HIPAA GUIDES
Is Calendly HIPAA Compliant?
Short Answer
No, not for patient scheduling. In July 2026 a Calendly community manager stated that the platform is not intended for collecting protected health information and that Calendly does not currently offer a Business Associate Agreement. Without a BAA, a practice covered by HIPAA should not use it to book patients.
What Calendly Says
In a July 17, 2026 reply on Calendly's community forum, a Calendly community manager wrote that the platform is not intended for collecting protected health information and that Calendly does not currently offer a BAA. The reply said there was no committed date for one, and advised keeping personal or medical details out of invitee questions.
Calendly describes encryption and other security measures. Security features are not the same thing as a BAA. Under HIPAA, a vendor that handles protected health information for a covered practice needs a written agreement with that practice.
Why a Booking Link Counts
It is easy to think of a calendar as harmless. But a patient booking includes a name, contact details and the fact that this person is seeing your practice, often with a reason for the visit. For a covered practice, that can be protected health information.
Options for Practices
- Use Calendly only for meetings that involve no patient information, such as vendor calls or hiring
- Keep patient booking in a tool whose vendor will sign a BAA with you
- Check reminder wording, since reminders can reveal more than intended
- Ask any scheduling vendor for its BAA before you connect it to your site
A Scheduling Option With a BAA
The Aspire Builder Pro HIPAA plan includes online booking, reminders and intake forms under one signed BAA, connected to your CRM. See HIPAA compliant scheduling.
Frequently Asked Questions
Sources
This article is general information, not legal advice. Vendor plans and policies change, so confirm details with each vendor before you rely on them. Last reviewed October 10, 2026.
