Help Scout alternative for HIPAA and healthcare support

Can a self-hosted help desk support HIPAA-covered patient conversations?

A healthcare support team that handles patient conversations in a vendor-hosted inbox depends on a business associate agreement to keep that vendor accountable. Self-hosted FreeScout or Chatwoot can keep those conversations inside your own environment, but the HIPAA Security Rule safeguards then become your own responsibility to design, operate and evidence. The Security Rule (45 CFR Part 164 Subpart C) applies to covered entities and their business associates for all electronic protected health information they create, receive, maintain or transmit (45 CFR 164.302). Moving the help desk in-house does not remove that obligation. It moves it onto your side of the table, so every control that a vendor previously handled, including access control, audit logging, encryption and incident reporting, needs an owner and a record.

There is no HIPAA certification. HHS states that no Security Rule standard requires an entity to certify compliance, and that private certifications do not prevent HHS from later finding a violation (HHS FAQ 2003). Any vendor or consultant who offers a HIPAA badge for a help desk product is offering something the rule does not recognize. The practical question is therefore evidence: can you show, for each applicable standard in Appendix A to Subpart C, which control you chose, who configured it and how you test it? That means documented risk analysis, role-based access for agents and administrators, unique user identification for every agent (a required implementation specification), automatic logoff and encryption in transit and at rest (addressable specifications that still need a documented decision), and a tested emergency access procedure. Ask Chatwoot or FreeScout's maintainers only what the software provides. The evidence file is your responsibility.

Before you choose a platform, confirm three things in writing. First, whether the chosen database, mail server and hosting provider will sign a business associate agreement with you, since hosting ePHI on infrastructure that you run in a cloud account still usually involves a provider that handles ePHI. Second, whether the features you need (single sign-on, audit trails, retention settings) are available in the edition you plan to run, because some are gated behind paid modules or plans. Third, who will maintain the system after go-live. HHS has proposed a major Security Rule revision (90 FR 898), but no final rule had been published as of October 2026, so plan against the current rule and track the proposal. Independent auditors and certification bodies assess compliance, and DeployOpen prepares the systems, controls and evidence those assessments review.

What the HIPAA Security Rule requires of a support inbox

The Security Rule applies to every system that creates, receives, maintains or transmits ePHI, so a support inbox that holds patient messages falls inside its scope. The cards below set out who is covered, which safeguards apply, and which contract terms must reach any vendor or subcontractor that touches that data.

Covered entities and business associates

The Security Rule binds covered entities (health plans, clearinghouses and covered providers) and their business associates for all ePHI they create, receive, maintain or transmit. A support inbox that stores patient emails, attachments or chat transcripts is in scope whether you host it or a vendor does. Confirm in writing which entity is responsible for each system that holds those messages.

18 standards and 36 specifications

Appendix A to Subpart C groups the Security Rule into administrative, physical and technical safeguards, with 36 implementation specifications. Of those, 14 are required and 22 are addressable, which means you must assess whether each one is reasonable for your environment and document the decision. For a support inbox, map each specification to a named owner, a configuration and a piece of evidence.

Seven technical safeguard specifications

The technical standards in 164.312 carry seven specifications. Unique user identification and an emergency access procedure are required. Automatic logoff and both encryption specifications are addressable. Each shared agent login on a help desk weakens unique identification, so check that every agent, admin and service account is individually named, that sessions time out, and that data is encrypted at rest and in transit or that you have documented why not.

Business associate contract terms

Under 164.314(a)(2)(i), a business associate contract must require the vendor to comply with the Security Rule, flow the same terms down to any subcontractor that handles ePHI, and report security incidents, including breaches of unsecured PHI, to the covered entity. If you self-host, the same obligations still apply to any hosting provider, email relay or backup vendor that can reach the data. Ask each one for a signed agreement before patient data moves.

No certification, only evidence

HHS states that no Security Rule standard requires certification, and a private certification does not stop HHS from later finding a violation. The Office for Civil Rights enforces the rule through complaints, compliance reviews and audits. Your readiness depends on documented risk analysis, configuration records and access logs that you can produce on request. Independent assessors may test these controls, but they do not certify HIPAA compliance.

Where Help Scout's HIPAA offer fits and where it leaves gaps

Help Scout ties HIPAA support to its plan structure. As described in the terms you need to confirm, HIPAA sits on the Pro plan, which requires at least 10 users, and is available as an add-on on other plans. A small support team therefore cannot assume the offer applies to it until it checks which tier and add-on combination it would buy. Plan names, eligibility and pricing change, so treat any summary, including this one, as a starting point and get the current terms in writing from Help Scout.

