's tracking scripts, including any that run on the page where you embed the Acuity scheduler.
• Third-party integrations you connect, including automation platforms and CRMs. Each is its own business associate question. Our verdict on whether HubSpot is HIPAA compliant for clinic marketing covers the CRM end of that chain.
• Payment processing, which is a separate vendor with separate terms. See our piece on whether Stripe is HIPAA compliant for patient payments.
• The scheduling page URL itself, which is not data Acuity discloses so much as data your visitor's browser broadcasts to whatever else is loaded.

Where the ad tracking problem shows up

Booking data is unusually revealing, and scheduling tools are unusually good at putting it into URLs.

A typical clinic funnel runs an ad to a landing page, the patient picks an appointment type, and lands on a confirmation page. Along that path:

• The appointment type appears in the URL or query string. A path or parameter naming a specific consultation is a clinical disclosure the moment it travels with a tracking event.
• A Meta Pixel on the booking or confirmation page sends the full page URL, plus a browser identifier that persists across sessions and sites.
• A Google tag sends the same page view with the click identifier that ties it to a specific ad, a specific campaign, and a specific person.
• Teams often create a distinct thank-you page per service line so conversions can be counted separately. That is a well-intentioned reporting decision that encodes the service into the exact event being transmitted.
• If the scheduler is embedded in an iframe, the parent page still fires its own tags, and its URL still describes the context.

Meta and Google do not sign BAAs for their advertising products. Every one of those calls is a disclosure to a vendor with no contract in place. This is the mechanism behind healthcare pixel litigation that has cumulatively crossed $100 million in settlements, including Advocate Aurora at roughly $12.225 million. The plaintiffs' theory does not require transmitting a diagnosis. It requires disclosing an identifiable person's health interest to a third party, and a booking URL naming a service does that on its own.

Say the uncomfortable part plainly: turning HIPAA mode on in Acuity does nothing about this. Acuity's controls govern Acuity's data handling. They do not govern the pixel you installed on your own site.

The architecture that works

The pattern that survives scrutiny separates the clinical record from the marketing signal, and it starts before the booking happens.

1. Generic scheduling URLs. Appointment type slugs should not name a treatment or condition. Use internal identifiers or neutral labels for anything that appears in a path or query string, and keep the descriptive name in the Acuity interface where staff see it.
2. One neutral confirmation page. Resist the urge to create per-service thank-you pages for reporting convenience. Distinguish conversions by event data you control, not by URL.
3. No client-side pixels on the booking flow. Collection moves server-side, so there is a decision point between the event happening and anything leaving.
4. Attribution carried by token, not by content. When a patient clicks from your site into the Acuity scheduler on a different domain, attribution normally breaks at exactly the moment it becomes valuable. That gap is solvable without carrying anything clinical across it.
5. Conversion signal, not description. Ad platforms learn that a booking happened and which click it belongs to. They do not learn what was booked.

Our walkthrough of HIPAA-compliant conversion tracking setup across Google, Meta, and Microsoft covers the platform-by-platform configuration, and the technical overview of conversion API architecture covers the shape of the server-side path.

How Curve handles an Acuity booking funnel

Curve is HIPAA-compliant ad tracking, attribution, and analytics for healthcare. It replaces the client-side pixels on your site with a server-side path that gives you control over the payload before anything is forwarded.

The Curve tracking script installs in place of the Meta Pixel and Google tag. Events go to Curve's US-hosted infrastructure rather than straight to the ad platforms. From there:

• Per-destination field mapping decides what forwards. Only fields you explicitly map reach a given destination, configured separately per destination. Page URLs, appointment type parameters, and query strings stay behind unless you deliberately map them. The default is that nothing goes.
• Identifiers are SHA-256 hashed to meet each platform's conversion API requirements before forwarding.
• Neutral event aliases keep the service line out of the ad account. The platform sees a generic appointment or lead event rather than one naming the treatment, so nobody browsing Ads Manager sees a condition.
• Bridge tokens preserve attribution across the click-out. When a patient leaves your site for a separate scheduling tool, the token carries the attribution across the boundary without carrying content. This is the specific problem embedded and linked schedulers create.
• PHI-pattern detection monitors payloads and flags PHI-shaped values such as SSNs, MRN-style identifiers, dates, and long numeric sequences. It is a monitoring layer that tells you when something upstream changed. The protection itself is the field mapping plus hashing.
• Offline conversion uploads close the loop for appointments that only get confirmed later in a practice management system, matching by click ID so the booking still credits the right campaign.

