Last verified: October 2026, against Zapier's data privacy FAQ and Terms of Service. General information, not legal advice — confirm with your compliance officer or attorney.
Is Zapier HIPAA compliant? No, and Zapier says so plainly: it won't sign a business associate agreement (BAA), and its terms forbid sending protected health information through it. That matters because many practices have a zap or two that a freelancer set up years ago, quietly copying every website form into a spreadsheet or an inbox. Those automations are where patient data most often leaves the systems a practice thinks it controls.
Short answer from Zapier's own documentation
Short answer (verified October 2026): Zapier's data privacy FAQ (opens in a new tab) says: "The use of regulated healthcare and medical data including Protected Health Information (PHI) under HIPAA isn't supported on Zapier. Zapier also can't sign business associate agreements (BAAs) or equivalent agreements for handling PHI." Its Terms of Service (opens in a new tab) (effective April 9, 2026) define "Sensitive Personal Data" to include "patient, medical, or other protected health information" and state: "You may not access or use the Service... to upload or transmit any Sensitive Personal Data." This applies to every plan.
Zapier holds SOC 2 Type 2 and SOC 3 reports. Those are security audits, not a BAA, and they don't change the terms above.
Why every automated step is a disclosure
A zap copies data from one app, through Zapier, into another. Under HIPAA, each hop is a disclosure to a vendor, and each vendor that receives patient information for your practice needs a BAA. One uncovered link breaks the chain, however well the other apps are set up.
Take a typical three-step zap: website form, then Google Sheets, then a Slack message. For it to be compliant, all of these would need coverage:
- The form tool, which collects the data.
- Zapier, which moves it. It won't sign.
- Google Sheets, covered only if your Workspace admin accepted Google's BAA; see Google Sheets and the Workspace BAA.
- Slack, which has its own plan rules; see Slack and HIPAA.
How these contracts chain together is explained in BAA chains and subcontractors.
Common practice zaps and the PHI they move
| Zap | What it moves | Safer pattern |
|---|---|---|
| Website form → Google Sheet | Name, phone, email, reason for visit | Keep submissions in the form tool or a covered CRM; alert staff without details |
| Website form → email to front desk | Full submission in the email body | Email says "New request received"; staff log in to read it |
| Form → CRM or email-marketing list | Contact plus the service they asked about | Add only consenting newsletter sign-ups, with no health fields |
| New booking → Slack or Teams channel | Patient name, time, visit type | Post "New booking" with no name, or use a covered channel |
| Missed call or text → spreadsheet | Phone number, message text | Keep call logs in the phone system under its own BAA |
Illustrative example: Cedar Grove Chiropractic's site form asked "What brings you in?" A zap copied each answer into a shared Google Sheet on the owner's personal Gmail. Two uncovered hops, and the sheet was still shared with a former front-desk employee.
Even zaps that look harmless can carry PHI. Zapier's Jotform connection, for instance, asks "Account HIPAA Compliant?" That describes your Jotform account. It doesn't change Zapier's terms.
Safer patterns: notify without the details
The fix is usually to separate the alert from the data:
- Alert, don't copy. Send staff a message that says only "New appointment request received." The submission stays in a system covered by a BAA, and staff log in there to read it.
- Automate inside a covered platform. Google lists Apps Script among the Workspace services in its HIPAA included functionality (opens in a new tab), and Microsoft lists Power Automate among its in-scope HIPAA services (opens in a new tab). Automations that stay inside an account under those BAAs don't add an uncovered hop, though each app they touch still has to be on the covered list.
- Collect less. A form that doesn't ask about symptoms has less to leak. See HIPAA-compliant forms for field choices.
Medfy's HIPAA-compliant website forms deliver submissions straight into a patient CRM and inbox, with no zap in between, and patient information is stored in separate, encrypted HIPAA databases in the US or Canada. Read how Medfy handles patient data, or see how other teams organize requests in a patient CRM.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Auditing automations you didn't build
Most practices inherit automations. Work through this list once, then repeat it every quarter:
- Find every account. Ask staff, former freelancers and your agency which Zapier (or Make, or n8n) accounts they created for the practice.
- List each zap: its trigger, the fields it copies, every destination app and the person who owns it.
- Flag PHI. Any zap carrying names alongside visit reasons, bookings, call logs or messages.
- Switch off anything nobody owns. If no current employee can explain it, turn it off.
- Redesign the rest using the patterns above.
- Move account ownership to a practice-controlled login, not a contractor's personal email.
- Record what you did and when, for your HIPAA risk analysis.
A free marketing audit won't see inside your Zapier account, but it does flag tracking pixels on the form pages that feed many of these zaps. Other tools are covered in HIPAA-compliant software.
Frequently asked questions
Will Zapier sign a BAA?
No. Zapier's data privacy page says it 'can't sign business associate agreements (BAAs) or equivalent agreements for handling PHI,' and that healthcare data including PHI 'isn't supported on Zapier.' Its terms also bar uploading or transmitting protected health information. No plan changes that as of October 2026. Ask your compliance officer or attorney how to handle zaps that already moved patient data.
Can I send website form submissions to Google Sheets?
Not through Zapier if the form collects anything about a patient, because Zapier won't sign a BAA. A Google Sheet itself can hold PHI only in a Workspace account whose admin accepted Google's BAA. A safer design keeps submissions in a BAA-covered system and sends staff a plain 'new request' alert. Confirm the redesign with your compliance officer or attorney.
Are Zapier alternatives HIPAA compliant?
Some automation tools sit inside a vendor's BAA. Google lists Apps Script among the Workspace services its BAA covers, and Microsoft lists Power Automate among its in-scope services. Others vary, so check each vendor's own BAA terms for your plan, and remember every connected app needs coverage too. Have your compliance officer or attorney review any automation before patient data flows through it.
How do I find all the automations touching patient data?
Start with the people: ask staff, past freelancers and your agency which automation accounts they set up. In each account, list every zap or workflow with its trigger, the fields it copies, where it sends them and who owns it. Turn off anything nobody owns, then redesign the rest so patient details stay in covered systems. Review the result with your compliance officer.