How does Zoho Creator support HIPAA compliance?
Zoho Creator HIPAA Compliance Guide
The Health Insurance Portability and Accountability Act (HIPAA) – including the Privacy Rule, Security Rule, Breach Notification Rule, and the Health Information Technology for Economic and Clinical Health (HITECH) Act – mandates that Covered Entities and Business Associates take specific measures to protect individually identifiable health information. HIPAA also grants individuals certain rights regarding their health data.
Zoho Creator itself does not collect, store, use, or maintain health information protected under HIPAA for its own purposes. However, it does provide features that allow customers to build and manage HIPAA-compliant applications on the platform.
HIPAA Compliance in Zoho Creator,
Zoho Creator provides various safeguards and controls in the platform that customers can utilise to build their HIPAA complaint applications. The following section highlights a few aspects of how Zoho Creator application owners/admins can achieve this:
Labelling Fields as ePHI
You can label specific fields as ePHI (electronic Protected Health Information) if they store any data that directly or indirectly identifies an individual’s health information.
Steps:
- Open the form builder.
- Select the target field.
- In the Field Properties panel, go to Data Security.
- Check the box labeled Contains health info (ePHI).
Encrypting ePHI Data
Encryption adds a strong layer of protection by making sensitive data readable only by authorized parties. Zoho Creator allows you to encrypt fields containing health information.
Managing Roles and Permissions
Zoho Creator gives admins fine-grained control over user access to applications and data. Key features include:
- Adding and managing users
- Creating custom permission sets at the module, record, feature, and field level
Defining roles and hierarchical structures
Defining roles and hierarchical structures
Enforcing domain restrictions
Audit Trails & Export Logs
The Audit Trail feature helps monitor and log user activities, including:
- Changes made to records
- Report export and print actions
Retention Period:
- Record change logs: Retained for 1 year
- Export/Print logs: Retained for 3 months
Audit logs can be exported as CSV files for internal archiving. However, it is the Covered Entity’s responsibility to protect and manage exported logs in accordance with HIPAA retention rules.
Backup and Restore Capabilities
Zoho Creator supports scheduled application backups, including associated data, with the ability to restore them as needed.
You can:
Configure backup frequency
- Set start dates for scheduled backups
- Restore from previous snapshots in case of data loss
Secure Third-party Integrations
- Zoho Creator allows secure integrations with third-party services. All data transmitted during these integrations is encrypted in transit and managed in accordance with HIPAA guidelines.
