Is Zoho CRM HIPAA compliant?
CRM with HIPAA compliance settings. Zoho provides its BAA on request from its legal team; the BAA lists the Zoho applications it covers.
Signs a BAAConditional
Zoho CRM signs a Business Associate Agreement only under specific conditions. Zoho provides a BAA template on request (legal@zohocorp.com); the BAA names the covered Zoho applications, and Zoho says no PHI should flow through any Zoho application until a signed BAA is in place.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: Zoho — HIPAA compliance at Zoho · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
| Signs a BAA | Conditional | Zoho — HIPAA compliance at Zoho |
|---|
What you still have to configure
- In Setup > Security Control > Compliance Settings > HIPAA Compliance, enable the settings, mark fields as "Contains Personal Health Data" and restrict API access, export and transfers to other apps as needed. source
Limitations
- Confirm that the signed BAA names Zoho CRM — Zoho's HIPAA page says the agreement specifies which applications are covered. source
- Zoho's documentation conflicts on how long the CRM audit log is kept: its HIPAA FAQ says 60 days, while its audit-log FAQ says the log captures the last three years and older actions are permanently deleted. Confirm the retention in your account and export logs according to your review and retention policy. source
Against our criteria
| BAA without a sales process | No — Requested from Zoho's legal team by email. | Zoho — HIPAA compliance at Zoho |
|---|---|---|
| BAA on entry-level team plans | Not verified | Not verified yet |
Alternatives
- HubSpot →BAA: conditional
- Microsoft Dynamics 365 →BAA: yes
- Pipedrive →BAA: no
- Salesforce →BAA: conditional