HIPAA Compliance with Zoho Commerce
The Health Insurance Portability and Accountability Act, (including the Privacy Rule, Security Rule, Breach Notification Rule, and Health Information Technology for Economic and Clinical Health Act) (“HIPAA”), requires covered entities and business associates to protect health information that can identify an individual. It also provides certain rights to individuals.
Zoho does not collect, use, store, or maintain health information protected by HIPAA for its own purposes. Zoho Commerce provides features that help customers use the platform in a HIPAA-compliant manner.
HIPAA requires covered entities to sign a Business Associate Agreement (BAA) with their business associates. You can request our BAA template by emailing legal@zohocorp.com.
Member Portal & Access Restriction
Zoho Commerce provides role-based access to the features available in your store. The member portal contains an access control list, where the store owner can restrict website access for employees and visitors. This gives the store owner complete control over user permissions.
Not all users can view or access the administrator functions in your store. This helps limit access to protected business and patient information to only the users who need it.
SSL Certificate
With Zoho Commerce, business owners can install their own SSL certificates or purchase one from Let’s Encrypt for free. SSL provides encryption, authenticity, and integrity for stores created through Zoho Commerce.
Audit Trail
The Audit page lets users review builder activities that have been recorded. Logs are available for up to 6 months and can be exported as CSV files.
All write operations involving ePHI and sensitive read operations, such as export activity, are available in the Zoho Commerce Audit Trail. Zoho Commerce can also provide audit logs to users on request. To request an audit log, contact the Zoho Commerce Support Team.
Forms
Zoho Commerce forms can be used to collect ePHI data. The form fields can be marked as sensitive while collecting ePHI data. See HIPAA compliance in Zoho Forms for more details.
Field encryption can be applied to ePHI data collected through forms. While exporting the form data, ePHI data can be withheld. Form data is not stored by Zoho Commerce. The Zoho Forms service is integrated with Zoho Commerce.
Custom Fields
Zoho Commerce can be used to create a custom field and mark it as ePHI if the information is used to identify a patient. For example, an electronic copy of a medical report is ePHI. Only fields such as Text, Email, URL, Phone, and Date can be marked as ePHI. The data is considered sensitive and is encrypted and stored. Only users with access to protected data can access these fields. These fields and Sales Orders are integrated through the Zoho Inventory service.
Zoho Commerce helps customers configure these controls so they can use the platform in a HIPAA-compliant workflow while keeping sensitive healthcare data protected.