On this page
No. As of November 11, 2026, Calendly does not sign a BAA on any plan, and its customer terms have you promise that your data contains no protected health information. A practice can still use Calendly for a short discovery call that asks no health questions. Patient visits, and any booking that asks why someone is coming in, belong in a scheduler that signs a BAA.
Checked November 11, 2026 on Calendly's own customer terms and community forum. Vendor terms change, so confirm with Calendly before any patient detail goes in.
What does Calendly say?
Two places settle it. Calendly's Customer Terms and Conditions, effective August 5, 2026, include a promise from you in section 13(d): that your customer data does not contain protected health information or information subject to HIPAA. In other words, the contract you accept when you sign up rules out the use a practice would need a BAA for.
Calendly's community manager said the same thing in plain words in July 2026: Calendly "isn't intended for collecting Protected Health Information, and we don't currently offer a BAA." The post added that it is being discussed internally, with no roadmap date.
Calendly's privacy and security help page covers encryption, SOC 2 and GDPR. It does not mention HIPAA. Security certifications are not a BAA, so they don't change the answer.
What can a practice still book through Calendly?
A booking becomes health information when it ties a person to their care. A name, email and a time slot for "Discovery call" doesn't. A name next to "Menopause consult" or "Weight-loss intake" does, because the event name itself says why they're coming.
That leaves a narrow, still useful job. Calendly works for:
- a free 15-minute discovery call with a neutral name such as "Intro call"
- calls with vendors, lab reps, referral partners or a VA you're hiring
- booking pages linked from ads, as long as the questions stop at name, email and phone
Keep out of Calendly:
- booking questions like "What brings you in?", "Current medications" or "Symptoms you'd like to discuss"
- event names that name a condition, program or treatment
- follow-up visits for existing patients, since the booking itself shows they're under your care
- routing forms that sort people by symptom or goal
- intake forms, lab requisitions or results attached to the invite
Where do practices slip up?
The common mistake is the "one helpful question." A practice sets up a neutral discovery call, then adds an optional field so the clinician can prepare: "Anything we should know before the call?" Patients answer with symptoms, medications and history. Now Calendly holds health information under terms that say it shouldn't, and the answers are copied into the confirmation email and your calendar invite.
The second slip is integrations. A Calendly booking that pushes to a CRM, a spreadsheet or Zapier copies whatever the booking holds into each of those tools. If the booking is clean, that's fine. If it carries health details, each copy needs a BAA of its own. See Is Zapier HIPAA compliant? for that half of the problem.
What to use for patient visits instead
For anything clinical, book inside a tool that signs a BAA. As of our last check:
| Option | BAA | Good fit when |
|---|---|---|
| Your EHR's scheduler | Covered by your EHR's BAA (Healthie, OptiMantra and Jane all sign one) | You already chart there and want bookings next to the chart |
| Acuity Scheduling | Premium or Powerhouse, with HIPAA turned on in settings | You want a stand-alone booking page with intake questions |
| Square Appointments | Covered as a HIPAA-enabled service in Square's terms | You already take payments through Square |
Acuity's HIPAA mode changes how it behaves: email notifications leave out form answers and some calendar syncs switch off. That is the trade for being allowed to ask health questions at booking.
A split that works for many solo practices: Calendly (or any neutral page) for the free intro call from ads, then the EHR's scheduler for the first paid consult and every visit after. The handoff happens once the person decides to become a patient, which is also when your intake form goes out. Our guide to reducing no-shows in a telehealth practice covers the reminders that follow.
A quick check of your booking page
- Open your public Calendly page as a stranger would.
- Read every event name. Rename any that say a condition, program or treatment.
- Open each event's booking questions. Delete anything beyond name, email and phone.
- Check the confirmation and reminder emails for the same words.
- List every integration on the account and what it receives.
- Move follow-ups for existing patients to your EHR or another scheduler with a BAA.
To check every tool in your stack at once, use the BAA checker or read the full table of tools that sign a BAA.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Is Calendly HIPAA compliant?
No. Calendly doesn't offer a BAA, and its customer terms (effective August 5, 2026) have customers promise their data contains no protected health information. That rules it out for any booking that carries health details.
Does Calendly sign a BAA on Enterprise?
Not as of November 2026. Calendly staff said in July 2026 that it doesn't currently offer a BAA, with no date for one, and its customer terms make no plan-level exception.
Can I use Calendly for a free discovery call?
Yes, if the call has a neutral name and the booking asks only for name, email and phone. Don't add questions about symptoms, goals or medications, and move patients to a scheduler with a BAA once they book a consult.
What is a HIPAA-compliant alternative to Calendly?
Acuity Scheduling signs a BAA on its Premium and Powerhouse plans once HIPAA is turned on. If your EHR signs a BAA and has a scheduler, booking inside the EHR is often the simplest option.