Is Calendly HIPAA compliant? No. Calendly does not sign Business Associate Agreements on any plan, and its customer terms say the data you put into Calendly must not contain protected health information (PHI, meaning health details that identify a person). Healthcare practices can use Calendly for internal staff scheduling, but not for patient appointment booking that involves PHI.
Online scheduling is one of the first things patients expect from a modern healthcare practice. The problem is that one of the most popular scheduling tools cannot be used for patient appointments under HIPAA. Here is why, and what to use instead.
Why Calendly Is Not HIPAA Compliant
Calendly fails the most fundamental HIPAA vendor requirement: it will not sign a Business Associate Agreement. This applies to every Calendly plan: Free, Standard, Teams, and Enterprise. No tier, no add-on, and no custom arrangement changes this.
Calendly's own customer terms are clear. Customers promise that their data "does not contain: (x) protected health information or information subject to Health Insurance Portability and Accountability Act ("HIPAA") compliance." In plain words, you agree to keep PHI out of Calendly.
Without a BAA, letting Calendly hold your patients' PHI breaks HIPAA. HIPAA requires a written contract with any vendor that handles PHI for you (45 CFR 164.308(b) and 164.502(e)). Good security features do not change that. Calendly says it encrypts stored data with AES-256 (a strong form of encryption) and data moving over the internet with TLS 1.2 or higher. But with no BAA, Calendly has made no HIPAA promises to you about guarding patient data or telling you about a breach.
Does Scheduling Data Count as PHI?
This is where many practices make a mistake. Scheduling data can absolutely constitute PHI depending on what information is collected. Under HIPAA, PHI is health information that identifies a person, including details about the care a person gets (45 CFR 160.103). Consider what a typical patient scheduling form collects:
- Patient name + appointment type: if the appointment type is "psychiatric evaluation" or "HIV consultation," the combination of name and service type is PHI
- Patient name + provider name: if the provider is a specialist (oncologist, psychiatrist, addiction counselor), the fact that someone has an appointment with that provider can reveal health information
- Custom intake questions: many practices add screening questions to their scheduling forms. Any question about symptoms, conditions, medications, or medical history creates PHI
- Reason for visit: even a simple "reason for visit" field can generate PHI if the patient describes symptoms or conditions
Even a patient's name plus the fact that they have an appointment with your practice counts. HIPAA's definition covers information that identifies a person and relates to "the provision of health care to an individual" (45 CFR 160.103), meaning the care someone gets. So when patients book with a clinic, the booking almost always involves PHI.
What Calendly Can Be Used For
Calendly is fine for internal, non-clinical scheduling that does not involve patients or PHI:
- Staff meetings and team coordination
- Vendor meetings and sales calls
- Administrative appointments with no patient involvement
- Consultant or contractor scheduling
If you are a healthcare organization using Calendly for these purposes and keeping all patient scheduling on a separate system covered by a BAA, Calendly itself is not a HIPAA problem. The problem arises when practices use one scheduling tool for everything, including patient bookings.
The Real Risk: Custom Intake Forms
Calendly allows event creators to add custom questions to their booking forms. In healthcare, this creates a direct pathway for PHI to enter a system with no BAA. A practice might add questions like:
- "What is the reason for your visit?"
- "Are you a new or returning patient?"
- "What insurance do you have?"
- "Please describe your symptoms"
Every response to these questions becomes PHI the moment it is linked to the patient's name and appointment. That PHI now sits in Calendly's system, including its database and backups. No BAA governs how it is handled, kept, or secured. If Calendly has a data breach involving this information, no signed agreement says how fast or how fully it must tell you. Yet your practice still must tell patients and HHS (the U.S. Department of Health and Human Services) about a breach (45 CFR 164.404 and 164.408).
HIPAA-Compliant Scheduling Alternatives
Several scheduling platforms are designed for healthcare and will sign BAAs:
- Acuity Scheduling (Squarespace): offers a BAA on plans that include its HIPAA features, supports intake forms, and integrates with major calendar platforms
- SimplePractice: built for healthcare, includes scheduling, intake, and telehealth under one BAA
- Jane App: popular with allied health providers, includes online booking with BAA
- Healthie: EHR with built-in scheduling, designed for wellness and nutrition practices
- Your EHR's built-in scheduler: many EHR systems (athenahealth, Epic MyChart, DrChrono) include patient self-scheduling, which falls under the BAA you already have with your EHR vendor
For most practices, the simplest solution is to use the scheduling feature built into your EHR. You already have a BAA with that vendor, and the scheduling data stays within your system of record. If your EHR does not offer self-scheduling, Acuity Scheduling works much like Calendly and offers a BAA.
Include the scheduling tool restriction in your staff training and document the approved platform in your security policies. Staff who are used to Calendly will need clear direction on what tool to use for patient appointments versus internal meetings.
Can I use Calendly if I don't collect medical information?
Not for patients. A covered entity is a health care provider, health plan, or clearinghouse that HIPAA applies to. If your practice is one, even a name, email, and appointment time can be PHI. HIPAA counts information that identifies a person and relates to "the provision of health care to an individual" (45 CFR 160.103), and a booking with your practice fits that. Use a scheduler with a BAA for every patient booking.
Does Calendly work with HIPAA-compliant video platforms?
Calendly integrates with Zoom and Microsoft Teams for automatic meeting links. Even if you have a BAA with the video platform, the scheduling tool (Calendly) has none. PHI entered into Calendly's booking form is still exposed in a system without a BAA, even if the resulting meeting happens on a compliant platform.
Will Calendly ever become HIPAA compliant?
There is no public indication that Calendly plans to offer BAAs or pursue HIPAA compliance. Its customer terms tell customers not to put PHI in Calendly. Use a purpose-built healthcare scheduling tool instead of waiting for Calendly to change course.
Is there a way to make Calendly HIPAA compliant?
No. Unlike some tools that can be configured for HIPAA compliance (such as Google Drive through Workspace or Dropbox through Business plans), Calendly does not offer any configuration, plan, or add-on that enables HIPAA compliance. The issue is contractual. Calendly will not sign a BAA, so no technical setting can fix it.
Related HIPAA Compliance Guides
- Is QuickBooks HIPAA Compliant?
- Is WhatsApp HIPAA Compliant?
- Is Zoom HIPAA Compliant?
- Is Gmail HIPAA Compliant?
- Is Slack HIPAA Compliant?
- Is iCloud HIPAA Compliant?
- Is Dropbox HIPAA Compliant?