---
title: "HIPAA Compliant Help Desk Software: Which Tools Sign a BAA, and on Which Plan"
description: "HIPAA compliant help desk software compared: which tools sign a BAA, the lowest plan that includes one, seat minimums, and which work inside Gmail."
author: "Andrew Rivers"
url: https://www.keeping.com/content/hipaa-compliant-help-desk-software/
datePublished: 2026-11-03
---

# HIPAA Compliant Help Desk Software: Which Tools Sign a BAA, and on Which Plan

> **The short answer:** Most HIPAA compliant help desk software signs a business associate agreement (BAA) only on an upper plan: Help Scout on Pro at $75 per user a month with a 10-user minimum, Zendesk on Suite Professional at $115, and HubSpot on Service Hub Enterprise at $150. Keeping includes the BAA in its $49 HIPAA plan and runs inside Gmail, so your team answers patient email where it already works.

Patient email lands in a shared address like frontdesk@ or billing@, and the moment a help desk sits on top of it, that help desk is handling protected health information. HIPAA compliant help desk software is any tool whose vendor will sign a business associate agreement (BAA) with you and give you the controls to use it safely.

Most major help desks put the BAA on an upper plan. Help Scout includes HIPAA support on Pro only ($75 per user a month, 10-user minimum), Zendesk needs Suite Professional ($115), and HubSpot needs Service Hub Enterprise ($150). Keeping includes the BAA in its $49 HIPAA plan, and your team keeps answering patient email inside Gmail. If you’re comparing an [email ticketing system](https://www.keeping.com/content/email-ticketing-system/) for a clinic, practice or billing office, start with the plan that carries the BAA, then compare features.

## Which help desks sign a BAA? HIPAA compliant help desk software by plan

Nearly every help desk below will sign a BAA. The real differences are which plan you have to buy, the seat minimum that comes with it, and what the agreement leaves out. The table puts those side by side for nine tools a small healthcare team is likely to shortlist.

| Tool | Signs a BAA? | Lowest plan with the BAA | Price per user a month, billed annually | Minimums, add-ons and exclusions | Works inside Gmail? |
| --- | --- | --- | --- | --- | --- |
| Keeping | Yes, included | HIPAA | $49 | 2-user minimum | Yes |
| Zendesk | Yes, through Advanced Compliance | Suite Professional | $115 | Text messaging, Marketplace apps and early-access features not covered | No, separate app |
| Help Scout | Yes | Pro | $75 | 10-user minimum; sold through a demo; AI features need a separate healthcare addendum | No, separate app |
| Freshdesk | Yes | Not named; required IP whitelisting is an Enterprise feature | $89 (Enterprise) | BAA covers Freshdesk, Freshchat, Freshcaller and Freshdesk Omnichannel only | No, separate app |
| HubSpot Service Hub | Yes, with Sensitive Data | Service Hub Enterprise | From $150 | $3,500 one-time onboarding fee | No, separate app |
| Front | Only above an unpublished annual contract value | Not published | Not published | Email notifications, email tags and sending through Front’s own email service not covered | No, your team works in Front |
| Hiver | Yes | Elite | $85 | 2-seat minimum on all plans | Yes, Hiver in Gmail |
| Gmelius | Yes | Enterprise | Custom quote | 50-user minimum | Yes |
| Zoho Desk | Yes, on request | Not published | Not published | Request the BAA from Zoho’s legal team | No, separate app |

Prices are list prices from each vendor’s pricing page and HIPAA documentation on November 3, 2026. “Not published” means the vendor’s own pages don’t say, so ask its sales team before you plan around it.

Among help desks that work inside Gmail, Keeping’s $49 HIPAA plan is the lowest-priced HIPAA plan we have found.

## What makes help desk software HIPAA compliant?

A help desk is HIPAA compliant when the vendor signs a BAA with you and the product gives you the safeguards the HIPAA Security Rule expects, configured the way the vendor’s HIPAA terms say. Full HIPAA compliance is a shared job: the vendor protects the platform, and your team decides who gets access and what goes into a ticket.

Check these before any patient email reaches the tool:

- **A signed BAA.** A business associate agreement is the contract in which the vendor agrees to protect the health information it handles for you. No BAA, no patient data, whatever the security page says.
- **Encryption in transit and at rest.** Messages, attachments and notes should be encrypted on the wire and in storage.
- **A named login for every person.** Each teammate signs in as themselves, with two-step verification or single sign-on. [Shared passwords](https://www.keeping.com/content/secure-email-collaboration/) on a front-desk inbox make it impossible to say who opened a patient’s message.
- **Audit controls.** The Security Rule’s technical safeguards require a way to record and examine activity in systems that hold health information. In a help desk, that means a log of who viewed a conversation and who changed it ([HHS summary of the Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html)).
- **Known gaps in coverage.** Every BAA in the table lists features it doesn’t cover: marketplace apps, text messaging, some email-sending paths. Turn those off for patient inboxes.
- **The minimum necessary.** Keep diagnoses and record numbers out of subject lines and tags, and check whether AI features send ticket text to another company.

