HIPAA Business Associate Addendum.

Read this first. This page describes our BAA program. The full executed BAA is provided privately under NDA after a Pro+ contract is in place. Email [email protected] with subject "BAA Request" to receive: (a) the unsigned BAA template for review, (b) the security questionnaire (SIG Lite + CAIQ), (c) coordination with your covered-entity counsel for execution.

What's covered when you sign.#

When the BAA is executed, Wendesk commits to the following safeguards over PHI as a Business Associate under the HIPAA Privacy and Security Rules. These are summarized here for transparency; the binding contract clauses live in the executed BAA itself.

• PHI auto-redaction before any AI inference call — tenant data is scrubbed of identifiers before it leaves our trust boundary toward third-party model providers.
• Audit log retention 6 years for healthcare tenants (vs 1–7 years for other plan tiers).
• Encryption posture: AES-256-GCM with AWS KMS-managed Customer Managed Keys; TLS 1.3 in transit at every hop.
• Breach notification within 60 days to the HHS Secretary; immediate notification for breaches affecting ≥500 records (per HIPAA Breach Notification Rule).
• Sub-processor restrictions — only sub-processors that themselves sign a BAA receive PHI access.
• Dedicated database isolation for healthcare Enterprise tenants (per ADR-0003).

How to request.#

Email [email protected] with subject "BAA Request" and include: your business name; the workspace slug or signup intent; the role of the person executing the BAA (CEO, COO, Compliance Officer); and your covered-entity status (provider, health plan, healthcare clearinghouse). We return the unsigned template, security questionnaire, and counter-sign within 5 business days of receiving the executed copy.

Plan eligibility: BAA is available on Pro and Enterprise plans. Free Lite, Base, Starter, and Growth tiers do not include BAA execution because the per-tenant isolation primitives required for HIPAA compliance are gated above. Talk to [email protected] if you need to negotiate an exception under a CustomPlan.

---

1. What the BAA Covers#

The Wendesk BAA is a written contract that sets the safeguards Wendesk maintains over Protected Health Information (PHI) as a Business Associate under the HIPAA Privacy and Security Rules.

Material commitments made by Wendesk as Business Associate:

• PHI auto-redaction before any AI inference call — tenant data is scrubbed of identifiers (names, dates of birth, geographic data, phone numbers, email addresses, SSN, MRN, and the other 16 HIPAA identifiers) before it leaves our trust boundary toward third-party model providers. Use the on-platform self-hosted Llama route for prompts that legitimately require PHI context.
• Audit log retention 6 years for healthcare tenants, covering all access, modification, disclosure, and administrative events on PHI. Logs are cryptographically signed and tamper-evident.
• Encryption posture: AES-256-GCM with AWS KMS-managed Customer Managed Keys; TLS 1.3 in transit at every hop — storage, inter-service calls, backup, and archival.
• Breach notification within 60 days to the HHS Secretary; immediate internal escalation for any suspected breach; notification to affected individuals without unreasonable delay.
• Sub-processor restrictions — every sub-processor that receives PHI is itself bound by a Business Associate Agreement. The current list is published at /sub-processors with the BAA-eligible subset flagged.
• Dedicated database isolation for healthcare Enterprise tenants (per ADR-0003 DEDICATED_DB strategy), ensuring PHI never co-mingles with data of non-healthcare tenants.
• Minimum necessary standard — Wendesk personnel access PHI only to the minimum extent necessary to carry out service obligations (support, incident response, legal compliance).
• Workforce training and access controls — all Wendesk personnel with potential PHI access receive HIPAA privacy and security training. Access is role-based, least-privilege, and reviewed quarterly.

2. How to Request#

Email [email protected] with:

1. Your business name and workspace slug (or signup intent if not yet activated).
2. The role of the person executing the BAA (CEO, COO, Compliance Officer, Privacy Officer, or equivalent).
3. Your covered-entity status: provider, health plan, or healthcare clearinghouse.
4. A brief description of the PHI categories you intend to process via Wendesk.

We return a counter-signed BAA within 5 working days.

Plan eligibility: BAA is available on Pro and Enterprise plans only. Free Lite, Base, Starter, and Growth tiers do not include BAA execution because the per-tenant isolation primitives required for HIPAA compliance (dedicated database isolation, 6-year audit retention, enhanced breach-notification workflows) are gated above those plan thresholds. Talk to [email protected] if you need to negotiate an exception under a CustomPlan.

3. Breach Notification#

For HIPAA-specific obligations:

The cross-regime breach-notification matrix (DPDP 72h, GDPR 72h, HIPAA 60d) is published in the central matrix below for cross-reference.

4. Sub-Processor PHI Controls#

Only sub-processors that have executed a Business Associate Agreement receive access to PHI. Wendesk maintains a documented list of BAA-eligible sub-processors and reviews it quarterly. The current list of all sub-processors is below; BAA-eligibility for PHI workloads is annotated separately on the /sub-processors page.

New PHI-touching sub-processors trigger a 30-day notice to healthcare tenants before data flows begin, in addition to the standard sub-processor change notification.

5. Security Rule Compliance#

Wendesk's technical safeguards for healthcare tenants include:

• Access controls: Unique user identification; automatic logoff after inactivity; emergency access procedures documented and tested annually.
• Audit controls: Hardware, software, and procedural mechanisms that record and examine activity in information systems containing PHI.
• Integrity: Electronic mechanisms to corroborate that PHI has not been altered or destroyed in an unauthorized manner (cryptographic checksums + tamper-evident logs).
• Transmission security: AES-256-GCM encryption for all PHI at rest; TLS 1.3 for all PHI in transit; no unencrypted PHI in logs, error messages, or cache.

6. Effective Date and Term#

This BAA supplement is effective upon counter-signature by Wendesk. It remains in force for the duration of the principal Terms of Service and survives termination for the period required to complete destruction or return of PHI.