Is Calendly HIPAA Compliant? Why It Falls Short and 4 HIPAA Compliant Scheduling Software Alternatives

Calendly is a great tool for booking sales calls. For booking patients, it falls short. Calendly does not sign a Business Associate Agreement (BAA) on its standard plans, and HIPAA requires a signed BAA before any vendor can handle protected health information (PHI) for a covered entity. If your practice schedules patients, you need software built for healthcare, with a signed BAA, access controls, and audit logging.

Quick answer: Calendly is not HIPAA compliant for PHI because it does not offer a BAA on standard plans. SimplePractice, Jane App, Acuity Scheduling (Premium or Powerhouse plan), and Zocdoc are healthcare-ready alternatives.

Why Isn't Calendly HIPAA Compliant?

Calendly was designed for general business scheduling. HIPAA says a covered entity must sign a BAA with any vendor that creates, receives, maintains, or transmits PHI on its behalf. Calendly won't sign one for standard plans, so using it to book patients puts your practice out of step with the HIPAA Privacy and Security Rules.

Here's where practices get tripped up. The calendar feels harmless. The risk lives in what rides along with each booking.

A booking page that asks for a name, phone number, and email is already collecting identifiers. Add a service type like "IOP admissions call" or "couples therapy consult," and that record now tells anyone who sees it that a specific person is looking for behavioral health care. That's health information attached to a name.

I spent years in direct clinical work with kids and families before I moved into marketing. Families shared things with me at their most vulnerable, and the first thing they ever shared was usually just a name and a time. That moment deserves the same protection as the session itself.

Regulators see it the same way. The Department of Health and Human Services (HHS) Office for Civil Rights treats appointment information that identifies a person and relates to their care as PHI. A booking is part of the care record the minute it exists.

HHS puts it plainly: "The HIPAA Rules permit a covered entity to disclose PHI to a business associate if the covered entity obtains satisfactory assurances, in the form of a contract or other written arrangement (collectively referred to as a 'business associate agreement,' or BAA), that the business associate will appropriately safeguard the information, among other obligations." (HHS, Business Associates guidance)

What Does HIPAA Actually Require From a Scheduling Tool?

A HIPAA compliant scheduling tool supports administrative, physical, and technical safeguards, and its vendor will sign a BAA. The BAA gets you in the door. Compliance also depends on whether the software gives your team the controls to use it safely every day.

Before you choose a platform, check for these:

• Signed BAA: The vendor commits in writing to its responsibilities for PHI, including breach notification.
• Encryption: Data is encrypted in transit and at rest.
• Access controls: Every staff member gets a unique login, role-based permissions, and automatic session timeouts.
• Audit logs: The system records who viewed or changed a record, and when.
• Secure reminders: Text and email reminders leave out diagnosis and service details.
• Data handling terms: The vendor spells out how long data is kept and how it gets deleted.

Ask each vendor to walk you through every item in plain language. If they can't, you have your answer.

Can You Use Calendly With Patients If You Remove the Sensitive Fields?

I hear this one a lot. A practice keeps Calendly, collects only a name and email, and moves everything else into a secure portal. It lowers the risk. It doesn't remove it, and it's hard to hold the line day to day. A name plus an appointment with a mental health or addiction treatment provider can still count as PHI.

The workaround also asks every staff member and every patient to get it right, every time. Patients type symptoms into free-text boxes because they want to be understood. Staff paste notes into confirmation emails because they're moving fast. One slip, and there's an unprotected record sitting on a platform with no BAA.

My take: if your scheduling touches patient identity at all, use a tool built for it. A compliant platform costs a few dollars a month. A single violation can cost far more, along with the trust of the people who reached out to you.

Why Does This Matter for Your Practice?

It matters because the exposure comes from three directions at once: federal regulators, state regulators, and your own patients. I'm sharing this so you can plan clearly, and so a scheduling shortcut never becomes the thing that puts your program at risk.

Federal penalties from HHS

The HHS Office for Civil Rights enforces HIPAA with civil money penalties tiered by how much the practice knew and how quickly it fixed the problem. As of the inflation adjustment effective January 28, 2026, the ranges per violation are:

Under a 2019 enforcement discretion notice, OCR has applied lower annual caps to the first three tiers, starting at $36,505.50 for Tier 1. That's a policy choice, and it can change. (HIPAA Journal, 2026 penalty update)

Using a scheduler with no BAA after reading an article like this one is the kind of fact pattern that moves a practice out of Tier 1. Once you know, "we didn't know" stops being available.

State attorneys general

The HITECH Act gave state attorneys general the authority to bring HIPAA cases on behalf of the residents of their state. A practice can end up answering to its state and to HHS for the same incident.

Patients can sue you

HIPAA itself has no private right of action, so a patient can't file a lawsuit "under HIPAA." Patients can sue under state law, though, and courts often look to HIPAA as the standard of care. Common claims include negligence, invasion of privacy, and breach of confidentiality. (HIPAA Journal, Can a Patient Sue for a HIPAA Violation?)

Some states go further. California's Confidentiality of Medical Information Act (CMIA) lets a patient recover $1,000 in nominal damages for a negligent release of medical information without proving they were harmed at all, plus any actual damages. Multiply that by every patient who booked through an unprotected page and the math gets serious fast.

Class actions over patient data are already common. Mass General Brigham paid $18.4 million to settle a lawsuit alleging its websites shared visitor data with third parties through cookies and tracking tools without consent. (HIPAA Journal) That case involved tracking technology, and scheduling data travels through the same kind of third-party tools.

