Is Calendly HIPAA compliant? Not for patient bookings.

The short answer

What Calendly's own documents say

Start with the contract, not with blog posts. Calendly's Customer Terms and Conditions include a customer warranty, in section 13(d), that your Customer Data does not contain "protected health information" or information subject to HIPAA. In other words, the terms you accept when you sign up assume you will keep PHI out.

The same terms don't mention a Business Associate Agreement, and we could not find a Calendly page in October 2026 that offers one on any plan. Some third-party articles claim a BAA is available to Enterprise customers; others say Calendly doesn't sign them. We couldn't confirm either from Calendly itself. If you are considering Calendly for patient scheduling, ask Calendly in writing whether it will sign a BAA for your plan, and get the signed agreement before you book a single patient. Until then, treat it as not covered.

Why a booking tool can hold PHI at all

People are sometimes surprised that a calendar needs a BAA. Under HIPAA, protected health information is any individually identifiable information about a person's health, care or payment for care held by a covered entity or its business associate. A booking that says "Maria Lopez, Tuesday 3 pm, initial evaluation with Dr. Patel, Lakeside Physical Therapy" identifies a person and shows they are receiving care at a named practice. That is PHI, even without a diagnosis. Add an intake question such as "reason for visit" and it is clearly PHI.

So the question isn't whether Calendly is secure; Calendly publishes its security practices on its security page. The question is whether the vendor agrees, by contract, to the obligations HIPAA puts on business associates. Without a BAA, a covered entity can't hand PHI to it.

If you already use it

Reducing risk if Calendly is already in your workflow

• Strip the questions. Remove any booking question about reason for visit, symptoms, medications or insurance.
• Use neutral event names. "Call with our team" says less than "Botox consultation" or "Depression intake".
• Check the integrations. Calendly passes bookings to your calendar, video tool and CRM. Each of those needs its own BAA if PHI flows through it.
• Move patient booking to a covered tool. The cleanest fix is a scheduler whose vendor signs your BAA, so the booking, the intake form and the record live under one agreement.

Calendly alternatives that sign a BAA

Practice-management systems such as SimplePractice and Jane App include scheduling and offer BAAs; our HIPAA scheduling comparison lists who signs what, in the vendors' own words. JBMOnboard360 is another option for clinics, med spas and wellness groups that want scheduling, booking requests, intake forms with QR codes and the client record under one Business Associate Agreement, included on every plan and hosted on AWS in the United States. Professional is $79 per user per month billed annually ($99 monthly); Business is $399 per location billed annually ($499 monthly) with unlimited users.

Be clear on the limits: JBMOnboard360 is not an EHR, it doesn't take US card payments, and it doesn't send SMS reminders. If text reminders are essential to your no-show rate, a practice-management system with texting may suit you better.

One note on our own site: we use Calendly for the free consultation below. That's a sales call with a business owner, not a patient booking, which is exactly the "fine" row in the table above.