No As of, no BAA is available on any Zapier plan, and Zapier says PHI under HIPAA is not supported. A clinic that sends patient data through a Zap, Table or Interface has no business associate agreement covering that data.
Short answer
No business associate agreement (BAA) is available on the Free, Professional, Team or Enterprise plan. Zapier states that regulated healthcare data, including PHI, is not supported and that it cannot sign BAAs. So do not route PHI through Zaps, Tables or Interfaces, on any plan.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | No | Not published by the vendor | Not published by the vendor |
| Professional | No | Not published by the vendor | Not published by the vendor |
| Team | No | Not published by the vendor | Not published by the vendor |
| Enterprise | No | Not published by the vendor | Not published by the vendor |
Zapier has no BAA process, so there is no request route, contract tier or add-on to price. Enterprise is not an exception. Zapier plan prices are not listed here, and the vendor's pricing page is the only source for them.
What the BAA covers and what it excludes
Covered: nothing, because Zapier offers no BAA.
Excluded:
- Any Zap that carries PHI in a trigger, action or field.
- Any Zapier Table that stores PHI.
- Any Zapier Interface that collects or displays PHI.
- Any other Zapier product handling PHI.
The apps you connect may have their own BAAs. That does not extend to the Zapier hop between them. For example, a patient intake form that triggers a Zap writing the submission into a spreadsheet moves PHI through Zapier, even if both the form tool and the spreadsheet vendor sign BAAs.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Security controls do not substitute for a BAA. An audit log or a SOC 2 report does not change whether Zapier will accept responsibility for PHI under HIPAA.
How to use Zapier with PHI
Zapier offers no BAA, so you cannot use it with PHI. What you can do is keep PHI out of it. Use this checklist:
- Keep PHI out of triggers, actions and fields. This covers patient names, dates of birth, MRNs, appointment details tied to a patient and free-text notes.
- Audit existing Zaps. Open each Zap and check mapped fields. Clinics often find a "new form submission" or "new calendar event" trigger passing patient details to Slack, email or a sheet.
- Check Tables and Interfaces too. Stored records and form fields count, not only Zaps.
- Use de-identified data only where your privacy officer approves it. Get the approval in writing.
- Review each connected app separately. For example, check Is HubSpot HIPAA compliant? for a connected CRM. Each app needs its own BAA review, and that review does not cover the Zapier connection.
- Document the decision in your vendor inventory. Record "no BAA available, PHI not permitted," with the verification date.
- Train staff. Anyone who can build a Zap should know which fields they may not map. Staff who handle automations need the same rule as staff who handle email.
If a workflow needs PHI to move automatically, consider an automation tool that signs a BAA. See the HIPAA guides for more on evaluating tools.
Compliance depends on a signed BAA, configuration and policies, and Zapier offers no BAA.
Alternatives with a BAA
No vetted alternatives are listed for this entry yet. Browse All vendor HIPAA checks for individual vendor verdicts, or HIPAA-compliant software by category to compare tools. Check each vendor's own BAA terms before use.
Sources
- Zapier Enterprise Agreement FAQ — Terms, checked 2026-10-19. "Zapier hasn’t undergone the HIPAA certification process, and we therefore don’t offer a BAA."
- Data Privacy Overview | Zapier — Terms, checked 2026-10-19. "The use of regulated healthcare and medical data including Protected Health Information (PHI) under HIPAA isn't supported on Zapier. Zapier also can’t sign business associate agreements (BAAs) or equivalent agreements for handling PHI or other similar information."
- Plans & Pricing | Zapier — Pricing page, checked 2026-10-19. "Customize your task history retention to match your company's legal and regulatory requirements."
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Does Zapier sign a BAA?
No. Zapier states that it cannot sign BAAs and that PHI is not supported. No plan has a BAA, and no process for requesting one is published.
Is any Zapier plan, including Enterprise, approved for PHI?
No. Free, Professional, Team and Enterprise all have the same status: no BAA available, PHI not supported.
Can I use Zapier if the data contains no PHI?
Yes, if the data truly contains no PHI. That means scrubbing every trigger, action and field, including free-text notes. A Zap that moves a non-patient task, like a supply-order reminder, is outside the issue. If the data is de-identified, your privacy officer should approve it in writing first.
Does Zapier's SOC 2 report mean it can handle PHI?
No. SOC 2 is a security audit. It is not a BAA, and Zapier does not offer a BAA.