Helpdesk platforms such as Gorgias or Zendesk are an option for patient support teams handling PHI, provided they satisfy two requirements. First, you need to have a signed business associate agreement (BAA) from the vendor for any features being used. The next step is confirming that every email leaving the helpdesk is secured. Helpdesks that don't meet these two requirements should only receive messages without protected health information (PHI). This is rare in a patient support inbox.

The HHS Office for Civil Rights (OCR) addresses whether your helpdesk vendor counts as a business associate in its online guidance on HIPAA and Cloud Computing. When a cloud vendor handles ePHI for a covered entity, whether by storing or processing it, that vendor is considered a business associate. Even when the information is encrypted and the vendor has no way to decrypt it, this still applies. Since help desks keep records of all your ticket information, they would meet that definition.

Your helpdesk may create exposure when it comes to emails leaving your helpdesk. According to Paubox's 2026 Healthcare Email Security Report, 41% of organizations that were breached due to email related breaches in 2025 were found to be high risk. That is up from 31% in 2024. Since your helpdesk sends emails to patients throughout the day, it is important to verify that it is configured properly.

 

Why a helpdesk counts as a business associate

HHS makes clear that the conduit rule applies to your vendor only when they do nothing more than transmit information. Ticket history is retained by a helpdesk for months at a time. So they would not fall under the conduit rule.

Every day brings a steady influx of messages into your inbox. A SAGE study reviewed the messages patients sent through the portal at four primary care clinics in Houston. They found that refills and phone calls increased back to their original number after the lockdown in March 2020. "Only electronic messages had a sustained increase." Although this study was only done at one health system in the US, we know that patients are continuing to message us electronically.

All of these messages can contain PHI. Once a message with PHI arrives in your team's queue, a BAA with your helpdesk provider becomes necessary.

 

What to confirm in a helpdesk vendor’s BAA

You will most likely not find that your BAA from your helpdesk vendor covers all of your products. They may only cover certain plans and some of your add-ons. Your helpdesk will likely not have add-ons or apps that allow you to chat through social media, SMS, and other applications that are in beta under their BAA. Zendesk offers this with their Advanced Compliance plan.

 

Since the messages you receive can include administrative questions that contain clinical details, it's important to confirm your helpdesk vendor covers all of your applications under their BAA. A recent study done at Stanford analyzed 30,390 patient messages requesting medical advice from their ophthalmologist. They found that "Nearly half of all messages addressed administrative issues." These messages included patients asking about scheduling, refills and insurance.

 

Why ecommerce integrations need separate review

Ecommerce-focused helpdesks typically come with integrations for platforms like Shopify, Klaviyo, Recharge, and others. The Enterprise page for Gorgias indicates that they are HIPAA compliant. You should always request a BAA from your helpdesk vendor to see what they cover. Keep in mind that your helpdesk BAA won't extend to any other apps you've connected.

If you are selling prescriptions directly to patients, you will want to review all of your integrations. In one American Diabetes Association study, patients with type 2 diabetes who used the patient portal at a North Carolina Endocrinology Clinic, 48.4% of the 882 patients sent at least one message. Many of these were "administrative requests," including not being able to get their medications and supplies. These types of messages will be common for companies that sell products directly to patients.

 

Why outbound email is the weakest point

Your helpdesk is constantly sending out emails. Emails confirming receipt of your ticket, notifying you of an agent's reply, and requesting feedback through surveys. Typically, the message your agent wrote will appear in the body of these emails. Zendesk requires you to let your patient know a reply has come in and that they'll need to sign in to read it. Patients might find this added step annoying, which could lead your team to switch it off.

Beyond the content of your email, you also have to consider how it's being transmitted. Paubox did a technical analysis of Amazon SES. When they sent out test messages with default settings. They found that the email was sent in plain text if the recipient server did not have an encryption option.

 

How HIPAA compliant email fits into a helpdesk workflow

Many helpdesks allow you to send emails through your domain name. In other words, a connector lets you route your helpdesk emails through your Google or Microsoft account.

Paubox Email Suite will allow you to send all of your emails encrypted by default through your Google or Microsoft account. Your email will be sent over TLS 1.2 or higher. If the recipient's email server does not have TLS 1.2 or higher. Paubox will send them a secure link to view their email. This allows your patient to view encrypted emails in their inbox. No portal or password needed. Make sure to test your helpdesk with Paubox before you go live.

 

Your patients may want to continue to use email. According to the HHS email FAQ, you can assume that email is an acceptable method of communication if the patient initiated the message by email. You should still provide a way for your patient to request confidential communications. A Duke study surveyed 15,376 people about their interest in taking part in a study; participants showed more interest when contacted by email than through patient portal messages. Especially for those over the age of 60.

 

Set access controls before the first ticket arrives

Having a BAA in place won't protect you if all of your agents have access to every ticket. You should require your team to have MFA on their accounts. Only allow your agents to view tickets that they are working on and sign in to download attachments. You can also auto-log your agents out after a period of inactivity.

According to Paubox, 74% of the domains that were breached did not have effective DMARC protection. They stated that the misconfiguration of these tools was the leading cause. Make sure that your helpdesk is configured properly for your PHI.

As more and more patients continue to message their providers, your team may grow. Patients in a University of Wisconsin study sent 55.5% more medical advice requests per 8 hours of appointments in 2019 than they did in 2023. Be sure you know which team members will be reading these kinds of messages.

 

Treat AI agents and canned replies as part of the PHI workflow

AI agents, canned responses, and automatic triage are common features in many helpdesks. It's worth verifying that your vendor's BAA applies to these applications as well. You should also ask how these messages are kept on file. Can your team delete or redact them?

According to one JAMA Network study, half of the drop in response rates from care teams was due to writing style. The researchers determined that writing style "may be an important potential source of bias in message triage." If you are using AI to triage your messages, you should be aware of this.

 

What a compliant helpdesk setup cannot solve

Even if you have a BAA in place with your helpdesk and it is configured properly. Your agents will still be writing messages that may violate the minimum necessary. If your agent sends an email to the wrong person it is still a breach. Even if that email is encrypted.

Your patients will also continue to send you messages from their personal email. There is nothing you can do to protect those messages before they reach your inbox. Our study showed that patients kept sending more and more messages. Adding to the workload of administrators, staff, and clinicians. Having a helpdesk in place is one way to keep your PHI secure.

Learn more: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Can patient support tickets be stored on servers outside the US?

HIPAA allows offshore storage when the vendor signs a BAA, but the organization’s risk analysis should account for the added risks of where the data sits.

 

Does an outsourced support agency answering patient tickets need its own BAA?

Yes, an outside agency handling PHI on the organization’s behalf is a business associate and needs a BAA before its staff can access the helpdesk.

 

What happens to patient tickets when a helpdesk contract ends?

The BAA must require the vendor to return or destroy the PHI where feasible, and to keep protecting any data it cannot return or destroy.