Zoho DataPrep with HIPAA Compliance
The Health Insurance Portability and Accountability Act, HIPAA (including the Privacy Rule, Security Rule, Breach Notification Rule, and Health Information Technology for Economic and Clinical Health Act), requires Covered Entities and Business Associates to take certain measures to protect health information that can identify an individual. It also provides certain rights to individuals.
Zoho does not collect, use, store or maintain health information protected by HIPAA for its own purposes. However, Zoho DataPrep provides certain features (as described below) to help its customers use DataPrep in a HIPAA compliant manner. HIPAA requires Covered Entities to sign a Business Associate Agreement (BAA) with their Business Associates. You can request our BAA template by sending an email to legal@zohocorp.com.
Zoho DataPrep is SOC2+HIPAA Type 2 compliant. Zoho DataPrep provides the following features to help its customers use DataPrep in a HIPAA compliant manner.
Mark PII and ePHI data
Zoho DataPrep helps you mark a column that contains ePHI (Electronic protected health information ) data using the Mark PII and ePHI data transform. This also helps users apply relevant controls like access control and apply security measures such as masking and tokenization during export, to the columns marked as ePHI data. Click here to learn more.
Roles and sharing permissions
Zoho DataPrep has roles for users based on their entity permissions. In other words, the user roles in DataPrep is based on the user's access to each entity like, workspace, datasets, etc. The following are the available user roles in DataPrep:
- Account admin
- Organization admin
- 'Workspace admin' role for Workspace
- 'Data consumer' role for Workspace
- 'Editor' role for dataset
- 'Data consumer' role for dataset
DataPrep allows you to share entities and collaborate with the end users in your organization without sharing PII data and ePHI data using the Data consumer (without PII and ePHI data) role to secure your personal data.
Encryption
ePHI data encryption is advised to prevent anyone from breaching the security and accessing or tampering with the ePHI data. In Zoho DataPrep, all user data including ePHI data is encrypted at rest and in transit by default.
Audit
Zoho DataPrep provides audit logs for the access and activity details of all data including ePHI data in your DataPrep organization using the Audit option.
Access Audit - This option monitors all the users who access entities in your organization. Learn more
Activity Audit - This option monitors all the user activities in your organization. Learn more
Note: Only the admin can access the Audit Logs.
Audit trial retention
Zoho DataPrep allows the users to export the activity and access audit logs for the last two years. The Admin can use the export option and download the audit trial logs of the previous 2 years using the link which will be sent to the registered email ID.
Note: The audit logs can be exported from the time the access or activity audit is enabled and not from the time when the organization was created.
Access controls of ePHI data
Users can manage how to process health related private data to comply with HIPAA regulations in the Compliance Settings.
Note: The Compliance settings are accessible only to the Account admin in the organization.
Zoho DataPrep provides the below features to manage and control the access of epHI data:
Restrict ePHI data transfer to Zoho Apps : Using this option, you can exclude ePHI columns from being exported to other Zoho Apps.
Restrict ePHI data transfer to Third-party Apps : Using this option, you can exclude ePHI data columns from being exported to Third-party Apps.
Secure ePHI columns before export : This option allows you to make the users in your organization to secure ePHI data before exporting. Learn more.
Export ePHI data with password protection : This option helps you restrict users from exporting datasets containing ePHI columns without password protection. Learn more about other protection methods in DataPrep.
How to enable HIPAA compliant features?
1. Click the Enable HIPAA Compliance toggle to submit a request to sign BAA and enable HIPAA compliant features.
2. The enable request is sent to our support team via email.
3. Once our support team is done with the background verification of BAA, the HIPAA compliant features will be enabled for your organization.
Note: You can also disable HIPAA features using the HIPAA Compliance toggle. Once our support team validates your request, HIPAA features will be disabled.
Modification of Terms of Use
Zoho reserves the right to modify the Terms. Modifications to the Terms are effective upon your use of Zoho DataPrep subsequent to publication of such modification.
Disclaimer: The content presented here is not to be construed as legal advice. This is a guideline on how Zoho DataPrep provides control to the organizations to be HIPAA compliant. Please contact your legal advisor to know how HIPAA is applicable and how it impacts your organization and the processes involved to be HIPAA compliant.
SEE ALSO
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Zoho DataPrep Resources
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
Zoho DataPrep with HIPAA Compliance
The Health Insurance Portability and Accountability Act, HIPAA (including the Privacy Rule, Security Rule, Breach Notification Rule, and Health Information Technology for Economic and Clinical Health Act), requires Covered Entities and Business ...GDPR Compliance in Zoho DataPrep
The European Union has taken a monumental step in protecting the fundamental right to privacy for every EU resident with the General Data Protection Regulation (GDPR) effective from May 25, 2018. Simply put, EU residents will now have greater say ...Ruleset in Zoho DataPrep
This page covers the following sections: What is a Ruleset? Data source settings Ruleset operations Options with individual rules Ruleset Templates What is a Ruleset? Each transform applied on the dataset is stored in DataPrep as a rule, in order of ...Zoho DataPrep's Home page
The home page gives you a brief overview of the workspaces you own, where they are located, and the workspaces that are shared with you. From Zoho DataPrep's home page, you can manage your Zoho DataPrep account, create and manage workspaces. The ...Data migration for Zoho Creator using DataPrep
Zoho DataPrep is now integrated with Creator using Zoho Creator connector. The forms in Zoho Creator are used to collect and store data, serving as the main point of interaction between the created application and users. Zoho DataPrep allows you to ...
New to Zoho LandingPage?
Zoho LandingPage Resources