HIPAA-compliant scheduling software for healthcare
Healthcare teams book patients, run telehealth and take intake answers on Cal.com. We sign a business associate agreement (BAA) for that protected health information and back it with controls audited under SOC 2 Type II and ISO/IEC 27001, flawless in every audit since 2022. This page says what HIPAA asks of a scheduling tool, which plans include the BAA, and how to get one.
Last reviewed on 6 November 2026. This page is information, not legal advice.
Trusted by fast-growing companies around the world
Three facts your compliance officer can check
HIPAA is a U.S. law, not a certificate. What makes a vendor fit for it is a signed agreement and the safeguards behind it.
01
A law, not a badge
HIPAA's Privacy and Security Rules apply to covered entities and their business associates. No logo makes a vendor compliant; a signed BAA and real safeguards do.
02
A signed BAA
Cal.com signs a BAA with covered entities and business associates, making our responsibility for the PHI that passes through Cal.com a contract.
03
Audited safeguards
The controls behind the BAA are the ones audited for SOC 2 Type II and ISO/IEC 27001. Every audit since our first certification in 2022 has been flawless.
Why HIPAA matters when you run patient scheduling on Cal.com
A booking for a clinic says more than a time. Who books, with whom and why can be protected health information on its own.
01
A booking can be PHI
A patient's name next to a cardiology appointment is health information. Booking questions, intake forms and notes add more.
02
Many tools touch it
Calendars, reminders, video links and forms all carry the booking. Every vendor in that chain that handles PHI needs a BAA.
03
The gap is the violation
Sharing PHI with a vendor that has not signed a BAA breaks HIPAA's rules, however secure that vendor is.
04
Patients notice
Secure, private booking is part of the care. A reminder that leaks a diagnosis costs more trust than any fine.
Why choose Cal.com for your HIPAA-compliant scheduling
HIPAA sets the standard for protecting patient data, ensuring it’s secure in storage, transit, and use. At Cal.com, compliance is built into our platform with encryption, access controls, BAAs, and continuous monitoring to protect PHI.
HIPAA compliance is more than a checklist, it’s the foundation of trust between providers and patients, and Cal.com helps you maintain that trust effortlessly.
Why healthcare teams require HIPAA-compliant scheduling software
Patient data passes through multiple tools, booking forms, calendars, and notifications. If any of these aren’t compliant, your entire workflow is at risk.
01
Patient privacy and trust
02
Secure PHI handling
03
Reduced risk of non-compliance
04
Safe collaboration across teams
How Cal.com ensures HIPAA compliance
Our infrastructure, policies, and product features are designed around HIPAA’s Privacy and Security Rules. [Cal.com](../) gives healthcare organizations confidence that every interaction meets the required standards.
01
Signed business associate agreement (BAA)
02
End-to-end encryption
03
Role-based access control (RBAC)
04
Secure booking workflows
05
Identity and access management
06
Continuous monitoring and compliance reviews
Which plans include a BAA
The BAA is part of the plan on Enterprise and on larger Organizations, and an add-on below that.
01
Enterprise
A BAA is included at no extra cost.
02
Organizations, 15 users or more
A BAA is included at no extra cost.
03
Teams, or Organizations under 15 users
A BAA can be added for $300 per month. Talk to sales to set it up.
Proven across healthcare, sales, service, SaaS, and beyond
Cal.com is compliant with a wide range of industries, including healthcare, sales, service, and SaaS, ensuring secure and compliant scheduling for diverse use cases.
Healthcare & wellness
MedTech & life sciences
Occupational health & health services
Therapy & mental health
What to do before your review
HIPAA compliance is shared: our safeguards and BAA, your configuration and policies.
01
Sign the BAA
Talk to sales and sign the BAA before PHI enters Cal.com. Keep it with your other business associate agreements.
02
Read the evidence
Signed in, open Settings, Security, Compliance for the SOC 2 Type II report and the ISO/IEC 27001 certificate behind the safeguards.
03
Set up the workspace
Use SAML SSO, role-based access and only the integrations your BAA chain covers. Ask only the booking questions you need.
The rest of Cal.com's compliance
Each framework answers a different question. Together they cover the security of the service, the laws on the data in it, and where that data may go.
01
SOC 2 Type II
An independent auditor tests our security, availability and confidentiality controls over months, every year. Read about SOC 2.
02
ISO/IEC 27001
Our information security management system is certified to the international standard and audited to keep the certificate. Read about ISO/IEC 27001.
03
GDPR
A Data Processing Agreement with standard contractual clauses, the Data Privacy Framework for transfers, and Cal.eu for hosting in the EU. Read about the GDPR.
04
EU-U.S. Data Privacy Framework
Cal.com, Inc. is an active participant, with the UK Extension. See the entry or read why it matters.
See why our users love Cal.com
Read the impact we've had from those who matter most - our customers.
