Overview

The Health Insurance Portability and Accountability Act (including the Privacy Rule, Security Rule, Breach notification Rule, and Health Information Technology for Economic and Clinical Health Act) ("HIPAA"), requires Covered Entities and Business Associates to take certain measures to protect health information that can identify an individual.

Zoho Connect does not collect, use, store, or maintain health information protected by HIPAA for its own purposes. However, Zoho Connect provides certain features (as described below) to help its customers use Zoho Connect in a HIPAA compliant manner. 

HIPAA requires Covered Entities to sign a Business Associate Agreement (BAA) with its Business Associates. You can request our BAA template by sending an email at legal@zohocorp.com.

Labelling of ePHI

         

The data in the following entities — tasks, events, and polls and the titles of Posts, Forums, Groups, Manuals, Articles are not considered as ePHI.

Data encryption

Audit logs to track data sources and modifications

Audit logs for modifications made in Custom Apps are currently not available.

Data deletion and retention 

Users in the network can delete the posts, comments, attachments, manuals, groups, events, and town halls shared and created by them. However, a copy of deleted items will be available in the trash of each module. Only network admins can access the contents in the trash and restore them, if required. 

The option to label ePHI as personal information, audit logs, edit history, and trash to store deleted data are available only in paid plans of Zoho Connect. Click here to view pricing.

Disclaimer: The information presented herein should not be taken as legal advice. This article is written to help organizations understand how Zoho Connect can enable them to be HIPAA compliant. We urge you to contact your legal advisor to know how HIPAA is applicable, its impact on your organization, and the processes involved to be HIPAA compliant.