Trust you can't buy back

The fine is the part you can budget for. The harder cost is the person who finally reached out for help and later learned their booking wasn't protected. In behavioral health, privacy is often the reason someone waited so long to call. Protecting the booking is how you honor that.

I'm a marketer with a clinical background. For legal advice on how these rules apply in your state, talk to your healthcare compliance counsel.

What Are 4 HIPAA Compliant Scheduling Software Alternatives to Calendly?

Each of the four tools below is built for healthcare or offers a plan with a signed BAA. They fit different kinds of practices, so start with how your team actually works and let that pick the tool. The longest feature list rarely wins. Confirm current BAA availability, plan requirements, and pricing with each vendor before you sign.

1. SimplePractice

SimplePractice is the practice management platform I see most often with therapists and group practices. Scheduling sits right next to notes, billing, and a client portal, so patient information stays inside one governed system. If you're a clinician making the leap into private practice and you want fewer moving parts, start here.

2. Jane App

Jane App is made for clinics with several practitioners and disciplines under one roof. It handles online booking, staff schedules, waitlists, and automated reminders, with charting and billing in the same place. Group practice owners tend to love how it juggles many calendars at once.

3. Acuity Scheduling (Premium or Powerhouse Plan)

Acuity is a flexible scheduler that will sign a BAA on its Premium and Powerhouse plans. It works well for practices that want a branded booking page and custom intake questions without committing to a full electronic health record. Pay close attention to the plan name. The lower tiers are the ones without a BAA, so double check you're on an eligible plan and that HIPAA mode is turned on in your account.

4. Zocdoc

Zocdoc pairs booking with patient discovery, which sets it apart from the other three. It can put your practice in front of people who are actively searching for care. The tradeoff is real, though. You're renting visibility from a marketplace, and that visibility leaves when the subscription does. Weigh it against building search presence you own.

How Do You Choose the Right HIPAA Compliant Scheduler for Your Practice?

Start with how much of your workflow you want living in one system. A solo therapist and a 40-clinician group practice need very different things, and the wrong fit creates friction your patients will feel.

Work through these questions:

• Do you need full practice management, or only booking? If you already have an EHR, a standalone scheduler with a BAA may be all you need.
• Who does the booking? Patients, staff, or both. Make sure the staff side is as secure as the patient-facing page.
• What do your reminders say? Messages should show the time and provider only. No diagnosis, no program name.
• Does it connect cleanly to your website? Booking should feel like part of your site. A clunky handoff loses people right at the moment they're ready.

That last question is where scheduling meets marketing, and it's the one I care about most. Picture a mom who finally works up the courage to look for help for her son at 11pm, after the house is quiet. She should be able to book in a few taps without hunting for a phone number. A compliant tool hidden behind a footer link won't reach her.

What Should You Do After Switching Away From Calendly?

Give the switch the attention of a small compliance project. Moving to a new platform without closing out the old one leaves a gap.

Here's the checklist I give practices:

• Export and review existing bookings. Flag any records that contain PHI.
• Request deletion. Ask Calendly to remove patient data you no longer need, and keep a record of the request.
• Update every booking link. Check your website, Google Business Profile, email signatures, and social bios.
• Retrain staff. Write down which fields are allowed and which details never go into confirmations.
• Sign and file the new BAA. Store it where your compliance lead can find it fast.

Old booking links are one of the most common leaks I find in audits. A Google Business Profile still pointing to a Calendly page will keep sending patients into the unprotected flow for months after you've moved on.

Compliance is an ongoing practice. Revisit your scheduling workflow any time you add a tool, open a location, or create a new staff role.

Frequently Asked Questions About HIPAA Compliant Scheduling Software

Does HIPAA apply to appointment scheduling?

Yes. Appointment details that identify a person and relate to their care are PHI. A covered entity must protect that information and have a BAA with any vendor that handles it.

Is a BAA enough to make a tool HIPAA compliant?

No. A BAA is required, and it's only one piece. The practice still has to configure the tool correctly, limit access, train staff, and keep sensitive details out of reminders.

Can patients sue a practice over a HIPAA violation?

Not under HIPAA directly, because HIPAA has no private right of action. Patients can sue under state laws for negligence, invasion of privacy, or breach of confidentiality, and some states, like California, allow statutory damages without proof of harm.

Can I use a general scheduler if I never collect clinical information?

It's risky. A name and contact details tied to an appointment with a behavioral health provider can still be PHI. A healthcare-built tool takes the guesswork away.

Key Takeaways

• Calendly does not offer a BAA on standard plans, so it isn't a safe choice for patient scheduling.
• HIPAA requires a BAA before any vendor handles PHI for a covered entity, and the BAA is one part of compliance.
• Appointment data that identifies a person and relates to their care can be PHI, even with no clinical notes attached.
• SimplePractice, Jane App, Acuity Scheduling (Premium or Powerhouse plan), and Zocdoc are four healthcare-ready alternatives.
• Exposure comes from HHS penalties of up to $2,190,294 per year per provision, state attorneys general, and patient lawsuits under state law.
• Pick a scheduler by workflow fit: full practice management, flexible booking, or patient discovery.
• Reminders should show the time and provider only.
• After switching, delete old patient data, update every booking link, and retrain your team.

By Ash Castro, MCM, founder of The Purpose Pilot. Ash started in direct clinical work with children and families before moving into healthcare marketing. Today she and her team build websites, SEO, paid media, and social presence for treatment centers, group practices, and therapists in Los Angeles and beyond, with compliance built in from day one. Last updated: October 2026