HIPAA and Industry-Specific Compliance Prohibition

What it is

The agreement prohibits use of Squarespace services in ways that would subject Squarespace to HIPAA, GLBA, FERPA, or similar industry-specific regulations without prior written agreement from Squarespace. Handling protected health information is specifically prohibited unless the account is designated as HIPAA-enabled and a separate business associate agreement is in place.

Why it matters (compliance & governance perspective)

This provision establishes a contractual prohibition on processing protected health information or other regulated data through standard Squarespace services, requiring a separate written agreement and account designation. Operators in healthcare, financial services, or education sectors must obtain specific contractual authorization before using the platform for regulated data processing.

Consumer impact (what this means for users)

This provision establishes that standard Squarespace accounts cannot lawfully be used to collect or process protected health information or other data regulated under HIPAA, GLBA, or FERPA without a separately negotiated written agreement and account designation. End users submitting health or other sensitive regulated data through a non-HIPAA-enabled Squarespace site should be aware that the platform is not contractually authorized to handle such data under standard terms.

Institutional analysis (regulatory & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision directly engages HIPAA (45 C.F.R. Parts 160 and 164), GLBA, and FERPA as the named industry-specific regulations. HHS Office for Civil Rights (HHS OCR) enforces HIPAA, including business associate agreement requirements under 45 C.F.R. §164.308. The provision cites the specific HIPAA definition of protected health information at 45 C.F.R. §160.103. Operators who process PHI through standard Squarespace accounts without a HIPAA-enabled designation and BAA would bear the primary regulatory exposure, though the regulatory analysis of business associate status is independent of contractual allocation. (2) GOVERNANCE EXPOSURE: High for healthcare, financial services, and education operators. The absence of a HIPAA-enabled account designation and executed BAA means that any PHI submitted through a standard Squarespace form or service would create HIPAA compliance risk for the operator. This is an operationally critical restriction for any healthcare-adjacent use case. (3) JURISDICTION FLAGS: HIPAA applies to covered entities and business associates in the US regardless of state. FERPA applies to educational institutions receiving federal funding. GLBA applies to financial institutions. Operators in these regulated sectors should assess whether their Squarespace use cases fall within the scope of these frameworks before deploying standard services. (4) CONTRACT AND VENDOR IMPLICATIONS: Healthcare operators must obtain a HIPAA-enabled account designation and execute a separate business associate agreement with Squarespace before using any services to collect or process PHI. Procurement and legal teams in regulated industries should assess whether Squarespace offers the required BAA and HIPAA-enabled account configuration as a pre-condition to deployment. (5) COMPLIANCE CONSIDERATIONS: Legal teams at healthcare, financial services, and education organizations should review all existing Squarespace deployments to confirm that no regulated data is being processed through standard accounts, assess whether HIPAA-enabled account options are available and appropriate for their use cases, and ensure that any required BAA is executed prior to processing PHI.

Applicable agencies

Provision details

Other risks in this policy

• Acceptable Use Policy Compliance Mandatory high
• Aggregate Liability Capped At Twenty Dollars Or Fees Paid high
• Arbitration Opt-Out Available Within Thirty Days high
• Automatic Subscription Renewal Billing Authorized high
• Binding Arbitration Required For Most Disputes high
• Broad License Granted To Squarespace For User Content high