Website Builders for Therapists: Booking and Privacy
Squarespace's Acuity Scheduling and Wix Bookings can both be configured for HIPAA compliance, but only on specific paid plans, only after you sign a Business Associate Agreement (BAA), and only for the specific tool the vendor names — neither platform's general-purpose contact form is HIPAA-compliant, and Squarespace says so directly. Getting this right matters more for a therapist's site than for most small businesses, since intake forms and booking requests can carry protected health information (PHI). Here's what each vendor's own documentation actually says, checked September 2026.
Can I use a regular contact form for client intake?
No — at least not on Squarespace, and the vendor is explicit about why. Squarespace's own help center states: "Form blocks sent over SSL-enabled domains are encrypted, but they can't be used as part of a HIPAA-compliant solution. To collect secure patient information, we recommend Acuity Scheduling" (Squarespace Help Center, "Form blocks", checked September 2026). Encryption in transit isn't the same thing as a compliant intake system, and Squarespace draws that line itself rather than leaving it ambiguous. Our full guide to Squarespace forms covers what a form block actually does and where its submissions go, if you're using one for anything that isn't sensitive intake.
Wix's documentation carries a similar warning for its own general forms: with old Wix Forms, "your PII and PHI data may not be as securely handled as the latest version," and Wix's guidance for a HIPAA-compliant site is to delete an old form and recreate it using current features rather than assume any form on the site automatically qualifies (Wix Help Center, "Enabling HIPAA Compliance for your Wix Site", checked September 2026). Neither vendor treats "add a form" as a compliance step on its own.
What does Squarespace document about Acuity Scheduling and HIPAA?
Acuity is the one Squarespace product built for this. Squarespace states plainly: "Acuity Scheduling is the only Squarespace feature currently designed to offer services consistent with HIPAA obligations," and adds a direct boundary: "Your Business Associate Addendum (BAA) doesn't cover other Squarespace features. You shouldn't maintain or transmit Protected Health Information through Squarespace outside of Acuity" (Squarespace Help Center, "Acuity Scheduling and HIPAA", checked September 2026).
Getting there requires a specific plan and a specific step: "You can make your Acuity account HIPAA-enabled on the Powerhouse or Premium plans," done by opening Scheduling Page settings and using the BAA link to "enter into the BAA by submitting the necessary information." A lower Acuity plan doesn't offer this option at all — check your current plan before assuming HIPAA support is available.
Worth knowing before you rely on it: Squarespace's page also notes that many third-party integrations aren't HIPAA-compatible, and that you can disable them before making the account HIPAA-enabled — meaning a HIPAA-enabled Acuity account may need you to turn off calendar syncs or other add-ons you'd otherwise use.
For general appointment scheduling — the non-PHI kind, like a free consultation call that doesn't touch health details — Squarespace's own overview describes Acuity as "a complete online scheduling solution for your business," with "calendar syncing," reminders, and payment processing, and notes plainly that "Squarespace Scheduling is now officially Acuity Scheduling" — the two names refer to the same product (Squarespace Help Center, "What is Acuity Scheduling?", checked September 2026).
What does Wix document about Wix Bookings and HIPAA?
Wix documents HIPAA compliance at the site level, not as a Bookings-only setting, and it's gated to specific plans: "Business, Plus, Elite, Business Elite and Enterprise plans" support it, on a site built with either the Wix Editor or Wix Studio Editor (Wix Help Center, "Enabling HIPAA Compliance for your Wix Site", checked September 2026). Activating it turns on "PHI protection" — tools and HIPAA-compliant hosting — and it hides visitor data that could identify individuals, such as names and locations, from parts of the dashboard. Once PHI protection is on, Wix says the App Market will surface only HIPAA-compliant apps, "including apps for bookings, forms, messaging and other tools that might collect personal info" — which is how Wix Bookings fits into a HIPAA-enabled site rather than being HIPAA-compliant as a standalone feature.
