Acuity Scheduling and HIPAA

Making your Acuity account HIPAA-compliant.

Acuity Scheduling is designed to allow you to comply with the requirements of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. Other parts of the Squarespace platform, including contact form features like the form block, can't be used as part of a HIPAA compliant solution. To collect secure patient information online for areas outside of Acuity, we recommend linking to an external, compliant service.

This guide covers how Acuity handles Protected Health Information (PHI) as the term is understood under United States law. If you’re not in the health field, this guide probably doesn’t apply to you.

Note: Acuity is the only Squarespace feature currently designed to offer services consistent with HIPAA obligations. Your Business Associate Addendum (BAA) doesn't cover other Squarespace features. You shouldn't maintain or transmit Protected Health Information through Squarespace outside of Acuity.

You can make your Acuity account HIPAA-enabled on the Premium or Powerhouse plan.

Acuity meets HIPAA Security Rule requirements

A qualified third-party information security consultant reviewed Acuity. The consultant validated that Acuity can meet the requirements of the HIPAA Security Rule.

Make your account HIPAA-enabled

If you’re on the Premium or Powerhouse plan, you can enable HIPAA compliance for your account. If you don't have an Acuity account but want to preview the BAA, start a free trial of the Premium or Powerhouse plan. During your trial, you can download and review the BAA.

To make your account HIPAA-enabled:

1. Ensure you’re on the Premium or Powerhouse plan.
2. In Acuity, click Scheduling Page, then click Settings.
3. Below the Account Language dropdown menu, click the BAA link to begin the process of entering into a BAA.
4. Review the BAA and ensure that you understand your obligations.
5. Enter into the BAA by submitting the necessary information and clicking Submit.

Your responsibilities for HIPAA

Enabling HIPAA-related features in Acuity alone isn't enough to make you HIPAA compliant. You must also ensure your business practices and systems work with Acuity to stay in compliance.

To use Acuity in a way that complies with the HIPAA Security Rule, you must exercise responsibility when setting up your account. These responsibilities include carefully selecting the amount and type of electronic protected health information included in and excluded from text and email messages, and entering into a Business Associate Addendum (BAA) with Squarespace.

A BAA governs the use and protection of Protected Health Information exchanged between a "covered entity" and a "business associate." In this situation, if you’re a covered entity pursuant to HIPAA, then Squarespace is a business associate to you. To learn more, visit the U.S. Department of Health and Human Services site.

General requirements

• You must be on the Premium or Powerhouse plan to enable HIPAA-related services and enter into a BAA with Squarespace.
• Ensure that you’ve made your Acuity account HIPAA-enabled before maintaining or transmitting any Protected Health Information through your account.
• You must make each Acuity account HIPAA-enabled. An account only becomes HIPAA-enabled when a separate BAA is entered into for that specific account.
• You're solely responsible for ensuring that the proper controls, settings, and limitations are in place to satisfy your needs and HIPAA compliance. Each organization controls and determines its own HIPAA compliance practices, including how to implement certain controls, de-identification, and the types of information exchanged between your organization, your clients, and Squarespace. Every organization is different and has different needs, and so we provide settings to help you meet your own compliance program.

More protections for HIPAA-enabled Acuity Scheduling accounts

All Acuity accounts share most technical and security protections, but there are additional protections for HIPAA-enabled accounts:

• Email notifications we send you won’t include client form answers.
• Intake forms only accept file uploads from a local computer or device. Uploading from Google Docs and similar services is disabled.
• Clients can’t use email addresses to check the balances of package, gift certificate, or subscription codes.
• Calendar syncing with Office 365, Outlook.com, Live.com, Exchange, and iCloud isn't available. Before making your Acuity account HIPAA-enabled, disable any syncing to those services.
• Integration with Squarespace Email Campaigns isn’t available. If this integration is active, you’re responsible for disabling it before making your Acuity account HIPAA-enabled.
• Acuity's invoices feature isn't enabled.
• Integration with Reserve with Google isn't enabled.
• Subscription renewal reminder emails don’t include subscription names.
• You'll be logged out of your account after four hours of inactivity.

Remove PHI from email and text notifications

Email and text notifications may contain Protected Health Information (PHI) by default, including client names, email addresses, appointment types, and appointment dates and times. You're responsible for changing the information in messages by updating your notification settings.

To remove PHI from your appointment notifications:

• Edit your email templates and delete tags that populate personal details about the appointment.
• You can disable internal email notifications sent to you and your staff to prevent the client’s name and email address from being sent in the From and Reply-To fields.
• Edit your text reminders to delete custom tags, or use the toggles in the Show section, to exclude personal details from your reminder text message.
• Text messages sent to clients on your waitlist won’t include the appointment type or business name if your account is HIPAA-enabled.

Remove ICS calendar files from email notifications

By default, confirmation and rescheduling emails sent to you and the client contain a calendar file (ICS invite) as an attachment. This ICS invite contains the client's name, appointment type, and appointment time. To disable the ICS file attachment in your email notifications, contact us.

How do clients opt out of notifications?

Clients can opt out of marketing emails by clicking Unsubscribe. They'll continue to receive automated emails documenting completed transactions. They can opt out of text messages by replying STOP. When scheduling an appointment on a client's behalf, you can prevent notifications from being sent by omitting their email address or phone number in the appointment details.

Third-party integrations and HIPAA

Many third-party integrations don't support HIPAA. You can disable any or all of these integrations before making your Acuity account HIPAA-enabled.

If you connect Acuity to any third-party integrations, such as Google Calendar or Stripe, it's your responsibility to determine if the integration is acceptable for your business, and/or modify your use, settings, security, or information to meet your HIPAA compliance practices and obligations. It's also your responsibility to enter any new contractual agreements necessary to meet your HIPAA compliance practices and obligations. You should do all of this prior to using the third-party service.

Access your BAA

You can review or download your BAA at any time:

1. In Acuity, click Scheduling Page, then click Settings.
2. Click View and download your signed BAA.
3. Optionally, click Download as PDF to download a copy.