Last updated: November 9, 2026 · By Alex Sandev, Founder of HiveSourced. This is general information, not legal advice.
Short answer: no scheduling tool is “HIPAA compliant” on its own. What matters is whether the vendor will sign a business associate agreement (BAA) that covers the scheduling features you use, and whether you set the tool up so that it only collects what you need. If a vendor will not sign a BAA, do not put client information into it.
This guide walks through how to check your booking tool, what a BAA is, and what to leave out of reminders and intake fields. It describes the rules in general terms and links to the official sources, so you can confirm the details for your own practice.
Key takeaways
- A scheduling tool is only safe for client information if the vendor signs a BAA and you configure it correctly.
- Ask for the BAA before you load any client names, emails or notes into the tool. Read what it covers, not just that it exists.
- A “HIPAA” badge on a vendor’s website is marketing. The signed agreement and your settings are what count.
- Keep reminders and booking forms minimal: a time and a link, not a diagnosis, service type or clinical detail.
- Your website’s booking page needs the same care as the tool behind it. See HIPAA compliant emails and forms for therapists.
What does HIPAA compliant scheduling software actually mean?
HIPAA is a set of federal rules for how health information is used and protected. A therapist who bills insurance electronically is generally a covered entity, and a vendor that handles protected health information (PHI) for you is generally a business associate. HHS explains the relationship, and the contract requirement, on its business associate contracts page.
A booking tool can hold PHI more easily than people expect. A client’s name plus the fact that they booked a therapist is health information. So is an email thread about why they want to book. If the tool stores or sends any of that on your behalf, treat the vendor as a business associate.
Whether your practice is a covered entity depends on how you bill, so ask your attorney or professional association if you are not sure. Either way, the habits below protect your clients.
What is a BAA, and why does it matter for booking tools?
A business associate agreement is a written contract between you and a vendor. Under HIPAA, a covered entity must get satisfactory assurances that the vendor will safeguard PHI, and the contract has to include the elements listed in 45 CFR 164.504(e). HHS publishes sample BAA provisions that show those elements.
HHS also applies this to cloud services. Its guidance on HIPAA and cloud computing says a cloud provider that creates, receives, maintains or transmits electronic PHI for you is a business associate, even if the data is stored in encrypted form and the provider cannot read it. Most online scheduling tools are cloud services.
So the first question for any scheduling tool is simple: “Will you sign a BAA, and does it cover the booking, reminder and storage features I plan to use?” If the answer is no, or the answer is vague, choose a different tool.
How do you check a scheduling tool before you use it?
Work through these steps in order. Do not skip ahead to features, because a missing BAA ends the conversation.
- Ask for the BAA in writing. Get the actual agreement, not a line on a pricing page. Note which plan it applies to, since some vendors only sign BAAs on higher tiers.
- Read the scope. Check whether it covers the booking page, reminders by email and text, calendar sync, video links and any file uploads you use.
- Check the vendor’s own HIPAA page. Read what it says about encryption, access controls and what it does not cover. Describe nothing as compliant that the vendor itself does not.
- Look at sub-processors. Text messaging, email delivery and video often come from other companies. Ask whether the BAA reaches them.
- Set up user accounts properly. Give each person their own login, and remove access when someone leaves.
- Test the client side. Book a test appointment and look at every email, text and page a client sees.
- Write down what you chose. Keep the BAA and your settings in your compliance folder, and review them each year.
What should you check besides the BAA?
| Area | What to look for | Why it matters |
|---|---|---|
| Encryption | Data protected in transit and at rest, as the vendor describes on its own security page | Limits exposure if something is intercepted or lost |
| Access controls | Separate logins, role limits, and the ability to remove users | Staff should only see what they need |
| Reminder content | Settings that let you strip names, service types and locations from messages | Messages can be read by anyone who sees the phone or inbox |
| Intake questions | Fields you can turn off, so you only collect what you need | Less stored data means less to protect |
| Calendar sync | Whether synced events show client names or details on other calendars | Personal and shared calendars often leak details |
| Tracking scripts | What analytics or ad pixels run on the booking page | See Google Analytics and HIPAA and HHS guidance on online tracking |
| Data export and deletion | How you get your data out if you switch tools | You do not want to be locked in |
What can go wrong with a general-purpose booking tool?
