Cal.com for Healthcare: HIPAA, the BAA Rule and Telehealth

Can a clinic run its scheduling on Cal.com?

Yes, with one condition that shapes every other decision. Cal.com can sit in front of a medical practice, a therapy group or a telehealth company, and it already does for several healthcare customers. But under its own Terms, nobody may put protected health information into the service without a signed business associate agreement first ^[1]. No BAA, no patient data. That single rule decides your plan, your monthly bill and which integrations you may switch on. Everything else a clinic needs is in the product: intake questions, routing to the right provider, recurring visits, video, reminders and an API to reach the record system.

This guide follows a practice's needs in order, from the compliance paperwork to the first telehealth call. It is written for clinic managers and practice owners who must pick a plan and defend it. For the full feature tour, read our Cal.com review; for every price and credit rule, see the Cal.com pricing guide. Here we stay with a healthcare buyer's questions. We also flag where Cal.com's own pages disagree.

Why the BAA rule decides the plan

Cal.com's HIPAA page sets the current rule. The BAA is included at no extra cost on Enterprise and on Organizations with 15 or more users. Teams customers, and Organizations customers below 15 users, can add it for $300 a month ^[2]. The healthcare landing page, the Organizations page and a June 2026 telehealth guide all repeat the same split. The privacy policy agrees on the floor: the BAA is available from Teams up and must be signed before any PHI is collected. In practice, the free plan is a tool for scheduling without HIPAA duties, which Cal.com's own telehealth guide says plainly.

Older pages that promise too much

Cal.com has been talking to healthcare buyers since 2022, and its older pages tell a looser story. A 2022 post for mental health professionals claimed HIPAA compliance outright, with no plan or contract attached. A March 2025 post said BAAs were for enterprise customers, arranged through sales. The general compliance page and the healthcare FAQ still tie HIPAA to Enterprise alone, and the law-firm landing page claims HIPAA compliance with no condition at all. Treat all of these as outdated. Today HIPAA readiness comes with a signed BAA, which costs $300 a month below the 15-user Organizations line. Even the June 2026 announcement post contradicts itself, calling the fee monthly in one place and not recurring in another. Follow the HIPAA page.

What stays your job after signing

A signed BAA covers Cal.com, not the apps you connect to it. The HIPAA page says customers must make sure every third-party integration they use with PHI is itself HIPAA compliant. That includes the video tool if you pick Zoom or Google Meet over Cal Video, the calendar your clinicians sync, any Zapier automation and any CRM. Cal.com does list solid controls on its side: encryption in transit and at rest, SOC 2 Type II with annual independent audits, ISO 27001, SAML SSO, SCIM provisioning and domain enforcement. The BAA itself is requested inside the product, from the app store, where a dedicated BAA for HIPAA app starts the process.

Intake before the visit: questions and routing

Every event type carries booking questions, and they are the simplest intake tool you have. Questions can be short text, long text, email or phone, and each can be required or optional. A practice can even let patients book with only a phone number and no email address, which helps older patients. One detail matters for privacy. Hidden booking questions carry data into the booking details but not into the calendar event, while visible answers appear in both. If a clinician's calendar is a consumer account outside your BAA, keep sensitive answers out of what lands there.

Routing forms, which start on Teams, go a step further. Cal.com's EHR guide describes a form that asks for the reason for the visit, whether the patient is new or returning, and a preferred provider, then sends the patient to the right booking page. Answers flow into booking questions when both use the same identifier, which is case-sensitive, so test the mapping before launch. On Organizations, attribute routing can match patients by specialty, location, language or seniority. That is how Kiaora, a women's health company, makes sure patients only see physicians licensed in their own state. This is the feature that justifies Organizations for multi-state telehealth.

Recurring visits and no-show protection

Teams also unlocks recurring events, which suit weekly therapy and long care plans. Cal.com's telehealth post gives the example of a short prescription renewal visit that repeats monthly or quarterly, up to 12 times. For paid visits, a payment app such as Stripe adds held payments: the card is held as a deposit and charged only if the patient misses the visit without cancelling or rescheduling properly. Collective events let one provider be mandatory and others rotate, which fits a visit that needs a physician plus whichever nurse is free. Round robin spreads new patients evenly across a team, and the team view shows everyone's availability at once.

