Zoho Campaigns is an email marketing platform that allows organizations to create, automate, send, and track campaigns across email, SMS, and WhatsApp. It also provides contact management, audience segmentation, templates, analytics, and integrations with other applications.

Is Zoho Campaigns HIPAA compliant? Yes, Zoho Campaigns can be HIPAA compliant.

 

What changed this year?

As of September 2026, our review did not identify any publicly disclosed changes to Zoho Campaigns’ HIPAA-related policies or BAA availability.

Zoho published revised Zoho Campaigns Terms of Use on September 3, 2026, which take effect on October 12, 2026. However, the revised terms do not announce a change to Zoho Campaigns’ inclusion among the services that support HIPAA requirements.

 

Will Zoho Campaigns sign a business associate agreement (BAA)?

Yes, Zoho Campaigns is eligible for inclusion in Zoho’s business associate agreement. Customers can request the BAA template by emailing legal@zohocorp.com, as explained in the Zoho Campaigns HIPAA guidance.

 

What does the Zoho Campaigns BAA cover?

Zoho does not publish the complete BAA template on its website. However, its HIPAA compliance page states, “The BAA defines the specific Zoho services covered, security commitments, breach notification procedures, and subcontractor flow-down requirements.”

The BAA covers:

  • The specific Zoho services named in the agreement
  • Security commitments for protected health information (PHI)
  • Breach notification procedures
  • Subcontractor obligations
  • Data-handling responsibilities between Zoho and the customer

Zoho Campaigns also provides controls for marking custom fields as containing PHI, encrypting those fields, restricting access through application programming interfaces, preventing data exports, and reviewing audit logs. Zoho explains that customers can “[mark] fields containing PHI” to help the system restrict access and prevent those values from being exported.

 

What does the Zoho Campaigns BAA exclude?

Zoho does not publicly provide a complete list of exclusions from its BAA. Healthcare organizations must review the agreement supplied by Zoho to confirm which services, communication channels, integrations, and uses are covered.

Zoho’s HIPAA guidance states, “Not all Zoho services are designed to meet HIPAA requirements.” The BAA only applies to the applications specifically included in the signed agreement, so organizations should not assume that every Zoho product or third-party integration is covered.

Zoho Campaigns also has technical limitations. Its HIPAA compliance instructions state, “Only Custom fields can be marked as fields with PHI. Standard fields cannot be marked.” Custom fields are not encrypted automatically and must be encrypted manually by the customer.

Organizations must therefore configure the HIPAA settings, identify and encrypt relevant custom fields, restrict exports and API access, and confirm that every connected application handling PHI has its own appropriate BAA.

 

Conclusion

Zoho Campaigns is HIPAA compliant when it is included in a signed BAA and configured appropriately.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a BAAt?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information, known as PHI.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.