General scheduling tools are built for any business, so their defaults are rarely tuned for health information. These are common problems to look for in your own setup.
- No BAA is available at all. Some free or low-cost plans do not offer one. Using them for client bookings is a risk even if the tool is well made.
- Reminders reveal too much. A text that names the clinician, the practice or the type of visit tells a bystander more than it should.
- Intake fields collect clinical detail. “Why are you seeking therapy?” in a booking form puts sensitive notes in a place you may not have secured.
- Calendar events carry names. A client’s name in an event title can show up on a phone lock screen or a shared family calendar.
- The booking page runs tracking scripts. Ad pixels on a page where someone books therapy can send information to third parties.
- Several tools, one workflow. A form tool, a calendar and a reminder service each need their own review and agreement.
How should you word reminders and booking forms?
A reminder only has to help the client show up. Keep the message short, and leave out anything that says what the visit is for.
| Instead of this | Use this |
|---|---|
| “Hi Sam, your EMDR session with Dr. Lee at Calm Path Therapy is tomorrow at 3 PM.” | “You have an appointment tomorrow at 3 PM. Reply C to confirm.” |
| “Tell us why you want therapy” as a required field | A short note field marked optional, with a line saying not to include clinical detail |
| Calendar title “Sam Rivera, anxiety session” | Calendar title “Appt” or the client’s initials, as your policy allows |
Ask clients how they want to be reached, and note it in their record. Some people do not want texts at all, and a missed text is better than an exposed one.
Do you need a separate tool, or can your practice management system handle it?
Many therapists use the booking feature inside their practice management or electronic health record system, so scheduling, notes and billing sit under one agreement. Others use a separate tool and connect it. Both can work. What matters is that each piece that touches client information is covered by a BAA you have read, and that the booking page on your own website matches the tool behind it.
If you are weighing a platform’s built-in website against your own, see our comparison of SimplePractice websites and custom therapist websites. Whichever route you choose, your booking link should sit on a page that is clear, fast and not loaded with tracking.
How should your website handle booking?
- Link to the booking tool from your contact page and every service page, with plain wording such as “Book an intro call”.
- Put a short privacy note near the button explaining what the form collects and that you do not need clinical detail to book.
- Keep analytics and ad pixels off the booking step, and do not pass names or emails in page addresses.
- Add a crisis line to the page. The 988 Suicide and Crisis Lifeline is for people in distress, and a booking form is not the place for them to wait.
- List the pages you need in one place. Our guide to the pages every therapist website needs covers where booking fits.
How does HiveSourced handle booking on a client site?
Every HiveSourced build includes a HIPAA-compliant contact form, and we help you connect the booking tool you have chosen to your site without extra tracking on the booking step. We do not store or process protected health information ourselves. Your practice stays responsible for the tool you choose and the BAA you sign. See custom websites for therapists and pricing, or tell us about your practice.
Frequently asked questions
Is there any HIPAA compliant scheduling software that needs no BAA?
No. If a vendor stores or sends client information on your behalf, HIPAA expects a BAA. A tool that will not sign one should not hold client information.
Does a “HIPAA compliant” badge on a vendor’s site mean I am covered?
No. A badge is a claim. The signed BAA, the plan it applies to and your own settings decide whether you are covered. Read the vendor’s own HIPAA page and the agreement.
Can I use a free scheduling tool for therapy appointments?
Only if the vendor offers a BAA on that plan. Many free plans do not. Check before you enter any client details.
Do appointment reminders have to be encrypted?
Texts and standard email are not encrypted end to end, so keep reminders minimal: a time and a way to reply, with no clinical detail. Ask your advisor what your practice needs.
Is Google Calendar fine for client appointments?
It depends on the account type, the agreement in place and what you put in each event. Use initials or a neutral title, and confirm with your advisor.
Where can I get help setting up booking on my website?
Reach out through our contact page and we will talk through your booking setup and what your site needs.
