Is Zapier HIPAA Compliant?

No. Zapier states that it is not HIPAA compliant, does not sign a Business Associate Agreement (BAA) and must not be used to store, send or automate protected health information (PHI). Its published Enterprise agreement FAQ also says it does not offer a BAA.

For a healthcare organization automating incoming faxes or records requests, that makes the data path decisive. A permitted fax account or destination does not authorize routing patient information through Zapier in between.

What does Zapier’s policy mean for a patient-fax workflow?

Zapier’s terms effective April 9, 2026 prohibit uploading or transmitting Sensitive Personal Data, a category that includes patient, medical and HIPAA-regulated information. The restriction is broader than whether a document is attached to an automation.

A paid subscription, Enterprise plan, encrypted connection or SOC 2 report does not supply the missing BAA or override the published PHI policy. Assess security evidence within its scope rather than treating it as contractual permission.

If your organization is a covered entity or business associate selecting providers to handle electronic PHI, review each provider’s role and agreement. The BAA from an upstream fax service does not cover a separate automation platform.

Where can PHI enter fax automation?

Consider a proposed workflow that reacts to a new referral fax and routes information into another system. The PDF is one possible disclosure, but the event can also carry information identifying the patient or revealing care.

Review the complete path before connecting a live account:

• Trigger and testing: Which fields, sample records, file names, numbers, identifiers or links enter the automation service?
• Processing and actions: Which steps receive the original payload, extracted content or destination details, and which other services receive the result?
• History and operational records: What remains in test data, execution history, retries, error messages, alerts or downstream storage?

A later filter cannot undo information already received in an earlier step. Likewise, a workflow that looks harmless at its final output can still expose patient information in its trigger or execution history.

Does removing the fax attachment make the workflow suitable?

Not automatically. A fax number, patient-linked identifier, file title or document URL can reveal sensitive context without the PDF itself. Review the content and relationships, rather than judging the payload only by its format.

Removing names or replacing them with a token does not by itself establish HIPAA de-identification. HHS describes specific de-identification standards; the applicable method and resulting data need appropriate assessment.

For Fax.Plus accounts with Advanced Security Controls, the Zapier connection is disabled regardless. An attachment-free payload does not change that product restriction.

Can a healthcare organization use Zapier without PHI?

Zapier’s guidance allows healthcare-related work that does not involve PHI, subject to its terms and other applicable obligations. A genuinely non-PHI administrative workflow can therefore be assessed separately from handling patient documents.

Establish what the actual trigger, actions and histories contain. Do not presume that scheduling, billing, reminders or an aggregate-looking output are free of patient information merely because their labels sound administrative.

The absence of PHI also does not override restrictions on other Sensitive Personal Data. Evaluate the complete information and service terms before using a workflow in an organization.

Why is Zapier unavailable under Fax.Plus ASC?

Fax.Plus deactivates Zapier when Advanced Security Controls (ASC) are enabled. This is the current integration restriction, rather than an optional setting for each patient document. The ASC integration documentation also confirms that the API remains available.

For Fax.Plus organizational PHI handling, the account prerequisites are Enterprise, enabled ASC and a signed BAA. Enterprise alone is insufficient, and the availability of a general Zapier connector on other configurations does not establish healthcare eligibility.

API availability does not provide an exception for routing PHI through Zapier. A custom request, webhook, formatter or code step still introduces the platform into the data path; it does not extend the fax provider’s agreement.

What is an alternative for patient-fax automation?

A direct, properly assessed integration using the Fax.Plus API is a separate implementation option. It requires the eligible Enterprise account, enabled ASC and signed BAA, together with an approved environment for the rest of the workflow.

Assess the systems receiving documents, authentication and permissions, storage, operational logs, error handling and destinations. Every service handling electronic PHI needs an appropriate contractual and technical arrangement for its role.

Keep that architecture outside a platform that prohibits the data. Connecting the same API through Zapier does not create an approved alternative. The HHS cloud guidance explains the responsibilities of covered entities and business associates using cloud providers.

A small practice does not need to commission custom development for every fax task. It can continue handling documents in its approved fax environment while evaluating whether automation justifies the implementation and governance work.

What should you establish before using live documents?

Identify the task you want to automate, the services involved and the information each receives. Confirm their agreements and account configurations, then test the proposed behavior using synthetic documents rather than real patient records.

Define who handles a failed action, where the authoritative document remains and how staff confirm completion. A successful technical transmission or automation run does not prove that a clinician reviewed the document or that a patient chart was updated correctly.