HIPAA Compliance with Zoho CRM
The Health Insurance Portability and Accountability Act (including the Privacy Rule, Security Rule, Breach notification Rule, and Health Information Technology for Economic and Clinical Health Act) ("HIPAA"), requires Covered Entities and Business Associates to take certain measures to protect health information that can identify an individual. It also provides certain rights to individuals. Zoho does not collect, use, store or maintain health information protected by HIPAA for its own purposes. However, Zoho CRM provides features to help its customers use CRM within the premises of HIPAA compliance.
HIPAA requires Covered Entities to sign a Business Associate Agreement (BAA) with its Business Associates. You can request our BAA template by sending an email to legal@zohocorp.com.
HIPAA compliance in Zoho CRM
As more healthcare organizations have started to use CRM to run their business smoothly and store customer information in a shared database, it is crucial that they can ensure the confidentiality of an individual's health information.
In Zoho CRM, we provide ways for healthcare organizations to secure and restrict export of individuals' health information and stay compliant with the HIPAA guidelines.
The CRM admins can achieve this by performing the following steps:
- Selecting the "health" module: All organization modules that contain protected health information must be selected. Both standard and custom organization modules can be selected. A total of 10 modules can be selected.
- Marking fields that contain PHI: In a module, there may be only a few fields that contain personal health details of a customer. For example, surgical history, symptoms, medication details, etc. Marking these fields as personal health details will help the system identify and restrict access to these fields through API and prevent the export of these field values. A total of 25 fields in each module can be marked as personal health data containing fields.
- Setting restrictions for the data marked as PHI: There are four options for restricting personal data from being accessed outside Zoho CRM. Any of these options can be enabled depending on the org's requirements:
- Restrict data access through API: Other applications can connect with CRM using API and data can be transferred. You can ensure that personal health data of your customers is not shared in the process, by restricting transfer of personal health data to other applications via API.
- Restrict data export: While exporting data from the CRM account you may want to withhold personal health information from being exported by checking this option.
- Restrict data transfer to Zoho apps: If the CRM account is integrated with other Zoho applications like Desk, Campaigns, Projects etc. the data will flow from CRM to these applications. This option will prevent personal health data from being transferred to other apps. To check the data flow restrictions refer to the table.
- Restrict data transfer to third party apps: If your CRM account is integrated with third party applications for business related reasons there will be chances of data flow from CRM to these apps. This option will prevent personal health data from being transferred to other apps. To check the data flow restrictions refer to the table.
- Encrypting PHI fields: Fields that contain personal health information can be encrypted for additional security. Though field encryption is not a mandatory step in Zoho CRM, we strongly recommend you enable encryption as it is the best practice to prevent unauthorized access to confidential data.
Read more to configure encryption and understand its limitations. Also, refer to the Zoho Encryption whitepaper to understand the encryption process and key management in detail.
HIPAA is supported for Leads, Contacts, Vendors, and custom modules.
Notes:
- Field types supported:
- Single line,
- Multiline
- Email
- Phone
- Picklist
- Multi-Select
- Date
- Date/Time
- Number
- Currency
- Decimal
- Percent
- Long Integer
- Checkbox
- URL
- File Upload
- Image Upload
- Lookup, multi-select lookup, and autonumber fields cannot be marked as personal health data.
Availability
Permission Required
Users with the Manage Compliance Settings permission in their profile can manage HIPAA compliance for different modules.
To configure HIPAA compliance
- Go to Setup
> Security Control > Compliance Settings.
- Click the HIPAA Compliance tab.
- Toggle the Enable HIPAA Compliance Settings button.
- Select the organization modules from the dropdown list.
- You can select up to 10 modules.
- In Personal Health Data Handling, toggle Restrict Data access through API and/or Restrict Data in Export, as required.
To mark fields that contain personal health data
- Go to Setup
> Customization > Modules and Fields.
- Select a module and select the desired layout.
Alternately, you can click the More iconagainst the layout and select Edit Layout.
- Go to the desired field and click the More icon
.
- Click Edit Properties and check the Contains Personal Health Data box.
Remember that this option will only appear if the module has been selected for HIPAA compliance
Retrieving the audit log
We allow users with permission, to export data as and when required using the Export Audit Log option. In Zoho CRM audit log is available for 60 days by default. If you want to preserve it for a long period, you can periodically export it using the Export Audit Log option. In case you require data beyond 60 days you can reach out to support@zohocrm.com.
Disabling HIPAA compliance
Once HIPAA compliance is disabled, the fields that have been marked as personal health data will be unmarked. The admin can mark the fields again when they re-enable the HIPAA compliance.
Viewing personal data of the records
All the fields that are marked as containing personal health data will be listed in the record detail page. Under Data Privacy, in the Personal Data section, you can click the Health tab to view the fields that have personal health data.
Kindly note that the content presented here is not to be construed as legal advice. Please contact your legal advisor to learn how HIPAA impacts your organization and what you need to do to comply with the HIPAA.
Other security related features that Zoho CRM offers
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
Centralize Knowledge. Transform Learning.
All-in-one knowledge management and training platform for your employees and customers.
New to Zoho Writer?
Create. Review. Publish.
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
FAQ: HIPAA Compliance
How does Zoho CRM help organizations be HIPAA Complaint? At Zoho CRM, we allow organizations to be compliant with the HIPAA guidelines by providing the following options: Select modules that contain personal health data: All modules that contain ...Security controls in Zoho CRM: An overview
The most valuable part of your CRM isn't its features—it's your organization's actionable, context-rich customer data. As an administrator, your job is to ensure only the right users have access to the CRM and can work with this data. Once inside, ...Troubleshooting Zoho Campaigns integration with Zoho CRM
Why aren't all of my contacts syncing between Zoho CRM and Campaigns? There can be a few reasons why your Zoho CRM contacts are not syncing in Campaigns. No email address has been entered in your customer account: Double check to ensure there is an ...Export CRM Data
Depending on your needs, you may wish to export all or part of the data stored in your CRM. Some common reasons include segmenting customers, sharing data with collaborators, meeting compliance-related requirements, creating reports, and archiving ...Zoho CRM and Security: A partnership that forms the bedrock of our operations
In August 2025, a leading human resources and financial management software provider, Workday, fell prey to a social engineering attack targeting a third-party customer relationship management (CRM) system. The incident exposed the company's business ...
New to Zoho LandingPage?
Zoho LandingPage Resources