Independent vendor compliance review
Is Squarespace HIPAA Compliant?
Squarespace ordinary Form Blocks are not covered for PHI. Its HIPAA path is limited to Acuity Scheduling: eligible Premium or Powerhouse accounts must become HIPAA-enabled under an account-specific BAA. That agreement does not extend to the rest of the Squarespace website.
Direct compliance answer
Squarespace HIPAA, BAA, PHI, and SOC 2 snapshot
Last checked: 2026-10-29 | Confidence: High
| Direct answer | Squarespace ordinary Form Blocks are not covered for PHI. Its HIPAA path is limited to Acuity Scheduling: eligible Premium or Powerhouse accounts must become HIPAA-enabled under an account-specific BAA. That agreement does not extend to the rest of the Squarespace website. |
|---|---|
| BAA availability | The Acuity guide lists Premium/Powerhouse eligibility and a separate BAA for each account. Custom Enterprise agreements require direct discussion. Confirm current terms with Squarespace. |
| Can it handle PHI? | Keep diagnosis, treatment and patient identifiers out of ordinary website forms and analytics. Review booking-related messages and integrations separately. |
| SOC 2 caveat | A BAA or HIPAA marketing statement does not establish SOC 2 report scope. Request the current report for the contracted product. |
| What to verify | Separate website contact collection from Acuity scheduling and any external patient intake provider. Retain the Acuity account-specific BAA before PHI collection. |
Scope of this profile
Separate ordinary website forms, Acuity booking and external patient intake; the Acuity BAA does not cover Form Blocks.
Independent research view
Squarespace plan and data-path decision checks
Use these checks with the official sources below before choosing or migrating an intake workflow.
| Review area | Vendor public signal | Buyer verification |
|---|---|---|
| Plan and agreement | The Acuity guide lists Premium/Powerhouse eligibility and a separate BAA for each account. Custom Enterprise agreements require direct discussion. Confirm current terms with Squarespace. | Separate website contact collection from Acuity scheduling and any external patient intake provider. |
| Workflow boundary | Form Blocks: not supported for PHI. Acuity: conditional on eligible plan, BAA and configuration. | Retain the Acuity account-specific BAA before PHI collection. |
| Destinations and copies | Acuity activation changes some notification, upload and integration behavior. | Test booking notifications, reminders, calendar sync, uploads and third-party destinations using synthetic data. |
HIPAA status signal
Form Blocks: not supported; Acuity: conditional
BAA public signal
Acuity only — no Form Block coverage
SOC 2 evidence signal
Verify current product report
PHI warning: Keep diagnosis, treatment and patient identifiers out of ordinary website forms and analytics. Review booking-related messages and integrations separately.
Search query answers
Is Squarespace HIPAA compliant?
Distinguish the website from Acuity. Ordinary Form Blocks are not covered for PHI; Acuity has an eligible-plan and account-specific BAA process.
Does a Squarespace BAA cover contact forms?
No. The official guide limits coverage to Acuity. Use a separately verified external intake service for PHI collection outside Acuity.
Which Acuity plan supports HIPAA setup?
The official guide lists Premium or Powerhouse. Verify current eligibility, enable the account and retain its separate BAA before processing PHI.
HIPAA, BAA, and SOC 2 summary
| HIPAA | Form Blocks: not supported for PHI. Acuity: conditional on eligible plan, BAA and configuration. |
|---|---|
| BAA | The Acuity guide lists Premium/Powerhouse eligibility and a separate BAA for each account. Custom Enterprise agreements require direct discussion. Confirm current terms with Squarespace. |
| SOC 2 | A BAA or HIPAA marketing statement does not establish SOC 2 report scope. Request the current report for the contracted product. |
| PHI risk | Keep diagnosis, treatment and patient identifiers out of ordinary website forms and analytics. Review booking-related messages and integrations separately. |
| Category | HIPAA-Compliant Forms and Intake Software |
| Last checked | 2026-10-29 |
| Confidence | High |
Public evidence and open questions
What public sources say
- Squarespace distinguishes Acuity from ordinary contact Form Blocks and recommends an external compliant service outside Acuity.
- Acuity activation changes some notification, upload and integration behavior.
What remains unconfirmed
- Your account activation and executed agreement.
- Coverage and configuration of the complete booking and external intake workflow.
What it may be used for
- A public healthcare website and general non-PHI contact information.
- Acuity scheduling only after plan, agreement and workflow verification.
What not to use it for
- Collecting patient health information through ordinary Squarespace Form Blocks.
- Assuming an Acuity BAA extends to website forms, analytics or external tools.
What to verify with the vendor
- Separate website contact collection from Acuity scheduling and any external patient intake provider.
- Retain the Acuity account-specific BAA before PHI collection.
- Test booking notifications, reminders, calendar sync, uploads and third-party destinations using synthetic data.
Safer alternatives and related profiles
Safer alternatives to consider
- Wix: distinguish eligible services from unsupported website and app features.
- Jotform: compare HIPAA-enabled plan eligibility, BAA activation and workflow controls.
- Formstack: compare Healthcare account activation, SMTP and supported integrations.
- Typeform: resolve plan wording and contracted BAA scope with Sales.
Google Forms
HIPAA: Conditional | SOC 2: Google public evidence
Microsoft Forms
HIPAA: Conditional | SOC 2: Microsoft audit evidence
Jotform
HIPAA: Conditional | SOC 2: Public evidence
Wix
HIPAA: Conditional | SOC 2: Verify with vendor
Formstack
HIPAA: Conditional — Forms Healthcare | SOC 2: Verify current product report
FAQ
Is Squarespace HIPAA compliant?
Distinguish the website from Acuity. Ordinary Form Blocks are not covered for PHI; Acuity has an eligible-plan and account-specific BAA process.
Does a Squarespace BAA cover contact forms?
No. The official guide limits coverage to Acuity. Use a separately verified external intake service for PHI collection outside Acuity.
Which Acuity plan supports HIPAA setup?
The official guide lists Premium or Powerhouse. Verify current eligibility, enable the account and retain its separate BAA before processing PHI.
Will Squarespace sign a BAA?
The Acuity guide lists Premium/Powerhouse eligibility and a separate BAA for each account. Custom Enterprise agreements require direct discussion. Confirm current terms with Squarespace.
Can Squarespace be used with PHI?
Do not use this vendor with PHI until your organization verifies BAA scope, covered services, configuration, access controls, data retention, and connected integrations.
Does SOC 2 mean Squarespace is HIPAA compliant?
No. SOC 2 evidence can support security diligence, but it does not prove HIPAA compliance, confirm BAA coverage, or approve PHI use. Review HIPAA terms, BAA scope, covered services, configuration, and intended workflow separately.
What should buyers verify before using Squarespace with PHI?
Separate website contact collection from Acuity scheduling and any external patient intake provider. Retain the Acuity account-specific BAA before PHI collection. Test booking notifications, reminders, calendar sync, uploads and third-party destinations using synthetic data.
Last checked and source notes
- Last checked
- 2026-10-29
- Confidence
- High
- Dataset rows
- 280 vendors
- Official public documentation checked October 29, 2026. Customer contracts and account settings were not inspected.
- The questions and data-path checks are ComplySaaS procurement guidance, not vendor certification.
- Squarespace — Acuity Scheduling and HIPAA; Form Block exclusion