## Is Zendesk HIPAA compliant?

Yes. Zendesk signs a BAA through Advanced Compliance, and Suite Professional is the lowest plan that qualifies. Zendesk’s pricing page marks Suite Professional ($115 per agent a month billed annually) and Suite Enterprise as HIPAA enabled, and its Advanced Compliance help article lists Suite Professional, Enterprise and Enterprise Plus.

Some AI search summaries get this wrong. They say Zendesk needs Enterprise or higher for HIPAA and that Professional doesn’t qualify. Zendesk’s own documentation says Professional does. Only the standalone Support Enterprise plan lists HIPAA as an add-on.

Coverage has limits. Zendesk’s text messaging (SMS) isn’t covered, and neither are Marketplace apps, early-access features or other third-party services connected to the account. If your team relies on texting patients or on a Marketplace app, plan for that before you sign.

For a broader look at how Zendesk stacks up for small teams, see [Zendesk vs Help Scout](https://www.keeping.com/content/zendesk-vs-help-scout/). If your team wants to stay in Gmail, there’s also a [Zendesk alternative that works inside Gmail](https://www.keeping.com/zendesk-alternative/).

## Help Scout, Freshdesk and HubSpot: which plan carries the BAA?

All three sign a BAA, and all three reserve it for their top tier. The differences are in how that tier is sold and what the agreement covers.

### Is Help Scout HIPAA compliant?

Yes, on Pro only. Help Scout’s documentation says HIPAA support is included in the Pro plan and nowhere else. Pro costs $75 per user a month billed annually, has a 10-user minimum and is sold through a demo, so a five-person team pays for ten seats. Using Help Scout’s AI features with patient data takes a separate AI healthcare addendum on top of the BAA. A [Help Scout alternative](https://www.keeping.com/helpscout-alternative/) may make more sense if you’re well under ten people.

### Is Freshdesk HIPAA compliant?

Freshworks signs a BAA that covers Freshdesk, Freshchat, Freshcaller and Freshdesk Omnichannel, and nothing else in its product range. It doesn’t name the plan the BAA requires. Its own HIPAA checklist does require IP whitelisting, which the Freshdesk pricing page lists on Enterprise ($89 per agent a month billed annually), so budget for Enterprise. The checklist also asks you to run your own custom mail server. [Freshdesk vs Zendesk](https://www.keeping.com/content/freshdesk-vs-zendesk/) compares the two plan ladders in more detail, and our [Freshdesk alternative](https://www.keeping.com/freshdesk-alternative/) page covers the Gmail route.

### Is HubSpot HIPAA compliant?

HubSpot signs a BAA when you turn on its Sensitive Data setting and confirm you’re a HIPAA covered entity or business associate. That setting needs an Enterprise subscription. For a support team, that’s Service Hub Enterprise, which starts at $150 per seat a month and carries a $3,500 one-time onboarding fee. Most people searching this question mean the HubSpot CRM, and the rule is the same there: the Enterprise tier of whichever hub you use.

## HIPAA help desks that work inside Gmail

If your practice already runs on Google Workspace, you’ve probably accepted Google’s BAA in the Admin console. That agreement covers Gmail itself, but Google states that [third-party apps and add-ons aren’t included](https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity). A help desk that runs inside Gmail still reads and stores your patient email, so it needs its own BAA with you.

That narrows the field. Most [shared inbox software that works in Gmail](https://www.keeping.com/content/best-shared-inbox-software/) wasn’t built with HIPAA in mind, and the tools that do offer a BAA price it very differently:

- **Hiver** lists HIPAA on its Elite plan, $85 per user a month billed annually, with a two-seat minimum. Teams on Growth or Pro would need to move up. Compare plans on our [Hiver alternative](https://www.keeping.com/hiver-alternative/) page.
- **Gmelius** includes the BAA on Enterprise only, which is a custom quote with a 50-user minimum. That rules it out for most clinics and small practices. See the [Gmelius alternative](https://www.keeping.com/gmelius-alternative/) page for the Gmail-native options.
- **Front** connects to Gmail, but your team works in Front’s own app. It signs a BAA only above an annual contract value it doesn’t publish, and email notifications, email tags and sending through its native email service sit outside the agreement. More on that trade-off on our [Front alternative](https://www.keeping.com/frontapp-alternative/) page.
- **Keeping** includes the BAA in its $49 HIPAA plan, with the same 2-user minimum as every Keeping plan. Your team keeps working in Gmail.

If you’ve been trying to [use Gmail as a help desk](https://www.keeping.com/content/gmail-as-help-desk/) with labels and a shared login, the BAA question is often what forces the change.

