Note: Only the standalone version of Freshchat facilitates HIPAA compliance.

Freshworks' Commitment to HIPAA Compliance

As a SaaS-based product provider, Freshworks offers several products. There could be instances when customers may use some of our products to process electronic Personal Health Information (ePHI) in their business operations. As per the Health Insurance Portability and Accountability Act (HIPAA) of 1996, should our customers get categorized as either Covered Entity or Business Associate, Freshworks may extend support to their compliance with HIPAA by mutually executing a Business Associate Agreement (BAA).


This document sets forth the Secured Operating Environment (SOE) that is mandatory for Customers (either Covered Entity or Business Associate) to adhere to while using Freshchat to process ePHI. This Guide only applies to Freshchat used on a standalone basis; this Guide doesn't cover Freshchat used as part of Freshsales Suite, Freshsales, or Freshmarketer.  For Freshchat offered as part of Freshdesk Omnichannel, please refer to this Guide for additional required configuration instructions. 


The validity of our BAA is subject to continued adherence by the Customers to the specifications set forth in this document. Freshworks is not responsible for the Customer's usage of their custom mailbox and/or any Apps (as defined in the Customer's agreement with Freshworks). We encourage Customers to use and configure these (if at all) in accordance with their unique circumstances in order to facilitate their continued compliance with HIPAA independently.

Secure Operating Environment

  1. Restricted access: Configure role-based access controls to ensure that access to your agents is limited based on their job responsibilities. Know more.
  2. Identification and Authentication: Enable SAML SSO for users to access their Freshchat account with your unified identification and authentication system and validate users logging into the portal using your script. SAML is a mechanism used for communicating identities between two web applications. It enables web-based Single-Sign-On, eliminating the need to maintain various application credentials and avoid identity theft.
  3. Data Sanitization: In addition, customers can truncate ePHI data in patient conversations by using the data truncation feature in Freshchat, which accepts regex patterns. Customers have to reach out to the product support team ([email protected]) with the regex pattern to enable it on behalf of the Customer. The responsibility for the correctness of the regex patterns will remain with the Customer.
    • Sanitization of User Properties: The responsibility of the Customer to sanitize before sending it to Freshchat 
    • Sanitization of Chat Messaging: Supported, regex-based truncation applied by Freshchat.
  4. End-Point Security: Ensure the end-point systems used by your agents are hardened and secured to protect the healthcare data they process. The systems shall be identified to specific agents, authenticated, configured to be automatically locked down in case of idleness, and secured from malware.
  5. Features and options to be configured:
    • CSAT: The Customer should keep the option "Ask for additional feedback after the user has rated the interaction" disabled. Enabling it will have the risk of ePHI data being shared in the CSAT survey, which is not protected by data sanitization/masking in Freshchat, Customers should not enable this option to adhere to HIPAA Compliance.
    • Email Campaigns: If the Customer uses the email campaigns feature, they need to ensure they configure a custom' reply to' email address that does not come back to Freshworks but to a customer-managed email address. 
  6. Integrations & Apps not to enable: Any integrations or apps with third-party applications that send user data or conversations data outside Freshworks will not be covered under the HIPAA scope.
  7. Notifications to Visitors: As these notifications go through sub-processors like Google-Firebase and Apple Notification service that don't sign a BAA, customers should disable the notification service for visitors using the following instructions to comply with HIPAA regulations.
    1. Turning off notifications to visitors for Web: The default state is on and can be disabled by customers using the following config code during widget init. Steps to disable browser notifications.
    2. Turning off notifications to visitors on Mobile (mobile SDK): The default state is off unless explicitly enabled by the Customer with customer-managed keys. Please do not enable this to comply with HIPAA regulations.
    3. Turning off notifications to visitors via Email: The default state is off unless explicitly enabled by the customer. Please do not enable this to comply with HIPAA regulations.

For information on the information security practices followed at Freshworks, please refer to https://www.freshworks.com/security/.


If you have any questions, please reach out to [email protected].