On this page
No. As of November 11, 2026, Zapier says it can't sign a BAA and that protected health information isn't supported on Zapier, on any plan. A practice can keep Zaps that move practice-side data, like ad leads with no health details or invoices to your bookkeeper. Any Zap that carries intake answers, visit reasons, lab details or patient messages has to be rebuilt in a tool that signs a BAA.
Checked November 11, 2026 on Zapier's data privacy page and its article "Is Zapier HIPAA compliant?". Confirm with Zapier before any patient detail goes through a Zap.
What does Zapier say?
Zapier is unusually clear. Its data privacy page says the use of regulated healthcare and medical data, "including Protected Health Information (PHI) under HIPAA," isn't supported, and that Zapier "can't sign business associate agreements (BAAs) or equivalent agreements for handling PHI."
Zapier's own article on the question opens with "No, Zapier isn't HIPAA compliant" and says you "shouldn't use it to store, send, or automate anything involving protected health information." It suggests healthcare teams use it for operations, marketing and administration, away from medical records.
No plan changes this. Zapier's security attestations, such as SOC 2, are about how it protects data in general. They are not a BAA.
Why "both ends sign a BAA" isn't enough
This is the mistake we see most. A practice has Jotform on Gold with HIPAA on, and Google Workspace with the BAA accepted. Both sign. So a Zap that copies each intake submission into a Google Sheet feels safe.
It isn't. To move the data, Zapier receives it, processes it and keeps it in task history. That makes Zapier a business associate for that data, and Zapier won't sign. The chain is only as covered as its weakest link, and the link in the middle has no BAA.
The same goes for anything else you build on Zapier that stores or reads data, including its AI features. Zapier's own article adds: "You should still never share PHI with an AI tool."
Which Zaps can a practice keep?
Ask one question of every Zap: does any field it touches link a person to their health or care? If not, it can stay.
| Zap | Keep or rebuild | Why |
|---|---|---|
| Meta lead form (name, email, phone) to a sheet | Keep, if the form asks no health questions | Contact details with no health context |
| Meta lead form with "What are your goals?" or "Symptoms?" | Rebuild, or remove the question | The answers are health information |
| Stripe payment to your bookkeeping app | Keep, if product names are generic | "Initial visit" and "Lab fee" say nothing about care |
| Intake form submission to a sheet or CRM | Rebuild | Every answer passes through Zapier |
| New booking in your EHR to a Slack message | Rebuild | The booking shows the person is a patient, often with a visit type |
| Calendar event to a reminder text | Rebuild | Patient name, phone and appointment pass through |
| New blog post to social media | Keep | No patient data at all |
Watch for Zaps that start clean and pick up health details later. A lead Zap built for name and email will happily pass along a new "Reason for inquiry" field the day someone adds it to the ad form.
What to use instead
For the Zaps you have to rebuild, there are three routes, from simplest to most work:
- Do it inside the EHR. Many EHRs send reminders, intake forms and follow-up messages on their own, under their BAA. If yours can do the job, no automation tool needs to touch the data.
- Use an automation tool that signs a BAA. Keragon is built for healthcare automation and lists a BAA on its paid plans in our BAA table. Every app it connects to also needs its own BAA.
- Send a notice, not the data. Some Zaps can be cut down to "A new intake form came in" with no name and no answers. The VA then opens the EHR to see who it was. That keeps Zapier for the nudge and the record where it belongs.
Make, the other big automation tool, is not a safe swap either. We found no BAA on Make's own site, and users in its forum report it doesn't sign one, so treat it as "no" until Make confirms in writing.
A quick audit of your Zapier account
- Export or list every Zap, including ones that are turned off.
- For each, write down the trigger app, every action app and every field mapped.
- Mark any field that could hold health details: free-text answers, visit type, program name, notes.
- Turn off and rebuild the marked Zaps.
- Ask Zapier how to delete task history that already holds patient data.
- Re-check whenever someone adds a field to a form or ad.
The BAA checker tells you which of the apps on each end sign a BAA. For how the pieces fit together, see the HIPAA-safe tool stack for a solo cash-pay telehealth practice.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does Zapier sign a BAA?
No. Zapier's data privacy page says it can't sign business associate agreements for handling PHI, and that regulated healthcare data isn't supported on Zapier (as of November 2026). No plan changes this.
Can a medical practice use Zapier at all?
Yes, for practice-side work with no health details: ad leads that give only name, email and phone, bookkeeping, social posts and internal tasks. Keep intake answers, visit types and patient messages out of every Zap.
Is Zapier HIPAA compliant if both apps sign a BAA?
No. Zapier receives and stores the data while moving it, so it needs a BAA too, and it won't sign one. Use an automation tool that signs a BAA, or let your EHR do the job.
What is a HIPAA-compliant alternative to Zapier?
Keragon is an automation tool built for healthcare that lists a BAA on its paid plans. Many EHRs also handle reminders and forms under their own BAA, which removes the need for a separate automation tool.