ScheduleOnce, now known as OnceHub, is an appointment scheduling platform that allows organizations to publish booking pages, coordinate calendars, route appointment requests, and automate confirmations and reminders.

Is ScheduleOnce HIPAA compliant? Yes, ScheduleOnce can be HIPAA compliant.

 

What changed this year?

In January 2026, OnceHub updated its business associate agreement (BAA). The current version expressly limits HIPAA coverage by excluding OnceHub’s AI features, support tickets containing protected health information (PHI), and SMS messages containing PHI.

As of July 2026, OnceHub still offers BAAs. However, OnceHub’s pricing information shows that BAA availability requires the Security and Compliance add-on for its paid Schedule, Route, and Engage plans. The add-on is included with the Enterprise plan.

 

Will ScheduleOnce sign a BAA?

Yes, OnceHub will sign a BAA, which can be reviewed here. OnceHub instructs customers to contact its support team to arrange for the BAA to be signed.

 

What does the ScheduleOnce BAA cover?

The OnceHub BAA covers PHI that OnceHub creates, receives, maintains, or transmits while providing covered services. OnceHub’s guidance states, “The OnceHub BAA covers patient data that is stored on our servers.”

The BAA covers:

  • Protection of PHI
  • Administrative, physical, and technical safeguards
  • Reporting unauthorized uses, disclosures, breaches, and security incidents
  • HIPAA obligations for subcontractors with access to PHI
  • Individual access and amendment requests, when applicable
  • Accounting of disclosures
  • Access by the Department of Health and Human Services
  • Return or destruction of PHI after termination

What does the ScheduleOnce BAA exclude?

The current BAA states that covered services “do not include” OnceHub’s AI features. It also excludes support tickets and SMS messages that contain PHI.

OnceHub’s BAA guidance adds that data transferred to third-party integrations is outside OnceHub’s control and is not covered by its BAA. Healthcare organizations must therefore confirm that connected calendar, video conferencing, CRM, and other integration providers are also covered by appropriate BAAs.

OnceHub specifically excludes:

  • OnceHub AI features
  • SMS messages containing PHI
  • Support tickets containing PHI
  • Data after it is transferred to third-party integrations

OnceHub also places responsibility on customers to enable the security features needed for their HIPAA obligations, including appropriate password and session policies.

 

Conclusion

ScheduleOnce, now known as OnceHub, may be HIPAA compliant, but only when the customer signs a BAA, obtains the required compliance add-on or Enterprise plan, configures the account correctly, and keeps PHI out of excluded services such as AI features, SMS messages, support tickets, and uncovered third-party integrations.

See also: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a BAA?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information, known as PHI.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.