Clean conversions forward server-side to Meta CAPI, Google Ads Enhanced Conversions, TikTok Events API, Microsoft, LinkedIn, and GA4. Because the path is server-side, it is unaffected by ad blockers and browser tracking prevention, which usually raises measured conversion volume rather than lowering it. A signed BAA is included on every Curve plan.

Checklist for your own Acuity setup

1. Confirm the plan tier and that HIPAA-related services are actually enabled, rather than assuming someone did it during setup.
2. Confirm the Business Associate Addendum is entered and keep a record with your compliance file.
3. Read every appointment type name and slug as a stranger would. Anything that names a treatment or condition needs renaming wherever it appears in a URL.
4. Check your notification settings. Configure email and SMS reminders so they do not carry clinical detail.
5. Audit anything you connected before HIPAA mode. Calendar syncs and campaign integrations that were in place beforehand deserve a second look.
6. Inventory the tags on the page that links to or embeds the scheduler. Tag manager containers, chat widgets, session recorders, and ad pixels all count.
7. Watch the network tab through a complete test booking. Filter to the ad platform domains and read what actually leaves. This is the only step that tells you the truth.

If you run a multi-location practice, the auditing gets harder because location pages multiply the surface. Our dental marketing compliance checklist is a useful template even outside dentistry.

Frequently asked questions

Does the Acuity BAA cover my Squarespace website?

No. Squarespace states directly that the Business Associate Addendum does not cover other Squarespace features and that you should not maintain or transmit PHI through Squarespace outside of Acuity. Contact form blocks are explicitly not usable as part of a HIPAA compliant solution.

Which Acuity plans allow a BAA?

Squarespace's documentation states you must be on the Premium or Powerhouse plan to enable HIPAA-related services and enter into the addendum, with custom BAAs available on enterprise arrangements. Confirm current tiers with Squarespace before relying on this.

Why did my calendar sync stop working after enabling HIPAA?

That is intended. Syncing with Office 365, Outlook, iCloud, and Exchange is unavailable in HIPAA mode, because appointment titles carried into an external mailbox would move PHI into a system with no BAA behind it.

Can I still send appointment reminders?

Yes, but you own the content. Keep reminders to the minimum necessary, meaning time, date, and location, without naming the service or including intake answers. Notification emails in HIPAA mode already exclude client form answers.

Is embedding the Acuity scheduler safer than linking to it?

Neither is inherently safer, and both need the same audit. Embedding puts the scheduler on a page you control alongside your own tags. Linking out creates a domain boundary that breaks attribution unless you carry it across deliberately. What matters is what your tags send in either case.

Can I run conversion tracking on Acuity bookings at all?

Yes, and you should. The question is what the event contains. A neutral booking event forwarded server-side with hashed identifiers, no page URL, and no appointment type gives ad platforms what they need for optimization while disclosing nothing clinical.

Does using generic appointment names solve the problem on its own?

It removes the most obvious disclosure and it is worth doing, but it does not remove the browser identifier, the referrer, or the click ID that still tie the visit to a person and a healthcare site. Generic naming is one layer, not the whole answer.

Where to start

Acuity is a defensible scheduling choice on a Premium or Powerhouse plan with HIPAA enabled and the addendum entered, as long as you respect the boundary Squarespace draws around it. Nothing clinical belongs in the rest of the platform, and the scheduling flow needs URLs that do not describe care.

The advertising layer is the part no plan tier fixes for you. Curve handles it with server-side collection, per-destination field mapping, hashed identifiers, neutral event aliases, and bridge-token attribution that survives the click-out into a scheduler on another domain. A signed BAA is included on every plan. Run our free compliance scanner against your booking page to see what is leaving right now, or visit curvecompliance.com to walk through your funnel.

Reviewed August 2026. Vendor BAA policies change. Confirm current terms with the vendor.