On this page
No, not for the website or its forms. As of November 12, 2026, Squarespace's terms bar protected health information unless an account is designated HIPAA-enabled under a separate BAA, and its help center says Acuity Scheduling is the only Squarespace feature that qualifies. A Squarespace site is fine for marketing your practice. A form on it should not ask about symptoms, medications or health history.
Checked November 12, 2026 on Squarespace's terms of service, its help article on form blocks and its article on Acuity Scheduling and HIPAA. Confirm with Squarespace before any patient detail goes in.
What does Squarespace say?
Three of its own pages agree.
- The terms of service. Section 7.4 says you may not use the services to handle protected health information unless your account is "designated as HIPAA-enabled" and you have entered into "a separate business associate agreement with Squarespace."
- The form blocks article. Asked whether form blocks are HIPAA compliant, it answers: "No. Form blocks sent over SSL-enabled domains are encrypted, but they can't be used as part of a HIPAA-compliant solution." It recommends Acuity Scheduling for collecting patient information.
- The Acuity article. "Acuity is the only Squarespace feature currently designed to offer services consistent with HIPAA obligations. Your Business Associate Addendum (BAA) doesn't cover other Squarespace features."
So there is a Squarespace BAA, but it is for Acuity, on Acuity's Premium or Powerhouse plan, turned on per account. It doesn't reach your site, your form blocks, your email campaigns or your online store.
What can a practice site on Squarespace do?
A lot. Most of a practice website has nothing to do with patient information:
- pages about your services, your approach and what a first visit looks like
- fees and program outlines, if you publish them
- a blog and answers to common questions
- a contact form that asks for name, email, phone and a preferred time to talk
- a button that sends people to a booking page or intake form hosted somewhere that signs a BAA
Squarespace is a common choice. When we read 385 small hormone, weight-loss and functional medicine practice websites in November 2026, 15% were built on it. See what cash-pay practice websites run on.
What should stay off a Squarespace site?
- Health questions in a form block. "What symptoms are you having?", "Current medications" and "Tell us about your health goals" all collect health information. A free-text "Message" box invites it too, so label it "How can we reach you?" or drop it.
- File uploads. No "upload your recent labs."
- Form storage and notifications. A form block emails each submission to you and can send it to a Google Sheet or an email marketing tool. Whatever the form collects gets copied to each of those.
- Email campaigns by condition. A mailing list called "Menopause program" is a list of people and a health detail.
- Member areas or store products that reveal what someone is being treated for.
Where do practices slip up?
The common mistake is the "new patient inquiry" form that grows. It starts as name, email and phone. Then someone adds a dropdown, "What are you interested in?", with options for hormone therapy, weight loss and thyroid. Then a box for "Anything else we should know?" Now each submission ties a named person to a health concern, and it sits in Squarespace and in the inbox it was emailed to, with no BAA covering either.
Keep the site form to contact details. Ask the health questions one step later, in a tool that signs a BAA.
What to use for the patient step
| Step | Option with a BAA | Plan |
|---|---|---|
| Booking with health questions | Acuity Scheduling, linked or embedded | Premium or Powerhouse, with HIPAA turned on |
| Intake form | Jotform, linked or embedded | Gold or Enterprise, with HIPAA turned on |
| Intake form | IntakeQ | Listed on its paid Forms plans |
| Booking and intake together | Your EHR's scheduler and forms | Covered by the EHR's BAA |
An embedded form still belongs to the tool that hosts it. The answers go to Jotform or your EHR, not to Squarespace, which is what you want. See Is Jotform HIPAA compliant? for the setup, and our intake form guide for what to ask.
Wix takes a different approach and offers a BAA on some plans; it's in our BAA table. Moving a whole site for that reason alone is rarely worth it. Moving one form is.
To check your other tools, use the HIPAA and BAA checker.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does Squarespace sign a BAA?
Only for Acuity Scheduling, on Acuity's Premium or Powerhouse plan with HIPAA turned on. Squarespace says that BAA doesn't cover its other features, including websites and form blocks (as of November 2026).
Are Squarespace forms HIPAA compliant?
No. Squarespace's help center says form blocks can't be used as part of a HIPAA-compliant solution. Keep them to name, email and phone.
Can a medical practice use Squarespace for its website?
Yes, for marketing pages, a blog and a simple contact form. Send booking and intake to a tool that signs a BAA, such as your EHR, Acuity or Jotform on the right plan.
How do I add a HIPAA-compliant form to a Squarespace site?
Build the form in a tool that signs a BAA, then link to it or embed it on the page. The answers are stored by that tool, not by Squarespace.