Thrilled with this scheduling app—it's a game-changer. The intuitive interface and advanced features streamline my time management. The standout, however, is the incredible support team—swift, expert responses to every query. A perfect combo for seamless scheduling and top-notch customer service. P.s. Way better than Calendly
Mickeyon TrustpilotWithout a doubt the best calendar/scheduling application I have ever used. It has all of the advanced features I need while also being insanely intuitive and straightforward for both end-users and booking recipients. Love it!!
davidvkimballon Trustpilotmore elegant than Calendly, more open than Savvycal, cal.com works and it feels just right.
flo merianon Product HuntAmazing. I've been sharing it with everyone I know. It's helped me create more events spontaneously, because of how smooth it is compared to Calendly and Harmonizely.
Benon Product Hunt
I just migrated from calendly to cal.com I'm liking it so far. I wasn't particularly displeased with calendly. It's fine. But I like that cal is OSS and my sub to calendly was coming up for renewal so I thought I'd check it out. Looks good.
Kent C. Dodds 🌌@kentcdodds on X(finally) made the move to @calcom after I couldn't find how to edit events in the calendly dashboard and I must say - dash is 10/10 Bravo @peer_rich and team (I should have moved over years ago!) OSS fam
Ant Wilson@AntWilson on XThis platform's open-source nature and flexible licensing are a developer's dream. Self-hosting and white-labeling empower personalization and seamless integration.
Ahmed Elnaggaron Product HuntVery easy to set up and start. Connected with my Google calendar without any problem. Connecting with Microsoft gives me an error. But other than that the user interface is very good.
Pankaj Dixiton Product Hunt
2 days of using @calcom is enough to never look back at calendly
Anuvesh Singh@singh_anuvesh on XOne of the best tools for scheduling and my favorite after so many other options tried.
Denison Product Huntfor the love of me, why do people still use Calendly? Just today I have seen products reference Calendly while they know of @calcom It's a no brainer for me to use , their brand is amazing, cool team + they even have more compelling features 🤷
Rotimi Best@rotimi_best on XJust gave it a go and it's definitely the easiest meeting I've ever scheduled! No context switching, no distractions, and works even better on mobile too.
Aria Minaeion Product Hunt
All your key tools in sync with your meetings
Connects to Slack, Salesforce, and 100+ more. Bookings show up where your team already works.
- Google CalendarChecks every calendar for conflicts and adds the booking.
- Zoom VideoGives each booking its own meeting link.
- SalesforceLogs the meeting on the contact and routes to the owner.
- HubSpot CRMAdds bookings to contacts and deals.
- SlackTells the team the moment a meeting is booked.
- StripeTakes payment when the slot is booked.
FramerPuts your booking page on a Framer site.
ElevenLabsGives voice agents a realistic AI voice.
LinearSets your status to out of office from your calendar.
Meta PixelMeasures bookings from your Meta ad campaigns.
UmamiCounts visits to your booking page, privately.
WhatsAppMeets your guests on a WhatsApp chat or video call.
Frequently asked questions around HIPAA compliance scheduling
The short ones are here. For anything else, ask below.
Ask a questionYes, if your organization is a covered entity or a business associate handling PHI, you will need a BAA with Cal.com. This agreement ensures that Cal.com is legally responsible for safeguarding PHI in accordance with HIPAA.
A BAA is a legal contract required under HIPAA between Cal.com and healthcare organizations (covered entities). It outlines the responsibilities of both parties in safeguarding protected health information (PHI), ensuring compliance with HIPAA regulations.
To be HIPAA-compliant with Cal.com, you'll need to sign a Business Associate Agreement (BAA). A BAA is included in the Organizations plan for 15 users or more, as well as in the Enterprise plan. If you're on a lower plan, such as the Teams plan or an Organizations plan with fewer than 15 users, a BAA can be purchased for an additional $300 per month.
A Business Associate Agreement (BAA) is included at no extra cost with the Enterprise plan and the Organizations plan for 15 users or more. For lower plans, such as the Teams plan or an Organizations plan with fewer than 15 users, a BAA can be purchased for an additional $300 per month.
To be HIPAA-compliant with Cal.com, you'll need to sign a Business Associate Agreement (BAA). A BAA is included in the Organizations plan for 15 users or more, as well as in the Enterprise plan. If you're on a lower plan, such as the Teams plan or an Organizations plan with fewer than 15 users, a BAA can be purchased for an additional $300 per month.
Yes, Cal.com offers integrations with various tools such as calendars, CRMs, EHRs, and other systems, all while maintaining HIPAA-compliant security standards. We ensure that your workflows remain compliant while easily integrating with your current tools. However, it’s your responsibility to ensure that any third-party tools or integrations you use are also HIPAA-compliant when handling PHI.
Read the originals
The law and its guidance, from the source.
- HIPAA for professionals, U.S. Department of Health and Human Services: the Privacy, Security and Breach Notification Rules.
- Business associates, HHS: when a vendor needs a business associate agreement and what it must say.
- Security at Cal.com: our controls, penetration testing and vulnerability disclosure.
Trusted by fast-growing companies around the world
Simplify HIPAA compliant scheduling. Secure every booking.
From encryption to signed BAAs, we make HIPAA compliance effortless in scheduling. Schedule a demo now to see how we can help you stay secure and compliant!
Get startedTalk to sales