Activation itself has real friction: it's desktop-only (no mobile activation), you sign a BAA describing how Wix handles health information, and Wix's own guidance is direct about one specific booking behavior: "adding a note to a booking may contravene HIPAA regulations" if that note describes health information, so treat the booking record itself as a place PHI can leak even after the site-level setting is on. Wix also warns that "some features, apps, or tools on Wix may not be compatible with HIPAA," and that non-compliant apps get hidden once PHI protection activates, which can break functionality on a site you built before turning it on. For the booking mechanics themselves — service types, staff calendars, payment options — our guide to Wix Bookings covers what the app does independent of the HIPAA question, including the separate detail that accepting payment online (HIPAA-enabled or not) requires its own plan upgrade.
How do the two compare for a therapy practice specifically?
| Squarespace (Acuity Scheduling) | Wix (Wix Bookings) | |
|---|---|---|
| HIPAA-capable tool | Acuity Scheduling only — not other Squarespace features | Site-wide "PHI protection" setting, which then permits HIPAA-compliant apps including Bookings |
| Plan requirement | Powerhouse or Premium Acuity plan | Business, Plus, Elite, Business Elite, or Enterprise Wix plan |
| BAA required | Yes, via a link inside Acuity's Scheduling Page settings | Yes, presented after you activate PHI protection |
| Scope of coverage | Explicitly limited to Acuity; "you shouldn't maintain or transmit PHI through Squarespace outside of Acuity" | Site-wide once activated, but individual apps/notes can still fall outside compliance |
| General contact forms | Explicitly not HIPAA-compliant | Older Forms may not handle data securely; Wix recommends recreating forms with current features |
Neither vendor's page states that the other platform's tool is inferior — the difference is architectural. Squarespace scopes HIPAA support to one specific product and tells you not to use anything else on the site for PHI. Wix flips it a different way: one site-level switch, but with app-by-app exceptions and a specific warning about free-text notes on bookings.
What should a therapist check before launch?
- Confirm the plan, not just the product. Acuity's HIPAA option needs Powerhouse or Premium; Wix's needs Business or above. A lower-tier plan with the same app installed does not have this option.
- Sign the BAA before collecting anything sensitive. Both vendors require it, and it's a distinct step from just enabling a setting or upgrading a plan.
- Don't assume site-wide coverage. On Squarespace, only Acuity is covered — every other block, form, or page is out of scope for PHI. On Wix, even with PHI protection on, a free-text note field on a booking can still create a HIPAA problem.
- Route non-PHI tasks separately. A general "contact me" form for someone who hasn't become a client yet, or a newsletter signup, doesn't need the same handling as client intake — just don't let health details slide into that channel by habit.
- Recheck after any plan downgrade. If you ever move off the qualifying plan, re-verify whether the HIPAA-enabled status and its BAA are still active before you keep using the same booking flow.
Recovery path: what if I already collected something sensitive the wrong way?
If a PHI-carrying message landed in a non-compliant form or a Bookings note before you set any of this up, don't just delete it and move on — check your own legal and compliance obligations for that jurisdiction and practice type before deciding how to handle the existing record, since deletion timing and disclosure requirements vary and this guide isn't legal advice. Going forward, redirect that intake to the compliant tool (Acuity's own intake fields on Squarespace, or a HIPAA-compliant Wix app once PHI protection is active) rather than patching the old form.
Where does Figment fit in?
Nowhere for booking or PHI handling. Figment publishes a website from a Figma design through its Figma plugin; it has no scheduling system, no HIPAA-enabled mode, and no form storage of its own. A Figment-published therapist site would still need to embed Acuity, Wix Bookings, or another HIPAA-capable scheduling tool as a separate service — the compliance work described above applies to whichever booking product you connect, not to the page it's embedded on.
Bottom line: both Squarespace and Wix document a real path to HIPAA-capable booking, but neither makes it the default. Acuity needs a Powerhouse or Premium plan and its own BAA, scoped to Acuity alone. Wix Bookings needs a Business-or-above plan, a site-wide PHI protection setting, and its own BAA, with specific exceptions for things like free-text notes. Check the current plan requirement on the vendor's own page before you promise a client that intake is private.
