Applicable Products: Freshservice Enterprise, including incorporated Freddy AI services and add-ons

Other Freshservice plans are expressly excluded from this Configuration Guide.

Freshworks Commitment to HIPAA Compliance

Freshworks provides cloud-based products that customers may use to process electronic protected health information (ePHI) as part of their business operations.

Where a customer is a Covered Entity or Business Associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Freshworks may support the customer's HIPAA compliance obligations through execution of a Business Associate Agreement (BAA).

Customers should not transmit, store, or process ePHI using Freshworks products, features, applications, integrations, or services that are not included in any Configuration Guide.

This Configuration Guide (“Guide”) identifies security configurations customers should implement or consider when using supported Freshworks products to process ePHI.

Customers remain responsible for:

• Performing and maintaining their HIPAA security risk analysis.
• Determining which information constitutes ePHI.
• Configuring Freshworks products appropriately for their environment and intended use.
• Managing user access and authorization.
• Evaluating applications, integrations, email services, notification services, telephony services, and other third-party systems that may access or process ePHI.
• Maintaining appropriate administrative, physical, and technical safeguards required by HIPAA.

Freshworks' BAA and HIPAA-supporting configurations do not replace the customer's responsibility to maintain an appropriate HIPAA compliance program.

Mandatory Configuration Specifications

1. Identification and Authentication

Customers must configure appropriate identification and authentication controls for users who access supported Freshworks products where ePHI is processed or stored.

Freshworks recommends the following:

• Workforce users, agents, and administrators: Configure SAML Single Sign-On (SSO) with multi-factor authentication (MFA), or enable Freshworks-supported MFA where federated authentication is not used.
• Privileged users: Require strong authentication, including MFA, for administrative or other privileged accounts.
• Individual accounts: Assign unique user identities and avoid shared credentials.
• External or portal users: Require individual authentication using an appropriate authentication mechanism where the product supports external user access.

Customers should periodically review authorized users, authentication methods, and account privileges.

Customers remain responsible for configuring authentication and access policies appropriate to the sensitivity of the information being accessed and consistent with their HIPAA security risk analysis, organizational policies, and applicable access-control requirements.

2. Network Access Restrictions

Where supported, customers may use IP-based or other network access restrictions to limit access from specified networks or trusted environments.

Network restrictions can provide an additional layer of defense for organizations with defined corporate networks, VPN infrastructure, or other controlled access points.

Customers should consider enabling network restrictions where appropriate based on their security risk analysis and operating environment.

IP allowlisting or the use of static IP addresses is not required by HIPAA and is not a substitute for user authentication, MFA, authorization, or appropriate access controls.

Customers with mobile users, remote users, patients, consumers, or distributed workforces may determine that IP restrictions are not operationally appropriate.

3. Access Control

Customers must configure roles and permissions so that access to ePHI is limited to authorized users based on their business responsibilities.

Customers should:

• Assign individual user accounts rather than shared credentials.
• Apply least-privilege access to administrative and user roles.
• Limit access to ePHI to users with a legitimate business need.
• Remove or modify access promptly when employment or responsibilities change.
• Periodically review users, roles, and privileges.
• Use MFA for privileged and administrative access.
• Consider additional network restrictions for privileged access where appropriate.

Customers should incorporate supported Freshworks products into their broader identity governance and access-management processes.

4. Transport Security

Customers must use secure, encrypted connections when accessing supported Freshworks products or transmitting ePHI.

Customers should ensure that:

• Web access uses HTTPS/TLS.
• APIs and integrations use encrypted transport.
• Customer-managed systems communicating with Freshworks use current, supported TLS configurations.
• Email containing ePHI uses appropriately secured transport.
• Sensitive information is not transmitted through unencrypted channels.

Where customers configure a custom domain, they are responsible for ensuring that an appropriate TLS certificate is configured and maintained.

Customers remain responsible for evaluating the complete data flow between Freshworks products, their users, applications, integrations, and external services.

5. Endpoint Security

Customers must appropriately secure endpoint systems used by workforce users who access supported Freshworks products or process ePHI.

Endpoints should:

• Be assigned to identifiable users.
• Require user authentication.
• Use automatic screen locking after a defined period of inactivity.
• Be protected by current endpoint protection capabilities.
• Receive appropriate operating system and application security updates.
• Use encryption where appropriate.
• Be managed in accordance with the customer's endpoint security policies.

