Is Zendesk HIPAA Compliant?

Zendesk can be HIPAA compliant, but it depends on how you configure it and the services you use. If your organization handles Protected Health Information (PHI), here’s what you need to know:

• Business Associate Agreement (BAA): Zendesk offers a BAA, but it only covers specific "Covered Services." You must sign this to use Zendesk for HIPAA-compliant workflows.

• Security Features: Zendesk includes advanced encryption, access logging, automatic logoff, and other tools to protect PHI.

• Plans Required: Only certain Zendesk plans (e.g., Suite Professional or Enterprise) and add-ons like Advanced Compliance support HIPAA standards.

• Non-Compliant Features: Some features, such as native SMS, social media integrations, and Early Access Programs, are not HIPAA-compliant.

• Your Responsibility: Proper configuration, staff training, and monitoring are essential to ensure compliance.

Quick Overview

To use Zendesk in a HIPAA-compliant way, you must carefully evaluate your use case, configure the platform correctly, and ensure ongoing compliance with regulations.

Zendesk Security and Compliance

Security Standards and Data Protection

Zendesk's security framework is built on recognized certifications like SOC2 and ISO27001/ISO27018, along with regular HIPAA audits. The platform includes features such as advanced encryption and detailed access logs to monitor user activity. For organizations managing Protected Health Information (PHI), Zendesk offers specific configurations that align with HIPAA's Technical Safeguards. Key features include:

• Advanced encryption protocols to secure data

• Detailed access logs for activity tracking

• User authentication controls to verify identities

• Automatic logoff to prevent unauthorized access

• Data retention policies to manage information lifecycle

• Redaction tools for handling sensitive data

These measures are designed to help organizations meet compliance requirements effectively.

Business Associate Agreement Requirements

For healthcare organizations using Zendesk, a Business Associate Agreement (BAA) is essential for HIPAA compliance. Zendesk's Advanced Compliance feature allows organizations to establish a formal BAA, ensuring PHI is handled appropriately within the platform.

"Advanced Compliance and the BAA only apply to features and functionality that are expressly stated to form part of the 'Covered Services' in the BAA".

Here are the key points to consider regarding the BAA:

1. Coverage Limitations
   

   Zendesk acts as a business associate and not the holder of the Designated Record Set. This means organizations are responsible for their own data governance strategies.

2. Service Restrictions
   

   Some features are not covered under the BAA, such as:

   • Early Access Programs (EAPs)

   • Zendesk-built apps from the Marketplace

   • Services not specifically listed as "Covered Services"

3. Compliance Verification
   

   Ensure coverage by reviewing documented BAA terms, which outline certifications and internal audit processes.

To stay compliant, organizations should regularly review Zendesk's security updates and adjust their practices as needed.

Setting Up HIPAA-Compliant Zendesk

Required Plans and Features

To ensure HIPAA compliance, you’ll need to subscribe to the Zendesk Suite Professional or Enterprise plans. These plans include key features designed for HIPAA compliance:

Keep in mind that the Advanced Compliance and Business Associate Agreement (BAA) apply only to features explicitly listed as "Covered Services" in the agreement.

Once you’ve selected the right plan, the next step is configuring your security settings to meet HIPAA standards.

Security Configuration Steps

Follow these steps to set up your Zendesk account for HIPAA compliance:

1. Initial Setup
   

   Purchase Advanced Compliance and consult with your Zendesk representative to get started.

2. BAA Implementation
   Complete the BAA through DocuSign. You’ll need to provide:

   • Your legal entity name

   • Authorized signatory details

   • Zendesk account number(s)

   • Verification of the Master Subscription Agreement

3. Security Controls
   

   Set up critical security measures, including:

   • Advanced encryption protocols

   • Strict access controls

   • Automatic session timeouts

   • Detailed audit logging

   • Data retention policies

4. Feature Management
   

   Disable any features that are not HIPAA-compliant, such as:

   • Text functionality within Talk

   • Early Access Programs (EAPs)

   • Built by Zendesk Applications from the Marketplace

   • Services not explicitly listed as "Covered Services"

It’s important to regularly review Zendesk’s security documentation. Regulatory updates or platform changes may require adjustments to your configuration.

