Is Zendesk HIPAA Compliant? Yes, With These Steps (2026)

Published June 9, 2020 · Updated July 16, 2026

Is Zendesk HIPAA compliant? Not out of the box, but it can be. Getting there takes four things: an eligible Zendesk Suite plan, the Advanced Data Privacy and Protection add-on (which includes Advanced Compliance), a signed Business Associate Agreement, and more than 50 recommended security configurations implemented before a single piece of protected health information enters the system. Here is exactly what that involves, updated for how Zendesk’s offering actually works in 2026.

Key Takeaways

Zendesk is not HIPAA compliant by default; its standard terms prohibit storing protected health information (PHI) without a Healthcare Agreement in place.
Compliance requires an eligible Suite plan, the Advanced Data Privacy and Protection add-on, Zendesk’s Business Associate Agreement (signed via DocuSign), and 50-plus security configurations across Support, Guide, messaging, and mobile.
The BAA covers only designated Covered Services. Marketplace apps, Early Access Programs, and most third-party integrations are excluded, and Contact Center users need a separate BAA with AWS.
Zendesk’s underlying security is genuinely strong: SOC 2 Type II, ISO 27001, and ISO 27018 certified, with encryption in transit and at rest on every plan.
Faye is a HIPAA-versed Zendesk partner, named Zendesk Partner of the Year for professional services, and configures HIPAA-enabled instances end to end.

Is Zendesk HIPAA Compliant Out of the Box?

No. As one of the most trusted platforms for customer service and support ticketing, Zendesk has a well-deserved reputation for data security. Every plan includes encryption in transit and at rest, and the platform holds SOC 2 Type II, ISO 27001, and ISO 27018 certifications. By any metric, that is a serious amount of data security.

And yet the stock version of Zendesk is not HIPAA compliant. In fact, Zendesk’s standard service terms prohibit customers from storing or transmitting PHI at all unless a Healthcare Agreement is in place. Strong security and HIPAA compliance are related, but they are not the same thing.

Why Isn’t Zendesk HIPAA Compliant by Default?

There is a good reason. The Health Insurance Portability and Accountability Act of 1996, better known as HIPAA, has no official certification program. Instead, it defines a set of protections for protected health information (PHI) that covered entities and their business associates must implement and be able to demonstrate on an ongoing basis. A support system that offered top-of-the-line security in 1996 would be completely inadequate against today’s attackers, which is exactly why HIPAA’s standards are written to evolve with technology.

Healthcare data is an extremely attractive target. PHI can be used for everything from fraud to blackmail, and a criminal who got into a healthcare company’s support database could wreck thousands of lives with a few keystrokes. The controls required to protect that data would be overkill for most Zendesk customers and would raise prices for everyone, so Zendesk offers HIPAA support as a paid capability for the organizations that truly need it.

What Do You Need to Make Zendesk HIPAA Compliant?

Four things, in order:

1. An eligible Zendesk Suite plan. HIPAA support is tied to upper-tier plans; lower tiers do not support it regardless of configuration.
2. The Advanced Data Privacy and Protection add-on. This add-on carries the Advanced Compliance capability, which is what makes an account eligible for a Healthcare Agreement. (If you read about an “Advanced Security add-on” in older articles, including the 2020 version of this post, this is its successor.)
3. A signed Business Associate Agreement. Zendesk offers a standardized BAA, executed via DocuSign, that designates which services are Covered Services for PHI. Zendesk acts strictly as a business associate and is not a holder of the Designated Record Set.
4. The security configuration work. Zendesk publishes recommended security configurations for Healthcare Enabled Accounts, more than 50 settings spanning agent authentication and 2FA, SSL, IP restrictions, API security, attachment protection, notification behavior, Guide permissions, messaging channels, and mobile apps. Implementing them before PHI enters the system is a condition of the agreement, not a suggestion.

Zendesk maintains the authoritative, current list of eligible plans, Covered Services, and configuration requirements in its Advanced Compliance documentation.

What Does Zendesk’s BAA Not Cover?

This is where healthcare teams most often get burned. The Healthcare Agreement covers only the services Zendesk expressly designates. Falling outside it: Marketplace apps, Early Access Programs, and most third-party integrations, including social media messaging channels. If PHI could touch any of those, you either keep it out or sign separate agreements with those vendors.

Two more traps worth naming. Contact Center customers must execute a separate BAA with AWS to cover the integrated Amazon Connect services. And Zendesk’s AI features draw on multiple external model providers, so compliance teams should verify coverage carefully before letting AI touch anything containing PHI.

All of this is why “we signed the BAA” is not the same as “we are compliant.” The agreement is the legal foundation; the configuration and workflow discipline are the actual protection.

How Can Faye Help?

The good news: you do not have to figure out those 50-plus configurations, plan requirements, and BAA boundaries alone. Faye is a HIPAA-versed Zendesk partner, named Zendesk Partner of the Year for professional services, and has configured Zendesk instances for healthcare organizations end to end, from plan and add-on procurement through security configuration, agent workflow design, and ongoing compliance maintenance.

Explore Faye’s Zendesk services and our healthcare and HIPAA compliance practice, and if you are still comparing platforms first, our guide to Zendesk competitors covers the field.

Frequently Asked Questions

Is Zendesk HIPAA compliant?

Not by default, but it can be configured for HIPAA compliance. You need an eligible Zendesk Suite plan with the Advanced Data Privacy and Protection add-on, a signed Business Associate Agreement, and Zendesk’s recommended security configurations implemented before any protected health information enters the system.

Does Zendesk sign a BAA?

Yes. Zendesk offers a standardized Business Associate Agreement that customers with the Advanced Compliance capability can review and sign via DocuSign. The BAA covers specific services Zendesk designates as Covered Services; anything outside that list, including Marketplace apps and most third-party integrations, needs its own compliance review.

Which Zendesk plan do you need for HIPAA compliance?

HIPAA support is tied to upper-tier Zendesk Suite plans that include or can purchase the Advanced Compliance capability, currently delivered through the Advanced Data Privacy and Protection add-on. Zendesk’s Advanced Compliance documentation maintains the current list of eligible plans and Covered Services, and it changes as products evolve.

Are Zendesk apps and integrations covered by the BAA?

Mostly no. Marketplace apps, Early Access Programs, and social messaging integrations sit outside Zendesk’s Healthcare Agreement, so they should not touch PHI unless you sign separate agreements with those vendors. Contact Center users must also execute a separate BAA with AWS to cover the integrated Amazon Connect services.

How long does it take to make Zendesk HIPAA compliant?

Plan on several weeks rather than days. The work spans plan and add-on procurement, executing the BAA, implementing more than 50 recommended security configurations across Support, Guide, messaging, and mobile, then training agents on compliant workflows. A partner who has done it before shortens every one of those steps.

Ready to Get Your Zendesk Instance HIPAA-Ready?

Talk to the team that has done this before. Contact Faye for a free consultation and we will map exactly what your Zendesk instance needs, plan, add-on, BAA, and configuration, to handle PHI safely.

This article is for informational purposes only and does not constitute legal, compliance, or professional advice. HIPAA obligations depend on your organization’s specific circumstances; consult qualified legal counsel or a compliance professional before making decisions about handling protected health information.

By Luke Richmond, Director of Global Professional Services

Luke Richmond holds extensive experience in business analysis, consulting, change management, and project management across CRM and ERP implementations. With a proven track record supporting complex software initiatives, he combines his technical expertise with a people-first approach to deliver impactful results.