Last verified: October 22, 2026, against Zendesk's trust center, BAA page, pricing page and two Zendesk help articles. General information, not legal advice.
Is Zendesk HIPAA compliant? Zendesk will sign a business associate agreement (BAA), but only for a "HIPAA-Enabled Account": the right add-on or Suite plan, a list of required security settings switched on, and only certain Zendesk products in use. Get any of the three wrong and patient messages land somewhere the BAA doesn't reach. Few people search this (about 40 a month in the US), yet advertisers pay around $53.66 a click for it (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
Short answer from Zendesk's own documentation
Short answer (verified October 2026): Zendesk's trust center (opens in a new tab) says: "To achieve a HIPAA-Enabled Account, you will need to (1) purchase the Advanced Security Deployed Associated Service or Advanced Compliance Deployed Associated Service Add-On; (2) enable a set of security configurations as outlined by Zendesk; and (3) execute our Business Associate Agreement ("BAA")." Its pricing page (opens in a new tab) shows "HIPAA Enabled" on Suite Professional and adds: "The Zendesk Business Associate Agreement (BAA) is available for execution by Subscribers."
The BAA page (opens in a new tab) works through an online launch form. The signer enters the practice's legal details and the Zendesk account numbers to be HIPAA-enabled, and a signed copy is emailed back. The BAA "is not valid" if signed by an entity that isn't party to the Zendesk contract, so have the person or company on your order form sign it.
Zendesk AI is "eligible for coverage under Zendesk's Business Associate Agreement," per the trust center, but customers "must have access to the Advanced Compliance Add-on."
What HIPAA requires before patient information goes in
A help desk stores every message patients send, which makes Zendesk a vendor that will "create, receive, maintain, or transmit protected health information" for your practice. HIPAA requires documented "satisfactory assurance" before that happens (45 CFR 164.502(e) (opens in a new tab)), in a written contract that meets 45 CFR 164.504(e) (opens in a new tab). See our guide to business associate agreements for what that contract covers.
Zendesk is unusually explicit that signing is step three of three. Its configuration requirements are conditions of the HIPAA-enabled account, not suggestions, and most of them are settings your admin controls.
Before you route patient messages anywhere, check what your website does with them first. The free marketing audit flags privacy risks such as ad pixels on patient forms.
Which Zendesk plans a BAA can cover
| Plan | Listed price (per agent/month, billed annually) | HIPAA-enabled account? |
|---|---|---|
| Support Team | See pricing page | No (dash on pricing page) |
| Suite Team | $55 | No |
| Suite Professional | $115 | Yes, "HIPAA Enabled" |
| Suite Enterprise | Through sales | Listed as eligible in Zendesk's help center |
| Enterprise Support (current and legacy) | Through sales | Listed as eligible |
Prices from zendesk.com/pricing, October 22, 2026. There's no free plan, only a 14-day trial.
The plan is half the answer. Zendesk's Advanced Compliance article (opens in a new tab) lists which services can be HIPAA-enabled:
- Covered: Support, Guide, Gather, Chat and Zendesk messaging, Explore, Talk (voice only, excluding text), and Sunshine Conversations within Suite.
- Not covered: "Any other Zendesk products or third party services," including integrations such as social media messaging channels and Marketplace apps.
- Keep PHI out of: Early Access Programs and Built by Zendesk apps, which "should not be used with PHI."
Note the Talk exception: voice calls are covered, text messages through Talk aren't.
Support tickets, chat and attachments
Zendesk's configuration requirements (opens in a new tab) (last changed May 13, 2026) get specific. The ones a practice is most likely to miss:
- Attachments. Turn on "require authentication for download." Without it, "any unrestricted attachment may be accessed by anyone with access to the correct URL."
- Messaging uploads. Disable end-user file attachments, then use secure attachments or make sure agents don't attach ePHI. End-user attachments on messaging "are currently not scanned for malware."
- Email notifications. Alert patients that a reply exists without including its content, and "require the End-User to authenticate into Zendesk Support to see the contents." Zendesk "is not responsible for securing email transmissions from End-Users."
- Chat transcripts. "Subscriber should not send Chat transcripts via email."
- Satisfaction surveys. Keep the survey email free of PHI, use only the survey link, and skip open-ended questions.
- Help center. Guide and Gather are "public by nature," so articles, attachments and community posts must hold no PHI.
- Agent access. Enforce two-factor authentication, keep SSL on "at all times," and lock agent screens after at most 15 minutes.
Two limits to plan around: redaction "is not available in the Support Mobile Application," and AI conversations turned into tickets "cannot currently be redacted."
Safe uses and unsafe uses for a practice
| Use | Verdict |
|---|---|
| Vendor, recruiting or website-feedback inbox where no patient writes in | Safe without a BAA, if it stays that way |
| Patient billing and scheduling questions on a HIPAA-enabled Suite Professional account, settings applied | Appropriate |
| Patient chat on your website through Zendesk messaging, HIPAA-enabled | Appropriate, with attachments locked down |
| Text messages through Zendesk Talk | Unsafe for PHI: Talk is covered for voice only |
| Patient questions via a social messaging integration | Unsafe: integrations aren't covered |
| A Marketplace app that reads ticket content | Unsafe unless that vendor signs its own BAA |
| Emailing full ticket replies to patients | Unsafe under Zendesk's own requirements |
Safer setup or alternatives
If patients already write to your Zendesk, treat this as a project with an owner: confirm the add-on is on your contract, sign the BAA from the contracting entity, work through every configuration requirement, then remove integrations and apps that aren't covered.
If you're choosing now, start with what your EHR offers: secure messaging inside the patient portal keeps conversations with the chart. For a broader CRM, compare our HubSpot verdict. If the goal is a website assistant, our guide to HIPAA and AI chatbots covers what changes when software writes the replies. The HIPAA and marketing software hub lists the rest.
Medfy doesn't sell Zendesk. For website chat specifically, Medfy's HIPAA AI chat widget ($49/month add-on) answers patients from the practice's own information, hands off to the team when needed and is covered by the practice's BAA. Chat and form submissions are stored in separate, encrypted HIPAA databases in the US or Canada. See how Medfy handles patient data.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Will Zendesk sign a BAA?
Yes. Zendesk's trust center says a HIPAA-enabled account takes three steps: buy the Advanced Security or Advanced Compliance add-on, enable the security configurations Zendesk specifies, and execute its BAA. The BAA is signed online through a launch form by the entity on the Zendesk contract, listing the account numbers to be HIPAA-enabled. Zendesk's pricing page shows HIPAA enabled on Suite Professional. Verified October 2026.
Is the free version of Zendesk HIPAA compliant?
Zendesk has no free plan, only a 14-day trial, and a trial isn't the place for patient information. Its pricing page shows HIPAA enabled on Suite Professional, listed at $115 per agent per month billed annually, and not on Suite Team. Zendesk's help center lists Suite Professional or Enterprise and Enterprise Support as the plans eligible for HIPAA-enabled accounts.
Can a practice use Zendesk without patient information?
It's hard for a medical practice. Patients write in about appointments, bills and symptoms, and once a ticket names a patient and their care it holds PHI. Zendesk works without a BAA only for traffic that never involves patients, such as a vendor or job-applicant inbox. If patients can reach the help desk, plan for a HIPAA-enabled account.
What is a HIPAA-compliant alternative to Zendesk?
For patient messages, the secure messaging or patient portal in your EHR is usually the first choice, since it sits under a BAA you already have and keeps conversations with the chart. If you need a full help desk, compare vendors on whether they sign a BAA for your plan, which channels it covers and what settings it requires. HubSpot is a common comparison.