Telehealth on Cal Video

Cal Video is the default meeting location for every Cal.com event, and it is free on every plan. It is built on Daily.co, does not cut meetings off after 45 minutes and handles group calls of up to 300 people. Clinics that already use Zoom, Google Meet or Microsoft Teams can connect those instead, but then the HIPAA status of that tool becomes your homework. Cal Video keeps the visit inside one vendor and under the same BAA. That is simpler.

Recording and transcription are where the plan matters. Recording is not available on Free; it starts on Teams, and transcription settings, including the language, are also team-plan features. Transcription covers English by default, a multilingual auto-detect option and about 45 named languages. Cal Video now shows a consent dialog for recording and transcription, plus a join window for the room. Hosts can switch recording off for guests or for the organizer, start it automatically when the organizer joins, and require guests to give an email before they enter.

Recordings, notes and retention

Plan retention first. The privacy policy says recordings and transcripts from bookings are stored until the user deletes them. We found no automatic expiry. Cal.com Notes turns a transcript into a summary that arrives by email and is saved to the booking; AI features are opt-in, and the notes feature sends only transcript text. The Terms also warn that AI output may be inaccurate. A summary is not a chart note. For on-demand care, instant meetings on Organizations connect a patient to the first host who accepts, always on Cal Video, but they cannot be used on event types that take payment.

Reminders by text and WhatsApp, and what credits cost

Cal.com's healthcare page describes its SMS and email reminders as HIPAA-compliant, and workflows can send email, SMS, WhatsApp or even a Cal.ai voice call. Custom workflows start on Teams; Free sends only the default reminder email. Texts are paid in credits. One credit equals $0.01, and each message costs the Twilio rate for that country plus an 80% processing fee ^[3]. The help page gives an example: a $0.05 SMS to India becomes 9 credits. Credits are charged per segment, which is 160 characters, or 70 with emojis and special characters.

Teams includes 750 credits per member a month, worth $7.50 by our arithmetic, and Organizations includes 1,000. Enterprise gets unlimited credits. When the balance runs out, texts and WhatsApp messages stop at once and Cal.com falls back to email, with a low-balance warning to team admins. Two cautions for clinics. WhatsApp workflows cannot be customized on any plan; they send a fixed default message. And the Cal.ai phone agent costs 29 credits a minute, test calls included. Keep reminder text short and free of clinical detail, which protects both your credit balance and your patients.

Connecting to the EHR

There is no named EHR connector. Cal.com's telehealth guide is clear that the record system connects through the public API rather than a packaged integration, and its EHR article names no specific EHR vendor ^[4]. Cal.com positions itself as a scheduling layer next to the EHR, not a place to store clinical records. The API exposes event types, bookings, users and availability, so the job is to keep appointment state in sync, not to move charts. Webhooks fire when a booking is created, updated or cancelled, and Cal.com says delivery status tracking shows failed syncs.

Plan this as a small engineering project. API v1 was shut down on April 8, 2026, so any integration must use API v2, which allows 120 requests a minute with an API key by default. Webhooks on the cloud service accept only HTTPS endpoints and carry an HMAC SHA256 signature you should verify. Middleware like Zapier is an option. The BAA rule applies there too. Cal.com also claims its scheduling keeps running on cached availability during EHR downtime and syncs afterwards. That is a vendor claim. Test it before you depend on it. Our Cal.com API guide covers authentication and limits in detail.

Where patient data lives

By default, data is processed in the United States, though some subprocessors work elsewhere. The pricing page lists US and EU hosting for data residency, but the privacy policy says EU residency is by request to Cal.com's privacy team. The fuller answer is Cal.eu, an EU-hosted version where all data is stored and processed inside EU borders. It needs at least 50 users and is still in early access through a waitlist, opened in waves. Customers can pick a region when they create an account or migrate an existing one. A small US practice will stay on US hosting; a European clinic group should ask about Cal.eu early.

