Here's a button I see on therapist websites every week: "Book a free 15-minute consult." Great button. I tell everyone to have one. Then I click it, and it opens a Calendly page with a box that says "What would you like to discuss?"
That box is a contact form. The page it's on is run by a company that, in its own words, does not comply with HIPAA. And the therapist usually has no idea, because the button works, the appointments show up, and nobody told them to look behind it.
This post is the booking-tool half of the question I covered in the 8-point contact form check. Same test, different tools. If you've already done that check, this one takes about three minutes.
(Same note as last time: I'm a web designer, not a lawyer. This is general information, not legal advice, and the fixes below are the ones I set up for clients.)
The short answer on Calendly
No. Calendly does not sign Business Associate Agreements, and its own help center says it plainly: "Calendly does not currently comply with HIPAA." That sentence is on Calendly's site as of this week. Nothing about it changes on a paid plan.
You'll find articles online with headlines claiming the opposite ("yes, on eligible plans with a BAA"). Read past the headline and they say the same thing I just did. There is no eligible plan.
"But my Calendly only asks for a name and email"
This is the question I get next, and it's a fair one. In the contact-form post, one of the fixes was to delete the "what brings you to therapy?" box, because name and email alone are contact info, not health information.
Booking is a little different. A completed booking isn't just a name and an email. It's a record that a named person made an appointment with a therapist on a specific date. The fact that someone is seeking mental health care is health information, and the appointment record is the kind of thing HIPAA is written to protect. People who do this for a living disagree about exactly where the line falls, and I'm not going to settle it in a blog post. What I can tell you is that the compliant options below cost between nothing and about fifty dollars a month, so the cautious reading is also the cheap one.
The one test
It's the same test as for contact forms. Does the company behind your booking page sign a Business Associate Agreement, and have you actually signed it? No BAA means the tool is not an option for client appointments, no matter how secure its marketing page sounds. A BAA you never signed is the same as no BAA, and that second part trips up more people than the first.
Booking tools that sign a BAA
Roughly in the order I reach for them:
1. Your EHR's client portal. If you pay for SimplePractice, TherapyNotes or Jane, they sign a BAA, and their booking pages are covered by it. One thing to check first: TherapyNotes and Jane don't sign it automatically. You have to request it inside your account, sign it and (for TherapyNotes) upload it back. I've met more than one practice that assumed this happened at signup. Go look. Then pointing your "book a consult" button straight at the portal is the cheapest fix there is, because it costs nothing and deletes a vendor from your life. The catch is the experience. Some portals make a brand-new person create an account before they can request a time, and that is exactly the login wall I tell people to remove. So before you commit, book a consult with yourself as a stranger. If it's a form and a confirmation, great. If it's a login screen, keep reading.
2. Google Calendar appointment schedules, on a paid Google Workspace plan. If your practice email already runs on Google Workspace (the paid kind, not free Gmail), you have a HIPAA-covered booking tool and may not know it. Google Calendar is on Google's list of services covered by its BAA, and appointment schedules are a Calendar feature: you set your availability, Google gives you a booking page you can link to or embed on your site, and the appointment lands on your calendar with a confirmation to the client. Business Starter is about $7 a month billed annually. Accept the BAA once in the Admin console and you're covered. This is the fix I use most often for solo practices, because it's usually already paid for.
3. Acuity Scheduling, Premium plan or higher. Acuity is owned by Squarespace and is the only Squarespace product designed for HIPAA. On the Premium plan ($49 a month billed annually, $61 monthly) or Powerhouse, you sign the BAA inside Acuity under Scheduling Page, then Settings, and turn on HIPAA mode. HIPAA mode changes real things: notification emails stop including clients' form answers, syncing to Outlook and iCloud calendars is turned off, and you get logged out after four hours. That's the tool doing its job, so expect it. If you want the booking calendar to live on the page itself rather than on a link, this is the polished option.
4. Wix Bookings, if your site is on Wix with PHI protection on. Since spring 2026, Wix signs a BAA on its Business, Plus, Elite, Business Elite and Enterprise plans, and Wix Bookings is on Wix's own list of HIPAA-supported apps. Two things have to be true: you turned on PHI protection in Compliance, Privacy & Cookies, and you signed the BAA there. Wix also warns that notes typed on a booking can contain health information, so don't use that field for intake.
5. Cal.com. The developer-friendly Calendly alternative signs BAAs on every plan, including the free one, for a $300 fee on the Individual and Team plans (included on Organization and Enterprise). Their own announcement is inconsistent about whether that $300 is one-time or monthly, so ask before you pay. A good fit if you or someone on your team is technical. Not the easiest path otherwise.
6. IntakeQ and Jotform. Both are forms-first tools that also do scheduling, and both sign BAAs (Jotform on its Gold plan, $99 a month billed annually). If you're already using one of them for intake, use its scheduling and stop looking.
Booking tools that don't
Calendly. Covered above. No BAA on any plan.
Square Appointments. Square does sign a BAA, which surprises people, but read it: data from appointment bookings is specifically carved out as something Square handles on its own terms, outside the BAA. So the booking page isn't covered even though the agreement exists.
Microsoft Bookings. Microsoft's list of services covered by its HIPAA agreement is long, and Bookings isn't on it. If you're a Microsoft 365 practice, ask Microsoft in writing before using Bookings for clients.
Most free schedulers. zcal, the booking widget that came with your newsletter tool, the one your website template suggested. Open the company's privacy policy and search for "HIPAA." If the word isn't there, that's your answer.
What I set up
For most solo practices, one of three things:
You already use SimplePractice, TherapyNotes or Jane, and its booking flow doesn't demand a login first: link to it. Done.
You're on paid Google Workspace: set up an appointment schedule, keep the booking form to name and email, embed the page or link to it. Done.
You want the calendar on the page, or you're on Squarespace and want to stay in one ecosystem: Acuity Premium, HIPAA mode on, BAA signed.
Whichever one you pick, run it through the same checks every booking button needs: one obvious button that says what it is, no login for new people, book yourself from your phone, and make sure the confirmation and calendar invite show up. Compliance is the floor. The button still has to get someone from your homepage to your calendar at 11pm without thinking.
Want me to check it?
I check the booking path on every site I work on, and most of the time the fix is a thirty-minute change, not a new subscription. If you're not sure what's behind your button, send me your website and I'll check your contact form and booking link on a free 15-minute call. I'll tell you whether it passes, and the cheapest way to fix it if it doesn't.
