Scheduling becomes a healthcare data flow when an identifiable person is linked to a service, clinician, appointment reason, intake answer, or reminder. The table separates a contractual prohibition from the two documented BAA paths in this directory.
| Vendor | BAA | Plan or arrangement | Verdict |
|---|---|---|---|
| Calendly | No documented healthcare path; terms prohibit PHI | Not applicable | No |
| Acuity Scheduling | Yes | Powerhouse or eligible legacy arrangement | Conditional |
| Square Appointments | Yes | HIPAA-enabled Appointments services | Conditional |
Conditional: a BAA-backed scheduler still needs setup
Acuity and Square Appointments both document a BAA path, but neither agreement should be treated as coverage for every connected screen or company. Acuity requires the eligible account and healthcare settings, with particular attention to email content, calendar attachments, forms, payment, and integrations. Square Appointments is included among Square’s HIPAA-enabled seller services, while Buyer Services and other independently controlled products sit outside that same boundary. For either option, keep appointment names and reminders minimal, use managed staff accounts, review calendars and integrations separately, and run fictional bookings through confirmation, rescheduling, cancellation, payment, exports, and deletion before opening the workflow to patients.
No: keep PHI out of Calendly
Calendly’s public terms prohibit PHI in Customer Data. That makes it different from a product that simply needs another setting or higher subscription. A generic non-clinical calendar may still be used only if the practice keeps health information out and has a procedure for accidental disclosures. Do not ask for symptoms, diagnosis, insurance, or appointment reasons, and remember that event titles, free text, reschedule notes, notifications, calendar sync, and automations can reveal context. Connecting Calendly to a video service that has a BAA does not change the information Calendly processes. When a booking must carry patient details, use a scheduler with an explicit contract and covered workflow instead.
Choosing among them
Start by deciding whether scheduling needs clinical details at all. A generic appointment request followed by protected intake can reduce exposure. If information must remain attached to the booking, compare the exact Acuity or Square plan, BAA, product scope, notification behavior, and connected calendar. The vendor directory contains the full source-based review for each option.
