HIPAA Compliance
How SparrowDesk enables HIPAA compliance for covered entities: our role as a Business Associate, HIPAA mode safeguards, security best practices and how we verify them.
Last updated Nov 2, 2026
HIPAA Compliance SparrowDesk
Your business’s privacy & security is our top priority. And, that’s exactly why we treat the safe custodianship of your data as our core function. Collectively referred to as HIPAA, the Health Insurance Portability and Accountability Act of 1996 along with a series of supplemental regulations, sets national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge.
In terms of Customer Service Software, the solution & security architecture must comply with all the applicable standards & implementation specifications that protect the confidentiality of Protected Health Information (PHI) stored, handled or processed by the covered entities or business associates, including PHI shared in conversations, tickets, attachments and email.
HIPAA security standards state that the covered entity must:
- Secure the integrity, confidentiality & availability of all electronic PHI
- Detect and safeguard against any foreseeable threats or risks to the security of the information
- Protect against any reasonably anticipated impermissible uses or disclosures of such information
- Certify compliance by their entire workforce
How SparrowDesk Enables HIPAA Compliance
We are committed to comply with all applicable data protection laws. We are a defined Business Associate and as part of our HIPAA compliance, SparrowDesk enforces and maintains the appropriate administrative, technical and physical safeguards for ensuring the confidentiality, security, integrity and privacy of the PHI. And in the capacity of a Business Associate throughout the duration of providing services to our healthcare customers, the SparrowDesk platform enables HIPAA compliance to covered entities.
Signing the Business Associate Agreement with SparrowDesk is a mandatory requirement to enable a HIPAA Account, please contact your account manager for more details.
Additionally, we have executed agreements with our subcontractors that create, receive, maintain, or transmit PHI on our behalf, including our email delivery and AI service providers, which contain the same restrictions, conditions, reasonable and appropriate safeguards that apply to SparrowDesk with respect to such PHI under HIPAA.
HIPAA safeguards are applied through HIPAA mode, which is enabled for your account once the Business Associate Agreement is in place. HIPAA mode cannot be switched off by account users once enabled.
The following table demonstrates the HIPAA standards, and SparrowDesk’s approach to comply with it.
Standard | How SparrowDesk supports HIPAA |
|---|---|
Access Control | Role-based access control for account owner, admins and agents. The admin has complete control of the account, its agents and teams, with features such as roles, team-based inbox access & permissions. |
Encryption | All data, including conversations and attachments, is encrypted in transit and at rest using industry-standard Advanced Encryption Standard (AES) encryption using 256-bit keys. Log data is also encrypted to mitigate risk of ePHI stored in log files. Under HIPAA mode, conversation exports are AES-256 encrypted ZIP files protected by a password the member sets, which is never sent by email. Data encryption protects against passive and active attacks on confidentiality. |
Authentication | Every agent within the SparrowDesk environment is issued a unique user login and signs in with their own credentials. Under HIPAA mode, two-factor authentication is required for every member. Accounts can additionally require Single Sign-On through their own identity provider. |
Automatic Logoff | Under HIPAA mode, members are automatically signed out after a period of inactivity. The timeout is 5 minutes by default and admins can set it to 10, 15 or 30 minutes, but never longer. Each sign-out is recorded in the audit log. |
Audit Controls | The account audit log records sign-ins, sign-outs, conversation views, exports and configuration changes, with the member, timestamp, module, source IP and an integrity indicator. |
Transmission Security | Under HIPAA mode, webhook payloads must be signed with a signing secret so receiving systems can verify them. All traffic to and from SparrowDesk is encrypted in transit using HTTPS (TLS). |
Response and Reporting | SparrowDesk has an Incident Response Plan that sets the procedures for identifying, responding to, and escalating all suspected or confirmed security breaches. |
Business Associate Contracts | SparrowDesk has a policy and process in place for performing due diligence with any third party or vendor before engaging them. |
HIPAA Security Best Practices
Action | HIPAA Security Tips |
|---|---|
Exporting conversations and reports | Exported conversations may contain PHI. Share the export password separately from the file, keep downloaded files encrypted, and transfer them only over an encrypted connection. |
Conversation emails leave SparrowDesk through mail servers. We recommend connecting your own email service provider that supports HIPAA and enforced TLS, and keeping notification templates to a short alert with a link to the conversation. | |
Managing agents and teams | When adding agents or teams, please make sure that they’ve been authorized to access the conversations in their inboxes. Assign the least privileged role that lets each agent do their job, limit the number of Admins, and remove access promptly when it is no longer needed. |
Integrations and apps | Apps, webhooks, the AI agent webhook and workflow actions such as Send HTTP Request and Send Email can send conversation data to third parties. Only connect destinations covered by a Business Associate Agreement with your organization, always set a webhook signing secret and authentication method, and review connected apps, workflows and API keys regularly. |
AI agent | Zoona AI answers customer conversations using your knowledge sources. Do not add PHI to knowledge sources or connect third-party sources such as Notion that are not covered by your agreements, and keep the AI agent and Copilot turned off for inboxes that receive PHI unless they are covered under your HIPAA configuration. |
Sharing conversations | Conversations and attachments may contain PHI. Please ensure that you share them only with authorized recipients, and avoid forwarding them to personal or unverified email addresses. |
How We Verify Our HIPAA Safeguards
The agencies responsible to certify health technology – the Office of the National Coordinator for Health Information Technology and the National Institute of Standards and Technology – do “not assume the task of certifying software and off-the-shelf products” (p. 8352 of the Security Rule), nor accredit any other independent agencies to do HIPAA certifications.
It should also be noted that the HITECH Act only supports testing and certification of Electronic Health Records (EHR) programs and modules. As SparrowDesk is not an EHR software or module, our area of technology cannot be certified by these unregulated agencies.
The administrative, technical and physical safeguards that protect PHI in SparrowDesk are covered by our ISO/IEC 27001 certification and SOC 2 Type II audit, both performed by independent third parties.
In addition, our security team performs periodic internal HIPAA audits of SparrowDesk. Each audit tests the safeguards in the running product against the HIPAA Security Rule, and any gaps found are tracked through to remediation.