Why isn't HIPAA compliance supported?

 @The Automator and @akhp we have your interest recorded for this. Unfortunately, no updates as of yet. I am going to close this thread until we have an update to share but please feel free to direct follow-up questions around this topic to our support team and they can help in the meantime: https://zapier.com/app/get-help

@The Automator 

Your only viable option is pretty much having an integration built between the two (or more) respective applications using their API’s you wish to integrate. We only use Zapier for non-HIPAA related matters, and even then due to Zapier costs and limitations in delays in tasks, some integrations a better done ourselves via those respective API’s.

It appears that with Zapier, most components if not all of the required and even most addressable requirements under HIPAA Security Rule are met.  

@DrCase , I would not recommend the advice from @blueguy without further consulting with an attorney.  §164.502(d) of the Privacy Rule permits a covered entity or its business associate to create information that is not individually identifiable by following the de-identification standard and implementation specifications in §164.514(a)-(b). However, I don’t believe the method suggested may meet those standards as it would still be a new individual identifier.

https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#standard

Any organization dealing with ePHI should also carefully consult with an attorney who understands software/tech and HIPAA/HITECH regulations.

All technical requirements aside, Zapier must also offer to execute Business Associate Agreements as well-- which they do not. Users should not believe that they can be HIPAA compliant on the simple basis that Zapier is not providing any “guarantee” and that the User would be fully responsible, as the requirement for a BAA is a clear requirement in order to meet the standards under HIPAA/HITECH.
 

Additionally, if Zapier was to learn you are using the system to handle ePHI, it would automatically have obligations as outlined by federal law, which likely would mean it would have no choice but to suspend your services and make a report of the violation to the Office of Civil Rights for the US Dept. of Health and Human Services.

The lack of Zapier (or any vendor for that matter) not signing a BAA and not officially allowing their system for use with ePHI, does not mean they are completely resolved of obligations under the law should they become aware of it’s use with ePHI.

@christina.d , I hope this is something you review as well.

Any updates on this

am going to have to leave and love Zapier !

 Thanks 

Pls add my vote as well. 

Hi there, @Joseph Moore. Thank for reaching out and sharing your candid feedback! I’ve got your vote added to this feature request. While I don’t have an update or ETA to offer at the moment, we’ll definitely send an email as soon we have one to share.

Thanks for reaching out, @uuainsuranceplans! I don’t have any updates to provide at the moment but I did go ahead and share your thoughts with the team. We’ll be sure to keep you posted when and if we hear more about this. 🙂

Thanks for outlining your use case so clearly, @DrCase! I’ve passed your feedback and vote along to this feature request. While we don’t have updates to share at the moment around when/if this will become available, we’ll be sure to keep you in the loop as soon as we know more. 🙂

As one of the many new healthcare tech startups flooding the market, I’ll mention my use case:  As a healthcare provider, I need a HIPAA compliant fax service.  Zendesk for enterprise, which is HIPAA compliant, is our front end, but has no fax features.   I signed up Fax.plus, and would love to use Zapier to integrate it with Zendesk, but activating the HIPAA compliance features of Fax.plus turns off integration with Zapier. 

Sure I cast a paper ballot and you can count it twice!!

Yes you have my vote for HIPAA compliance.

Here is your work around on this issue; correct Zapier is not Hipaa compliant.  You can connect your JotForm to Google Sheets and this is Hipaa compliant.  Call this Google Sheet #1.  Create a second Google Sheet #2 with a simple important range / query function leaving out the personal identifiers or PHI.  Send the information from the JotForm (which has a unique identifier) and Google Sheet #2 back to Zapier utilizing the Submission ID as the unique identifier.  When Zapier is done with the data send it back to Google Sheet #3 and use the Submission ID to query the PHI data and personal identifiers from Google Sheet #1.  

We use these tools and in essence we never have PHI data travel with Personal identifiers.

Hope that helps!

Hi

Any update on this . We are UK based and use Zapier for all our processes we are expanding internationally and I am disappointed to see it is not HIPAA compliant which will be essential for us 

thanks

Add me to the list, too, please.  We're a Zapier partner and this is what many of our customers need to properly roll out zapier in an enterprise environment.