Is Zendesk HIPAA Compliant?

Zendesk can be HIPAA compliant, but it depends on how you configure it and the services you use. If your organization handles Protected Health Information (PHI), here’s what you need to know:

Business Associate Agreement (BAA): Zendesk offers a BAA, but it only covers specific "Covered Services." You must sign this to use Zendesk for HIPAA-compliant workflows.
Security Features: Zendesk includes advanced encryption, access logging, automatic logoff, and other tools to protect PHI.
Plans Required: Only certain Zendesk plans (e.g., Suite Professional or Enterprise) and add-ons like Advanced Compliance support HIPAA standards.
Non-Compliant Features: Some features, such as native SMS, social media integrations, and Early Access Programs, are not HIPAA-compliant.
Your Responsibility: Proper configuration, staff training, and monitoring are essential to ensure compliance.

Quick Overview

Requirement	Details
BAA	Must be signed for HIPAA compliance. Covers only specific services.
Security Setup	Includes encryption, access controls, and data retention policies.
Non-Compliant Features	Avoid using SMS, social media messaging, and unsupported third-party tools.
Plans Needed	Zendesk Suite Professional/Enterprise or equivalent legacy plans.
Your Role	Configure settings, train staff, and monitor compliance regularly.

To use Zendesk in a HIPAA-compliant way, you must carefully evaluate your use case, configure the platform correctly, and ensure ongoing compliance with regulations.

Zendesk Security and Compliance

Security Standards and Data Protection

Zendesk's security framework is built on recognized certifications like SOC2 and ISO27001/ISO27018, along with regular HIPAA audits. The platform includes features such as advanced encryption and detailed access logs to monitor user activity. For organizations managing Protected Health Information (PHI), Zendesk offers specific configurations that align with HIPAA's Technical Safeguards. Key features include:

Advanced encryption protocols to secure data
Detailed access logs for activity tracking
User authentication controls to verify identities
Automatic logoff to prevent unauthorized access
Data retention policies to manage information lifecycle
Redaction tools for handling sensitive data

These measures are designed to help organizations meet compliance requirements effectively.

Business Associate Agreement Requirements

For healthcare organizations using Zendesk, a Business Associate Agreement (BAA) is essential for HIPAA compliance. Zendesk's Advanced Compliance feature allows organizations to establish a formal BAA, ensuring PHI is handled appropriately within the platform.

"Advanced Compliance and the BAA only apply to features and functionality that are expressly stated to form part of the 'Covered Services' in the BAA".

Here are the key points to consider regarding the BAA:

Coverage Limitations
Zendesk acts as a business associate and not the holder of the Designated Record Set. This means organizations are responsible for their own data governance strategies.
Service Restrictions
Some features are not covered under the BAA, such as:
- Early Access Programs (EAPs)
- Zendesk-built apps from the Marketplace
- Services not specifically listed as "Covered Services"
Compliance Verification
Ensure coverage by reviewing documented BAA terms, which outline certifications and internal audit processes.

Security Feature	Purpose	HIPAA Relevance
Advanced Encryption	Protects data in transit and at rest	Maintains PHI confidentiality
Access Logging	Tracks user interactions with PHI	Creates an audit trail
Automatic Logoff	Prevents unauthorized access	Reduces the risk of PHI exposure
Data Retention Controls	Manages the PHI lifecycle	Supports compliant data handling

To stay compliant, organizations should regularly review Zendesk's security updates and adjust their practices as needed.

Setting Up HIPAA-Compliant Zendesk

Required Plans and Features

To ensure HIPAA compliance, you’ll need to subscribe to the Zendesk Suite Professional or Enterprise plans. These plans include key features designed for HIPAA compliance:

Feature Category	Included Functionality
Core Services	Support (Ticketing System)
	Guide (Help Center)
	Gather (Community Forum)
	Chat and Messaging
	Explore (Analytics)
AI Capabilities	Auto Assist
	Suggested First Replies
	Ticket Summaries
	Call Summaries and Transcriptions
Add‑ons	Advanced Data Privacy and Protection
	Copilot
	Premium Sandbox
	Workforce Management
	Quality Assurance

Keep in mind that the Advanced Compliance and Business Associate Agreement (BAA) apply only to features explicitly listed as "Covered Services" in the agreement.

Once you’ve selected the right plan, the next step is configuring your security settings to meet HIPAA standards.

Security Configuration Steps

Follow these steps to set up your Zendesk account for HIPAA compliance:

Initial Setup
Purchase Advanced Compliance and consult with your Zendesk representative to get started.
BAA Implementation
Complete the BAA through DocuSign. You’ll need to provide:
- Your legal entity name
- Authorized signatory details
- Zendesk account number(s)
- Verification of the Master Subscription Agreement
Security Controls
Set up critical security measures, including:
- Advanced encryption protocols
- Strict access controls
- Automatic session timeouts
- Detailed audit logging
- Data retention policies
Feature Management
Disable any features that are not HIPAA-compliant, such as:
- Text functionality within Talk
- Early Access Programs (EAPs)
- Built by Zendesk Applications from the Marketplace
- Services not explicitly listed as "Covered Services"

It’s important to regularly review Zendesk’s security documentation. Regulatory updates or platform changes may require adjustments to your configuration.