Customers should restrict access from unmanaged or untrusted endpoints where appropriate based on their security risk analysis.

6. Product Use

Customers should maintain the data within the system so as to not compromise mandatory retention periods. Avoid deleting tickets, which results in deletion of the associated Ticket Activity Log.

Customers should:

• Ensure permissions for agents in the product do not allow agents to delete tickets, to ensure that the Ticket Activity Log is retained for relevant tickets which contain ePHI.
• If agents must be granted permissions to delete tickets, train users of the system not to delete tickets which contain ePHI or to first export the Ticket Activity Log.

Recommended Configuration Specifications

1. Data Protection and Encryption

Customers should evaluate where ePHI may be entered, stored, displayed, transmitted, recorded, or otherwise processed within supported Freshworks products and configure appropriate protections based on their HIPAA security risk analysis.

Customers should:

• Use available encryption, sanitization, masking, and data-protection capabilities where appropriate.
• Avoid placing sensitive information in fields, metadata, applications, integrations, or other locations that have not been approved for the intended use.
• Limit access to ePHI through appropriate roles and permissions.
• Ensure customer-managed systems used to store or process ePHI apply appropriate encryption and access controls.
• Periodically review where ePHI is stored and who has access to it.
• Ensure applications and integrations that process ePHI are included within the organization's security and privacy review.

Customers remain responsible for determining what information constitutes ePHI and for configuring supported Freshworks products consistent with their HIPAA security risk analysis and organizational policies.

2. Data Minimization and Masking

Customers should minimize the collection, storage, recording, and display of sensitive information to what is reasonably necessary for the intended business purpose.

Customers should:

• Avoid collecting ePHI that is not required for the applicable business process.
• Use available masking, truncation, or encrypted-field capabilities where appropriate.
• Not enter ePHI into free-form fields, notes, metadata, conversations, or recordings.
• Avoid collecting payment card data, Social Security numbers, or other sensitive information unless required for the intended business purpose.
• Review forms, conversations, workflows, bots, automations, and integrations for unnecessary collection or duplication of sensitive information.
• Remove or delete sensitive information when continued retention is no longer required.

Where a product uses customer-defined rules, patterns, or configurations to identify or sanitize sensitive information, customers remain responsible for validating that those controls operate as intended.

3. Secure Data Migration

Customers migrating data containing ePHI into or out of supported Freshworks products should use approved migration methods designed to protect the confidentiality and integrity of the information during transfer.

Customers should:

• Use encrypted transmission methods for migration activities.
• Restrict migration access to authorized personnel.
• Minimize temporary copies of ePHI created during migration.
• Protect credentials and other secrets used during the migration.
• Remove temporary migration data when it is no longer required.
• Validate that migrated data is stored only in approved locations.
• Verify the completeness and integrity of migrated data.
• Apply the organization's applicable retention and deletion requirements.

Customers should contact Freshworks Support for information regarding supported migration methods and should review their migration approach as part of their HIPAA security risk analysis.

4. Logging and Auditability

Customers should configure and maintain appropriate logging and auditing processes for activity involving ePHI.

Logging should support the customer's ability to investigate security events, review access to sensitive information, and identify inappropriate or unauthorized activity.

Customers should consider retaining relevant records of:

• User authentication activity.
• Administrative actions.
• Changes to user roles and permissions.
• Access to or changes involving sensitive information where such events are available for logging.
• Security-relevant configuration changes.
• Application and integration activity involving ePHI.

Customers should periodically review relevant logs and integrate supported Freshworks security events into their centralized security monitoring or incident-response processes where appropriate.

Logging configurations and retention periods should be based on the customer's legal, regulatory, security, and organizational requirements.

It is the Customer's responsibility to download their logs from Freshworks systems to ensure that data is not lost. Freshworks does not store relevant customer logs for the entire mandatory retention period, and it is the Customer's responsibility to ensure they are storing the logs outside of Freshworks systems to meet their archive and retention obligations. Customers' failure to download these logs is the sole responsibility of the Customer. Please refer to the View and export audit logs in Freshservice Support Article for detailed information.

5. Applications and Integrations

Customers should evaluate applications, APIs, integrations, automation tools, and other services before allowing them to access data containing ePHI.

