Is Zoho HIPAA compliant?

BAA on select plansPHI with conditionsSOC 2 Type II

Will Zoho sign a HIPAA BAA?

Sometimes — Zoho signs a HIPAA BAA only on specific plans or add-ons.

Zoho signs a HIPAA Business Associate Agreement; the BAA template must be requested by emailing legal@zohocorp.com. Its scope is governed by Zoho's SOC 2 + HIPAA Type 2 audit and applies only where Zoho acts as a Business Associate; not all Zoho apps are covered.

PHI eligibility

PHI is permitted only after a signed BAA is in place and only within covered, properly configured Zoho services; some apps are out of scope and should not receive PHI.

SOC 2

SOC 2 Type II

Trust center

zoho.com ↗

Sub-processors

—

Notes

BAA is not self-serve; it must be requested from legal@zohocorp.com. Zoho's SOC 2 + HIPAA audit period runs December to November annually.

Last verified 2026-05-31confidence: high· Vendor terms change — confirm directly with Zoho before storing PHI.

Get notified when this changes

We track Zoho's BAA and HIPAA status. Leave your email and we'll send one note if the verdict on this page changes.

How to request and sign a BAA with Zoho

Sometimes — Zoho signs a HIPAA BAA only on specific plans or add-ons.

Request routeSelf-serve — enable it in your account

1
Get on a qualifying plan
Zoho signs a HIPAA Business Associate Agreement; the BAA template must be requested by emailing legal@zohocorp.com. Its scope is governed by Zoho's SOC 2 + HIPAA Type 2 audit and applies only where Zoho acts as a Business Associate; not all Zoho apps are covered.
2
Request the Business Associate Agreement
Zoho lets you obtain the BAA without a sales call. Follow the path named in the plan requirement above — typically an in-product toggle or a billing / compliance settings page — then request and accept the agreement from your own account.
3
Confirm what PHI is allowed before you store any
PHI is permitted only after a signed BAA is in place and only within covered, properly configured Zoho services; some apps are out of scope and should not receive PHI. Match your configuration to this scope before putting protected health information into Zoho.

Last verified 2026-05-31 · Plan tiers and BAA terms change often — confirm the current process directly with Zoho before you rely on it. This is cited public information, not legal advice.

Frequently asked questions

Does Zoho sign a HIPAA Business Associate Agreement (BAA)?

Sometimes — Zoho signs a HIPAA BAA only on specific plans or add-ons. Zoho signs a HIPAA Business Associate Agreement; the BAA template must be requested by emailing legal@zohocorp.com. Its scope is governed by Zoho's SOC 2 + HIPAA Type 2 audit and applies only where Zoho acts as a Business Associate; not all Zoho apps are covered.

Is Zoho HIPAA compliant?

Zoho can be HIPAA-compliant only on the specific plans or add-ons where it will sign a Business Associate Agreement (BAA). PHI is permitted only after a signed BAA is in place and only within covered, properly configured Zoho services; some apps are out of scope and should not receive PHI.

Can you store PHI (protected health information) in Zoho?

PHI is permitted only after a signed BAA is in place and only within covered, properly configured Zoho services; some apps are out of scope and should not receive PHI.

Is Zoho SOC 2 certified?

Zoho reports a SOC 2 Type II attestation according to its public security documentation.

How do I request a HIPAA BAA from Zoho?

Zoho lets you obtain the BAA without a sales call. Follow the path named in the plan requirement above — typically an in-product toggle or a billing / compliance settings page — then request and accept the agreement from your own account. Confirm current terms directly with Zoho before storing PHI.

What plan do I need to sign a BAA with Zoho?

Sources

HIPAA Compliance — Zoho Vault

https://www.zoho.com/vault/hipaa-compliance.html

Supports: Zoho signs a BAA; request template via legal@zohocorp.com; PHI storage permitteddated: undated

Compliance at Zoho

https://www.zoho.com/compliance.html

Supports: Zoho is SOC 2 Type 2 compliant; SOC 2 + HIPAA Type 2 audit where Zoho acts as a Business Associatedated: undated

This page is cited public information, not legal or compliance advice. A BAA's availability can depend on your specific plan, region, and contract. Always confirm current terms with Zoho before processing protected health information.

Check another vendor

See all HIPAA compliant CRM software →
Browse all 105 vendors by category →