Zoho says customers can request its BAA template by email, but it does not say which Zoho Mail plans qualify. The vendor’s position isn’t clear enough to rely on. Treat it as unsafe for patient data until the vendor confirms in writing.
How to get the BAA
Email [email protected] to request Zoho’s BAA template.
What the vendor says to do
- Request the BAA from [email protected] and do not put PHI in Zoho until it is signed
- Assign administrator roles and set security policies such as multi-factor authentication, password rules and IP restrictions
- Optionally enable S/MIME
- On premium plans, use eDiscovery with defined retention
- Schedule periodic email backups and use audit logs
What we couldn’t confirm
Zoho says the BAA defines the covered services, so confirm Zoho Mail is named in your signed copy. Plan coverage isn’t stated.
Proof from the vendor
- HIPAA Compliant Email, Zoho MailBAA request address; eDiscovery premium-only; security settings
- HIPAA Compliance at ZohoBAA specifies covered services; not all Zoho services eligible; no PHI before signing
- Zoho Mail pricingNo HIPAA or BAA row by plan; FAQ mentions Mail and WorkDrive within Workplace
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.