Compliance Boundaries and Requirements

Non-HIPAA Compliant Services

Zendesk provides HIPAA compliance for certain services, but some features are excluded. It's crucial to know these limitations to prevent accidental sharing of PHI through non-compliant channels:

Service Category	Non-Compliant Features
Communication	Native SMS and Text functionality; Social media messaging channel integrations
Platform Features	Standalone Sunshine Conversations; Net Promoter Score (NPS) Surveys
Third-Party Tools	Marketplace applications; Third-party integrations
Development	Early Access Programs (EAPs)

For example, using Zendesk's native SMS feature to send patient appointment reminders would violate compliance rules. While Zendesk outlines these platform boundaries, ensuring full compliance ultimately falls on the organization.

Organization Compliance Tasks

Once you understand Zendesk's non-compliant features, your organization must take specific actions to meet compliance standards:

Security Configuration Management
Keep Zendesk's security settings updated to align with regulations.
User Access Control
Implement strict access controls for PHI by:
- Assigning appropriate access levels to staff
- Using role-based permissions
- Monitoring activity logs
- Enforcing strong password policies
- Performing regular access reviews
Documentation and Monitoring
Track and document all PHI-related activities, including:
- Security incident responses
- System changes affecting PHI access
- Adherence to configuration guidelines
Third-Party Management
When working with external vendors, ensure:
- Third-party integrations meet HIPAA standards
- Business Associate Agreements (BAAs) are in place
- Regular audits of vendor access and use are conducted
Operational Requirements
Healthcare organizations should:
- Follow Zendesk's security recommendations and review updates as they are released
- Comply with the Privacy Rule's patient rights provisions
- Properly manage the Designated Record Set, as Zendesk does not handle this responsibility

Strengthening HIPAA Protection

Security Add-ons and Tools

Boost HIPAA compliance by leveraging additional security tools. Data Loss Prevention (DLP) solutions help protect Protected Health Information (PHI). For example, Strac's DLP integration with Zendesk offers automated PHI detection and redaction for tickets, comments, and attachments.

Some key features include:

Real-time PHI Detection: Automatically scans support tickets to identify and minimize PHI exposure.
Customizable Security Settings: Adjust sensitivity thresholds and create specific redaction rules for PHI.
Historical Data Protection: Scan archived tickets for PHI, identify sensitive content, and apply redactions as needed.

Pair these technical measures with thorough staff training to maintain compliance.

Staff Training and Oversight

Technology alone isn’t enough - proper staff training is essential for maintaining HIPAA compliance when using Zendesk. Healthcare organizations should implement training programs that address both technical and procedural aspects of PHI handling.

Here’s a breakdown of training areas:

Training Component	Key Focus Areas	Implementation Requirements
Platform Usage	Handling PHI in tickets, secure communication	Initial onboarding and quarterly refreshers
Security Protocols	Access control, password policies, session security	Monthly updates and assessments
Incident Response	Identifying and reporting breaches, remediation	Bi-annual drills and reviews

To ensure compliance is upheld, organizations should also adopt continuous monitoring practices:

Regular Compliance Audits: Review Zendesk usage patterns and security configurations. This includes monitoring access logs, ticket handling, and PHI protection measures.
Configuration Management: Keep up with Zendesk's latest security updates and recommended settings to maintain PHI protection.
Documentation and Reporting: Maintain detailed records of security-related activities, such as:
- Staff training completions
- Incident reports
- Configuration changes
- Access reviews

These combined efforts create a stronger defense against potential HIPAA violations.

Making Your HIPAA Compliance Decision

Use the table below to determine if Zendesk meets your HIPAA requirements:

Assessment Area	Requirements	Implementation Considerations
Platform Subscription	HIPAA-enabled Zendesk plan	Confirm pricing and features with your account representative.
Legal Documentation	Business Associate Agreement (BAA)	Review and sign via DocuSign.
Security Configuration	Required security settings	Follow Zendesk's recommended configurations.
Service Coverage	Covered vs. non-covered services	Note: Native SMS/Text functionality is not HIPAA-compliant.
Organizational Readiness	Staff training and protocols	Ensure regular updates and ongoing compliance monitoring.

This framework helps you align your implementation with Zendesk's security features. Zendesk upholds compliance through SOC2 and ISO27001/ISO27018 certifications, along with internal HIPAA audits.

Steps to Implement Compliance

To meet HIPAA requirements, take these key actions:

Apply Zendesk's required security settings to ensure compliance.
Review third-party integrations to confirm they meet HIPAA standards or disable them if necessary.
Set up notification controls to prevent accidental disclosure of PHI.
Adhere to the Privacy Rule, ensuring patient rights are protected.

These actions supplement Zendesk's security configuration guidelines. If you need further assistance, reach out to your Zendesk account representative to ensure your setup meets HIPAA standards while safeguarding PHI.