Other controls matter more to a growing practice. Organizations adds unlimited sub-teams, so a group can split by department or specialty, plus role-based permissions and audit logs. Admins can manage routing rules and event types while clinicians manage only their own calendars. Enterprise adds a dedicated database, an uptime SLA of 99.9% with a 99.99% option, and self-hosting with help from Cal.com engineers. Note one fine point in the Terms: an SLA applies only if it is written into an Order Form or another signed agreement.

What healthcare customers report

Cal.com's customer stories give a fair picture of who uses it, though the numbers drift between versions of the same story. Kiaora, a 15-person women's health company founded in 2023 and on Enterprise, routes patients by state licensure using provider availability, date overrides and external calendars. Its story says it saved 12-24 hours a month of admin work, but the headline says 24 hours and the results list says 3 work days. The same story credits engineering support for digging into its setup and the Insights dashboard for giving Kiaora its first central view of scheduling.

Plume appears only in Cal.com's June 2026 telehealth guide. It moved off the scheduling layer of its Healow EMR, runs roughly 5,000 bookings a month and cut its annual scheduling cost from about $60,000 to $25,000. These are rounded vendor figures with no separate case study behind them in our files. Within Health chose Cal.com because its previous tool was not HIPAA-compliant. Shimmer, an ADHD coaching company on Enterprise, has run over 31,000 sessions, with coaches booking 3-4 weeks ahead, and Cal.com built a Shimmer Video app so its own video could serve as the meeting location. Navi's CEO is quoted saying that protecting health information made Cal.com the sensible choice.

Which plan for a solo practitioner or a group practice

The BAA turns the usual Cal.com math upside down. For most buyers, the seat price is the bill. For a clinic, the $300 monthly BAA usually dwarfs it, until the practice reaches 15 users on Organizations. Here is how annual billing works out, by our arithmetic from the published prices of $12 per user a month for Teams and $28 for Organizations.

A solo practitioner handling PHI needs at least Teams plus the BAA: $144 a year for the seat and $3,600 for the agreement. That is steep for one person, and it is the honest answer for a solo therapist. A solo provider who never puts PHI into the booking flow can stay on Free, but the questions, reminders and video must then carry no health information at all.

A group practice under 15 people is cheaper on Teams with the BAA, and it still gets round robin, routing forms, recurring events and recording. At 15 users, Organizations becomes the cheaper plan and adds attribute routing, sub-teams, SSO and audit logs. A practice of 11 to 14 people should ask sales whether buying up to 15 seats is allowed and how the user count is measured. Seat billing can follow the highest number of members in a cycle or active users with a minimum commitment. Both plans offer a 14-day trial.

Limits and caveats before you sign

The first limit is the price floor for compliance. Any practice that touches PHI pays at least for a Teams seat and the $300 monthly BAA, so Cal.com's generous free plan does not apply to clinical use. The second is integration risk. Calendars, video tools, Zapier and CRMs all fall under your responsibility, and Cal.com names no EHR it connects to out of the box. The third is that fees are billed in advance, renew automatically and are non-refundable except as stated or required by law, so run the trial fully before paying for a year.

Read the vendor's healthcare pages with care. Several older posts still call Cal.com open source, which it has not been since April 2026; the free community edition, Cal.diy, is for personal, non-production use and lacks teams, routing forms and workflows. Others claim HIPAA compliance with no BAA attached. Customer numbers are self-reported and shift between versions. None of this makes Cal.com a poor fit. Its BAA terms are written down and priced openly. It simply needs the paperwork first and the integrations checked one by one.

The bottom line

Cal.com works well for healthcare scheduling once the business associate agreement is in place, and the BAA is the real price decision. Below 15 users, expect to pay $300 a month for it on Teams; from 15 users on Organizations, it comes free along with attribute routing, sub-teams and audit logs. Cal Video, intake questions, routing forms and reminders cover a clinic's day well, while the EHR link needs API work and every connected app needs its own check. Solo practitioners will find the compliance cost steep. Group practices near 15 clinicians get the best value.