## What a HIPAA compliant ticketing system costs a five-person team

For five people on annual billing, a HIPAA compliant ticketing system runs from about $2,900 to $12,500 in the first year at list price. Seat minimums and onboarding fees move the totals more than the headline price does.

| Tool and plan | First-year cost for five users, billed annually | What drives it |
| --- | --- | --- |
| Keeping HIPAA | $2,940 | 5 seats at $49 |
| Hiver Elite | $5,100 | 5 seats at $85 |
| Freshdesk Enterprise | $5,340 | 5 seats at $89 |
| Zendesk Suite Professional | $6,900 | 5 seats at $115 |
| Help Scout Pro | $9,000 | 10-user minimum, so 10 seats at $75 |
| HubSpot Service Hub Enterprise | $12,500 | 5 seats at $150, plus $3,500 onboarding |
| Gmelius Enterprise | Custom quote | 50-user minimum |

Front and Zoho Desk are left out because neither publishes the plan or price that carries its BAA.

Elsewhere, HIPAA is usually a reason to sell you the biggest plan. Keeping’s HIPAA plan is $49 per user per month with the BAA included, not an enterprise upgrade.

## How Keeping’s HIPAA plan works

Keeping’s HIPAA plan costs $49 per user per month billed annually ($59 monthly), and the executed BAA is part of it. It includes everything in the Advanced plan, plus an SLA uptime guarantee, custom contract and payment terms, and a dedicated account manager. Getting started follows three steps:

1. **Start the trial with test data.** Connect a shared address and try assignment, internal notes and statuses inside Gmail using made-up messages. A trial account isn’t covered by the BAA.
2. **Request the BAA.** Ask your account manager or support for it, and leave patient details out of that message.
3. **Go live once your account is HIPAA Enabled.** Keeping provisions it after the BAA is signed and the [HIPAA configuration requirements](https://docs.keeping.com/help/security-and-privacy/hipaa-security-configuration-requirements) are met. Patient email goes in after that, not before.

What the account gives you once it’s live:

- **Google sign-in for every teammate.** Each person uses their own Google Workspace account, so there’s no shared password to the patient inbox.
- **A record of who handled what.** HIPAA Enabled accounts keep an append-only log of who viewed each conversation and who changed its status, priority or recipients, retained for six years.
- **SOC 2 Type II controls and US hosting.** Data sits on Google Cloud in the United States, encrypted in transit and at rest.
- **Two ways to connect your address.** Connect the shared mailbox with Google sign-in, or keep your current mail setup and use Keeping’s HIPAA-safe forwarding, which delivers through BAA-covered forwarding domains.

Compare plans on [Keeping pricing](https://www.keeping.com/pricing/), or [see how the HIPAA plan works](https://www.keeping.com/lp/hipaa-compliant-help-desk/) in more detail. When you’re ready, [start your free trial on the HIPAA plan](https://app.keeping.com/signup?plan_id=HIPAA-USD-Yearly). Use test data while you try it; the BAA comes before patient email.

## Frequently asked questions about HIPAA compliant help desks

### Does Zendesk sign a BAA?

Yes. Zendesk signs a business associate agreement through Advanced Compliance, on Suite Professional, Suite Enterprise and Enterprise Plus. Its pricing page marks Suite Professional, at $115 per agent a month billed annually, as HIPAA enabled. Text messaging, Marketplace apps and early-access features stay outside the agreement.

### Is Freshdesk HIPAA compliant?

Freshdesk can be used in a HIPAA compliant way. Freshworks signs a BAA covering Freshdesk, Freshchat, Freshcaller and Freshdesk Omnichannel. It doesn’t name a plan, but its HIPAA checklist requires IP whitelisting, which the pricing page lists on Enterprise at $89 per agent a month billed annually.

### Is HubSpot HIPAA compliant?

HubSpot signs a BAA when you turn on its Sensitive Data setting, which needs an Enterprise subscription. For a support team that means Service Hub Enterprise, from $150 per seat a month plus a $3,500 one-time onboarding fee. A CRM-only team needs the Enterprise tier of the hub it uses.

### Is there a free HIPAA compliant help desk?

Not among the tools compared here. None of their free plans includes a BAA, and a help desk without a signed BAA shouldn’t hold patient information. A self-hosted open-source help desk is an option only if your own team can run, patch and secure the server.

### Do I need a BAA with my help desk if Google already signed one?

Yes. Google’s BAA covers Gmail and the other Workspace services it lists, and Google states that third-party apps and add-ons aren’t included. Any help desk that reads or stores your patient email, including one that runs inside Gmail, needs its own signed BAA with you.

### Can we use the free trial with patient email?

No. Run the trial with test messages and made-up names. Patient email should reach a help desk only after the BAA is signed and the account is set up the way the vendor’s HIPAA terms require. With Keeping, that means a HIPAA Enabled account.