Every connection into QR Rx carries a patient's name and a way to reach them. Under HIPAA, any company that handles that information on your behalf must sign a Business Associate Agreement with your clinic first. QR Rx signs one. Zapier does not.
Zapier states in its own documentation that it does not sign a Business Associate Agreement and does not support HIPAA workloads, on any plan. A Zap that copies a completed appointment into QR Rx would pass the patient's name, phone, and procedure through Zapier's servers without that agreement. That is your clinic's exposure, not Zapier's, so QR Rx will not route patient information through it and does not publish Zapier recipes.
Some systems, Aesthetic Record among them, publish no API and offer Zapier as their only outbound connection. QR Rx cannot connect those automatically today. Use CSV import or the intake page, and tell QR Rx which system you use. We ask vendors for a direct webhook or a partner integration, and the more clinics that name a system, the sooner it moves.
A connection tool that will sign a Business Associate Agreement with your clinic, or one you run yourself inside your own systems, can be reviewed. Contact QR Rx support before sending patient information through it so we can confirm the agreement and the setup together.