Zoho offers a BAA template on request by email, and the signed BAA specifies which applications it covers; its feature list shows HIPAA settings as not included on the Free edition. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Free (HIPAA Compliance Settings not included per feature list) | Not covered |
What the BAA leaves out
- Lookup, multi-select lookup and autonumber fields cannot be marked as PHI
- First Name cannot be marked as a personal health field
- Limit of 10 modules and 25 PHI-marked fields per module
How to get the BAA
Email [email protected] to request the BAA template.
What the vendor says to do
- Request and sign the BAA before PHI flows through any Zoho app
- Go to Setup, Security Control, Compliance Settings, HIPAA Compliance and enable it
- Select up to 10 modules
- Restrict data access through API and data in export as needed
- Mark PHI fields as Contains Personal Health Data
- Restrict PHI transfer to Zoho and third-party apps as needed
- Optionally enable field encryption
What we couldn’t confirm
We couldn’t confirm which paid editions are covered. Being listed on Zoho’s HIPAA page doesn’t by itself mean a service is covered, so check the signed BAA.
Proof from the vendor
- HIPAA Compliance with Zoho CRMBAA template by email, setup steps, limits, integration restrictions
- HIPAA Compliance at ZohoBAA specifies covered applications, no PHI until signed
- FAQ: HIPAA Compliance, CRMField limits, integration impacts, audit log default of 60 days
- Feature-wise comparison of Zoho CRM EditionsHIPAA Compliance Settings marked absent on Free
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.