On this page
Partly. As of November 12, 2026, Square's terms include a HIPAA business associate agreement that applies where Square acts as your business associate, and it names Square Appointments and Invoices as examples. You don't sign anything extra. But Square says not every service is HIPAA-enabled, and its consumer services are outside the BAA, so the answer depends on which parts of Square you use and how.
Checked November 12, 2026 on Square's HIPAA Business Associate Agreement (last updated March 16, 2026) and its help article on HIPAA requirements. Read the BAA yourself before patient details go into Square.
What does Square say?
Square's BAA is "incorporated into the terms governing your use of Square's services." Its help article puts it this way: if you are subject to HIPAA and your use of Square causes it to handle protected health information for you, "then you agree to the HIPAA Business Associate Agreement." There is no form to request and no plan to upgrade to.
The scope is narrower than that sounds. The BAA covers the services and setups where Square is acting as your business associate, "including when you use Square Appointments, Invoices, or other features" Square has identified as HIPAA-enabled. It then adds two limits:
- "Not all Services are HIPAA-enabled," and whether one is depends on how it is configured and used. Checking that is your job.
- Services Square offers directly to consumers are excluded. The BAA lists Square Go, Square Profile, Square Pay and Square Local Offers.
Is Square Appointments HIPAA compliant?
Square names Appointments in its BAA, so a practice that books patient visits there has a BAA in place for that use. That is more than Calendly offers; see Does Calendly sign a BAA?
The BAA doesn't set the product up for you. Before you book patients:
- Name services plainly. "New patient consult" and "Follow-up visit" are enough. A service called "Hormone pellet follow-up" puts the reason for the visit into every confirmation and reminder.
- Read each reminder. Email and text reminders repeat the service name. Send yourself one and look at it on a locked phone screen.
- Keep booking questions short. Appointments is named in the BAA, but intake belongs in an intake form or your EHR, where the answers sit next to the chart.
- Mind the consumer side. Square says data from its consumer services falls outside the BAA. Ask Square how that applies if your patients book or pay through a Square consumer account.
Is Square HIPAA compliant for payments?
Taking a card payment is a different question from storing health information. HIPAA exempts payment processing by financial institutions, which is why a practice can take payments through a processor with no BAA at all, as long as nothing clinical travels with the payment. We explain that exemption in our guide to Stripe payment links.
Square's BAA doesn't name card processing or Point of Sale. It names Invoices, which matters because an invoice carries words, not just an amount. In practice:
- Item and invoice names: "Initial consult," "Lab fee," "Program month 2." Never the condition, the test or the treatment.
- Notes and memos: leave them empty or administrative.
- Receipts: check what the patient's receipt shows, since it goes to their email or phone.
- Customer directory: names and contact details only. Clinical notes go in the chart.
For the order of payment and booking, see how to collect lab fees before the consult.
What isn't settled by the BAA?
Square's BAA text doesn't mention Square Marketing, Square Messages or Square Online. We can't tell you they are covered, and Square says it is on you to check each service. Until Square confirms in writing, treat them as tools with no BAA: no campaigns built on a patient list by program, and no clinical back-and-forth in Messages.
Apps you connect to Square are separate vendors. A form tool, an email tool or an automation that reads Square customers or invoices needs its own BAA. See Is Zapier HIPAA compliant?
Square, Stripe or your EHR?
| Option | BAA | Good fit when |
|---|---|---|
| Square | In its terms, for HIPAA-enabled services such as Appointments and Invoices | You want booking and payment in one place outside the EHR |
| Stripe | None published | You only need payment links, with generic names |
| Acuity Scheduling | Premium or Powerhouse, with HIPAA turned on | You want a stand-alone booking page with intake questions |
| Your EHR's billing and scheduler | Covered by the EHR's BAA | You want payments and visits next to the chart |
To check the rest of your stack, use the HIPAA and BAA checker. For Stripe, see Is Stripe HIPAA compliant?
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does Square sign a BAA?
Square's HIPAA BAA is part of its terms, so there is nothing separate to sign. It applies where Square acts as your business associate and names Appointments and Invoices (as of November 2026).
Is Square Appointments HIPAA compliant?
Square names Appointments in its BAA as a service where it can act as your business associate. You still have to keep service names, booking questions and reminders free of clinical detail.
Can a medical practice take payments with Square?
Yes. Keep item names, invoice text and notes generic, such as "Consult" or "Lab fee," so no health detail travels with the payment.
Does Square's BAA cover every Square product?
No. Square says not all services are HIPAA-enabled, and its consumer services, including Square Pay and Square Go, are outside the BAA. Ask Square about any product the BAA doesn't name.