Compliance Boundaries and Requirements

Non-HIPAA Compliant Services

Zendesk provides HIPAA compliance for certain services, but some features are excluded. It's crucial to know these limitations to prevent accidental sharing of PHI through non-compliant channels:

For example, using Zendesk's native SMS feature to send patient appointment reminders would violate compliance rules. While Zendesk outlines these platform boundaries, ensuring full compliance ultimately falls on the organization.

Organization Compliance Tasks

Once you understand Zendesk's non-compliant features, your organization must take specific actions to meet compliance standards:

1. Security Configuration Management
   

   Keep Zendesk's security settings updated to align with regulations.

2. User Access Control
   

   Implement strict access controls for PHI by:

   • Assigning appropriate access levels to staff

   • Using role-based permissions

   • Monitoring activity logs

   • Enforcing strong password policies

   • Performing regular access reviews

3. Documentation and Monitoring
   

   Track and document all PHI-related activities, including:

   • Security incident responses

   • System changes affecting PHI access

   • Adherence to configuration guidelines

4. Third-Party Management
   

   When working with external vendors, ensure:

   • Third-party integrations meet HIPAA standards

   • Business Associate Agreements (BAAs) are in place

   • Regular audits of vendor access and use are conducted

5. Operational Requirements
   

   Healthcare organizations should:

   • Follow Zendesk's security recommendations and review updates as they are released

   • Comply with the Privacy Rule's patient rights provisions

   • Properly manage the Designated Record Set, as Zendesk does not handle this responsibility

Strengthening HIPAA Protection

Security Add-ons and Tools

Boost HIPAA compliance by leveraging additional security tools. Data Loss Prevention (DLP) solutions help protect Protected Health Information (PHI). For example, Strac's DLP integration with Zendesk offers automated PHI detection and redaction for tickets, comments, and attachments.

Some key features include:

• Real-time PHI Detection: Automatically scans support tickets to identify and minimize PHI exposure.

• Customizable Security Settings: Adjust sensitivity thresholds and create specific redaction rules for PHI.

• Historical Data Protection: Scan archived tickets for PHI, identify sensitive content, and apply redactions as needed.

Pair these technical measures with thorough staff training to maintain compliance.

Staff Training and Oversight

Technology alone isn’t enough - proper staff training is essential for maintaining HIPAA compliance when using Zendesk. Healthcare organizations should implement training programs that address both technical and procedural aspects of PHI handling.

Here’s a breakdown of training areas:

To ensure compliance is upheld, organizations should also adopt continuous monitoring practices:

• Regular Compliance Audits: Review Zendesk usage patterns and security configurations. This includes monitoring access logs, ticket handling, and PHI protection measures.

• Configuration Management: Keep up with Zendesk's latest security updates and recommended settings to maintain PHI protection.

• Documentation and Reporting: Maintain detailed records of security-related activities, such as:

  • Staff training completions

  • Incident reports

  • Configuration changes

  • Access reviews

These combined efforts create a stronger defense against potential HIPAA violations.

Making Your HIPAA Compliance Decision

Use the table below to determine if Zendesk meets your HIPAA requirements:

This framework helps you align your implementation with Zendesk's security features. Zendesk upholds compliance through SOC2 and ISO27001/ISO27018 certifications, along with internal HIPAA audits.

Steps to Implement Compliance

To meet HIPAA requirements, take these key actions:

• Apply Zendesk's required security settings to ensure compliance.

• Review third-party integrations to confirm they meet HIPAA standards or disable them if necessary.

• Set up notification controls to prevent accidental disclosure of PHI.

• Adhere to the Privacy Rule, ensuring patient rights are protected.

These actions supplement Zendesk's security configuration guidelines. If you need further assistance, reach out to your Zendesk account representative to ensure your setup meets HIPAA standards while safeguarding PHI.

Related posts

• Hidden Security Risks In Zendesk Apps

• How to Make Zendesk HIPAA Compliant

• Why you need the Zendesk + Workday Integration