Guide · Online Booking
A HIPAA badge is not a signed BAA — five booking vendors will put it in writing, two won't say
Seven scheduling tools advertise HIPAA support, but only five confirm they'll sign a Business Associate Agreement — and the cheapest of those starts at $5 a seat.
If you handle protected health information — a med-spa, a therapy practice, a physiotherapist taking online bookings — “HIPAA” on a pricing page does not make you compliant. What makes you compliant is a signed Business Associate Agreement (BAA): the contract that legally puts the vendor on the hook for the patient data flowing through their software. A booking tool can have every encryption feature in the world and still leave you exposed if it won’t sign that paper.
In our 17-vendor online-booking dataset, seven flag HIPAA support. Only five of those seven will confirm a BAA. The other two advertise HIPAA as a feature and go quiet on the contract. That distinction is the whole question, so here is who lands on which side, with the real entry price for each.
The five that will sign — cheapest seat first
| Vendor | BAA confirmed | Tier where HIPAA lives | Published price |
|---|---|---|---|
| Setmore | Yes (via Setmore Health) | Pro | $5/user/mo annual ($12 monthly) |
| vcita | Yes — “HIPAA Compliant + BAA” | All tiers (Kickstart up) | $35/seat/mo annual |
| GReminders | Yes — “HIPAA Compliance w/ BAA” | Professional | $39/user/mo annual ($47 monthly) |
| Acuity Scheduling | Yes — “Sign BAA for HIPAA compliance” | Premium | $49/mo annual ($61 monthly) |
| Vagaro | Yes — signs its standard BAA | Quote-only | Not published |
The cheapest confirmed-BAA seat in the dataset is Setmore Pro at $5/user/mo billed annually ($12/user/mo month-to-month), with HIPAA delivered through its Setmore Health offering — though Setmore Health’s own pricing isn’t publicly listed, so treat the $5 as the booking layer, not the all-in compliant cost.
vcita is the one that doesn’t gate HIPAA behind its top tier: “HIPAA Compliant + BAA” is listed on all three plans, starting at its Kickstart tier at $35/seat/mo (annual rate). Note vcita also carries a $150 setup-session fee, with Kickstart including zero free sessions — the only vendor here charging a published setup fee at all.
GReminders confirms a BAA on its Professional tier at $39/user/mo annually ($47 monthly), and is the only vendor whose dataset entry includes a dedicated HIPAA/BAA documentation page rather than a one-line pricing-card claim. Acuity offers “Sign BAA for HIPAA compliance” on its Premium tier at $49/mo billed annually ($61/mo month-to-month) — flat-priced, not per-seat, so the number doesn’t climb as you add staff calendars (Premium covers up to 36).
Vagaro rounds out the five: its own support documentation states it signs a standard BAA with covered entities, so the contract is confirmed even though no live USD subscription price could be read from its page — treat Vagaro as quote-only on price, settled on compliance.
The two that flag HIPAA but won’t confirm the paper
| Vendor | HIPAA claim | BAA | Entry price |
|---|---|---|---|
| GlossGenius | HIPAA Compliance via Forms & Waivers (Gold+) | Not stated | Gold $48/mo annual ($56 monthly) |
| Fresha | HIPAA listed alongside ISO/GDPR | Not stated | Not published (EUR-only page) |
GlossGenius markets a “HIPAA Compliance” option, but it’s bundled inside the Forms & Waivers feature on its Gold tier ($48/mo annual, $56/mo monthly) and above — and no source, including GlossGenius’s own pricing page, mentions a BAA. The HIPAA capability is real; the contractual backing is unconfirmed. For a covered entity, that is not a yes.
Fresha lists HIPAA compliance next to ISO 9001/27001 and GDPR on its pricing page, but likewise names no BAA, and its page rendered EUR-only with no confirmable USD figure — so it’s both unpriced and unconfirmed on the contract.
How to read this
A HIPAA feature and a HIPAA-grade contract are different purchases. Of the seven booking vendors here that say “HIPAA,” five — Setmore, vcita, GReminders, Acuity and Vagaro — will name a BAA in their published materials; two — GlossGenius and Fresha — show the badge and stop short.
If price is the tiebreaker, the cheapest published confirmed-BAA entry is Setmore Pro at $5/user/mo (annual), then vcita Kickstart at $35/seat/mo, GReminders Professional at $39/user/mo, and Acuity Premium at $49/mo. But “cheapest” is the second question for a healthcare buyer. The first is whether the vendor will sign — and on that, two of these seven have not said yes. Verify the BAA in writing before you let a single patient name through the booking page; the pricing card is not the contract.