Zoho will sign a BAA that can cover Zoho CRM, but only on request and only for the services the signed agreement names. Zoho CRM can hold PHI only after that BAA is in place and the HIPAA settings are configured.
Conditional Zoho offers a BAA on request for the Standard, Professional, Enterprise and Ultimate editions of Zoho CRM; the main exclusion is any Zoho service not named in the signed BAA. Verdict date: 2026-10-28.
Short answer
Zoho provides a BAA template on request through [email protected]. Zoho CRM is listed among the services a BAA can cover. Zoho advertises its HIPAA compliance settings from the Standard edition upward, and the signed BAA specifies which Zoho services are covered.
Zoho's stated principle is that no PHI should flow through any Zoho application until a signed BAA is in place. A clinic that imports patient leads or referral records before signing is outside that principle.
For other tools, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Standard | Available on request | Email [email protected] for the BAA template; the signed BAA specifies covered services | Not published by the vendor |
| Professional | Available on request | Same route | Not published by the vendor |
| Enterprise | Available on request | Same route | Not published by the vendor |
| Ultimate | Available on request | Same route | Not published by the vendor |
No edition is listed as excluded among the paid plans. The Free edition is not stated as covered on the pages checked, so treat it as outside the BAA.
Zoho does not state an extra charge for the BAA. The Standard price is shown by region; the page fetched showed INR 800/user/month.
What the BAA covers and what it excludes
The BAA and business associate terms in the signed agreement set the boundary, not the product name on the invoice.
Covered
- Zoho CRM, when named in the signed BAA.
- Other Zoho services that the signed BAA names.
Excluded or not assumed
- Any Zoho service not named in the BAA. Zoho states that not all of its services are designed to meet HIPAA requirements.
- Third-party integrations that handle PHI. Each needs its own BAA with that vendor.
- Zoho's responsibility is limited to where it acts as a Business Associate, per the Zoho trust center.
Field encryption is optional and edition-limited. Zoho's comparison page lists encryption of PHI fields as 10 fields per module on Enterprise and 20 fields per module on Ultimate. A practice storing diagnosis notes, insurance IDs and dates of birth in a contact module should count its fields against that limit before choosing an edition.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | US, EU, India (datacenters listed on compliance page) |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
- Data residency: the compliance page lists US, EU and India datacenters.
- Audit log retention: the CRM HIPAA FAQ states the audit log is available for 60 days by default.
How to use Zoho CRM with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the software alone.
- Sign the BAA before any PHI enters Zoho, including test imports of patient lists.
- Confirm Zoho CRM is named in the signed BAA, along with any other Zoho app you plan to use.
- Enable the HIPAA settings and apply field encryption to each field that holds PHI, within your edition's limit.
- Restrict access with roles so front-desk staff see only what their job needs.
- Review the audit log inside its 60-day window; export what your retention policy requires.
- Get a separate BAA for every integration that touches PHI. Automation tools are a common gap; see Is Zapier HIPAA compliant?.
- Train staff and set written policies on what may be entered in free-text notes.
Alternatives with a BAA
- GoHighLevel: conditional, on any plan with the HIPAA Compliance add-on.
- HubSpot: conditional, Marketing Hub Enterprise. See Is HubSpot HIPAA compliant?.
- monday.com: conditional, Enterprise work management.
- Salesforce: conditional, for the HIPAA Covered Services listed on its BAA Restrictions page; edition eligibility is not stated.
Compare more options in HIPAA-compliant CRM software.
Sources
- HIPAA Compliance at Zoho — BAA page, checked 2026-10-28. "No PHI should flow through any Zoho application until a signed BAA is in place."
- HIPAA Compliance with Zoho CRM — Help article, checked 2026-10-28. "You can request our BAA template by sending an email to [email protected]."
- FAQs: HIPAA Compliance — Help article, checked 2026-10-28. "In Zoho CRM audit log is available for 60 days by default."
- Compliance at Zoho — Trust center, checked 2026-10-28. "The responsibility of Zoho is limited to the extent it acts as a 'Business Associate'."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Does Zoho sign a BAA for Zoho CRM, and how do I request it?
Yes, on request. Email [email protected] for the BAA template. The signed BAA specifies which Zoho services are covered, so confirm Zoho CRM is named before you enter PHI.
Which Zoho CRM editions can have a BAA?
Standard, Professional, Enterprise and Ultimate. The Free edition is not stated as covered on the pages checked.
Does the Zoho BAA cover integrations and other Zoho apps?
Only the Zoho services named in the signed BAA. Zoho states that not all of its services are designed to meet HIPAA requirements. Third-party integrations that handle PHI need their own BAA with the integration vendor.
How long is the audit log kept in Zoho CRM?
60 days by default, per the CRM HIPAA FAQ.