Plan requirement
| Subscription | Suite Professional or higher, Support Enterprise |
| Access | Admin |
Not as a yes or no. Zendesk's own wording is that it "provides a security feature that includes the ability to configure for HIPAA compliance", and that compliance with HIPAA depends on how you use the software. HIPAA places obligations on organisations, not on products: a tool can support those obligations or make them harder to meet, and it cannot discharge them for you.
What does a HIPAA-enabled account take?
Three things, and all of them:
- The Advanced Compliance add-on, bought directly or included in your plan.
- A signed Healthcare Agreement, the business associate agreement, with Zendesk.
- A Suite Professional, Enterprise or Enterprise Plus plan, or the equivalent Enterprise Support plan.
On top of that the account has to be configured to the conditions the agreement carries, and your working practices have to match: who may open which tickets, what leaves in an export, what agents paste elsewhere. Configuration is checkable; habits are what go wrong.
What is never covered?
Some things sit outside the Healthcare Agreement whatever you configure, and should not be used with health information at all:
- Early Access Programs.
- Marketplace applications, including the ones built by Zendesk.
- Integrations, social media messaging channels among them.
That third one catches healthcare teams out, because a WhatsApp or Facebook channel looks like any other way into the same queue.
None of this is legal advice: what you must do is determined by your obligations and your counsel. Talk to us before health information goes into Zendesk and we will go through what has to be in place for your account.
Comments
0 comments
Article is closed for comments.