Before enabling an integration that may access ePHI, customers should evaluate:

• What information the integration can access.
• Whether access is limited to the minimum necessary data.
• How the integration authenticates.
• Whether data is encrypted during transmission.
• Where the integration processes or stores data.
• Applicable retention and deletion practices.
• Whether the provider is authorized to process ePHI under the customer's HIPAA compliance program.
• Whether appropriate contractual protections, including a BAA where applicable, are in place.

Third-party applications or integrations that transmit ePHI to services outside the applicable Freshworks BAA should not be used to process ePHI unless the customer has independently established an appropriate HIPAA-compliant arrangement with the applicable provider.

Customers should periodically review enabled applications and integrations and remove those that are no longer required.

6. Periodic Access and Configuration Reviews

Customers should periodically review their Freshworks environment to confirm that security configurations remain appropriate as users, business processes, and technology change.

Reviews should include, as appropriate:

• Active users and administrators.
• Assigned roles and privileges.
• Authentication and MFA settings.
• SSO configurations.
• Network access restrictions.
• Custom mailboxes and email configurations.
• Data sanitization and masking rules.
• Applications and integrations.
• Notification configurations.
• Logging and monitoring settings.
• Endpoint security requirements.
• Product-specific HIPAA configuration requirements.

Customers should promptly address unnecessary access, obsolete integrations, insecure configurations, ineffective sanitization controls, or other issues identified during these reviews.

7. Incident Response

Customers should include supported Freshworks products within their security incident-response processes where those products are used to process ePHI.

Customers should establish procedures for:

• Investigating suspected unauthorized access.
• Disabling or restricting compromised accounts.
• Reviewing relevant activity and logs.
• Rotating compromised credentials, API keys, or integration secrets.
• Evaluating potentially exposed ePHI.
• Determining whether ePHI may have been accessed, acquired, used, or disclosed improperly.
• Escalating potential breaches to appropriate privacy, legal, security, and compliance personnel.

Customers remain responsible for determining whether an incident constitutes a breach under HIPAA and for satisfying applicable notification obligations.

Available Product-Specific Controls

Freshservice

New features marked with an asterisk (*) are being released in Freshservice Enterprise during the last week of November 2026. Please review these configuration specifications before using or enabling these additional features.

* NEW Field-Level Encryption — New Fields: Freshservice allows administrators to designate custom ticket fields as Encrypted to protect ePHI at rest and in transit. This applies to Single-line text and Paragraph text field types on Incident and Service Request tickets. Values written to an Encrypted field are protected from the first save and are never stored in plain text.

Default system fields such as Subject, Description, Priority, and Status cannot be designated as Encrypted. Only custom fields are eligible.

For full setup instructions, see the Field-Level Encryption Setup Guide.

* NEW Field-Level Encryption — Existing Fields: If your Freshservice account has existing custom ticket fields that currently store ePHI in plain text, you can enable encryption on those fields through the Encrypted checkbox in Field Manager. Once enabled, all new values written to the field are immediately protected. You may additionally choose to encrypt all historical values already stored in that field — including on archived tickets — through a separate opt-in action. This retroactive encryption runs as a background process and does not interrupt production operations.

For full setup instructions, see the Field-Level Encryption Setup Guide.

* NEW Masked Display and Controlled Reveal: Encrypted field values are displayed as masked by default for all agents and administrators. Agents may reveal the value through a click-to-reveal action. The revealed value remains visible for the duration of their active session and is automatically re-masked when the session expires. Every reveal is recorded in the Freshservice activity with the agent identity, ticket ID, field name, and timestamp.

* NEW Field-Level Encryption — Field Data Is Retained Within Freshservice: Encrypted field values are viewable only through the ticket detail view inside Freshservice via the controlled reveal flow described above for users with permissions to view the encrypted fields.

• This data is not visible via other services, including third-party services, APIs, and MCPs, even for users with permissions to view encrypted fields.
• Encrypted fields are excluded from being used for reporting and analytics, such as filters, chart structures, and formula operands in the Freshservice Analytics module.
• Any existing report or dashboard widget that references a field after it is marked Encrypted will display a data unavailable message and must be reconfigured.
• Encrypted fields are excluded from all Freddy AI capabilities to prevent ePHI from entering AI processing and training.