Pro plan minimum: confirm whether the 10-user floor counts shared inbox seats, contractors and staff who would see patient messages.
Add-on eligibility: ask which plans can take the add-on and what it changes in the contract.
Feature scope: get a written list of which features, such as Docs, Beacon, integrations and attachments, fall under the agreement.
Data location and subprocessors: request where ePHI is stored and processed and which subprocessors touch it.
Renewal and exit: confirm what happens to HIPAA coverage on a downgrade, plan change or cancellation.

Ask Help Scout for each answer in writing before any patient conversation enters the platform.

FreeScout and Chatwoot compared for patient conversations

This table compares FreeScout and Chatwoot on the points that matter when patient conversations move into your own environment: license, stack, channels, SSO and AI features. Read each row as a question to answer for your own deployment, since the HIPAA Security Rule safeguards apply to whichever tool you run. The main takeaway is that Chatwoot covers more channels but needs a heavier stack and paid plans for SSO, while FreeScout is simpler and email-centric with SSO and LDAP sold as modules.

Factor	FreeScout	Chatwoot
License	AGPL-3.0 open source	MIT Expat core, with the enterprise/ directory under its own license
Application stack	PHP on Laravel, running on Nginx, Apache or IIS	Ruby on Rails and Vue.js, with Ruby 3.2 or later and Node.js 20.x recommended
Database	MySQL, MariaDB or PostgreSQL	PostgreSQL only, with Redis 7.0 or higher
Primary channel focus	Email-centric shared inbox, with WhatsApp, Telegram, Facebook, Slack and live chat listed	Omnichannel inbox including website chat, email, WhatsApp, SMS, Facebook, Instagram and Telegram
SAML SSO and LDAP	Available as paid lifetime modules, licensed per single instance	SAML SSO on the paid Enterprise Edition per agent plan; confirm current terms before relying on it
AI features	AI Integration module is free; confirm which provider it calls before enabling	Captain AI sits on paid Premium Support plans; confirm which third parties receive conversation content
Recommended sizing check	Confirm the server and database tier against your mailbox volume in your own environment	Requires at least 4 cores and 4 GB RAM for up to 10,000 conversations a day, per Chatwoot's requirements
Fit for patient conversations	Suits email-led intake if you can meet SSO and access control needs through modules and infrastructure	Suits chat-heavy intake, but channel scope widens the data flows you must document and protect

How to deploy FreeScout or Chatwoot under HIPAA safeguards

This sequence takes a self-hosted FreeScout or Chatwoot deployment from a scoped inventory of patient data flows to a documented, tested environment that your own risk analysis and safeguards can stand behind.

Scope the ePHI flows and channels
Your privacy or compliance lead and the support manager list every place patient information enters or leaves the help desk: mailboxes, web chat, attachments, saved replies, exports, reports and integrations. Include who uses each channel and what they type into it. The step is complete when you have a written data flow diagram and a list of the systems that create, receive, maintain or transmit ePHI. Anything outside that list should be kept out of the help desk by policy, since the HIPAA Security Rule applies to all ePHI your organization or its business associates handle.
Choose a hosting environment covered by your BAA
Your IT and legal teams select the cloud account, data center or private network that will run the application, then confirm that the hosting provider will sign a business associate agreement that meets 45 CFR 164.314(a). Ask the provider which services fall under the agreement and whether backups, logs and snapshots are included. The step is complete when the signed agreement is on file and the provider's scope is recorded against your data flow diagram. Self-hosting does not remove the business associate question, it moves it to your infrastructure vendors.
Deploy FreeScout or Chatwoot from a pinned version
Your platform engineers deploy FreeScout with its Docker image or Chatwoot with Docker, its Linux installation script or a Helm chart for larger high-availability setups. Chatwoot requires Ruby 3.2 or later, recommends Node.js 20.x, supports only PostgreSQL and recommends Redis 7.0 or higher. For up to 10,000 conversations a day, plan for at least 4 CPU cores and 4 GB of RAM, plus at least 1 GB of swap. Pin the version and record it in your change log. The step is complete when the application starts on a private address, the database and Redis are reachable only from the application tier, and a test conversation completes end to end.
Enforce SSO and MFA for every account
Your identity team connects the application to your corporate identity provider or enables the authentication module that fits your platform. For FreeScout, the paid SAML SSO and LDAP Integration modules are listed on its modules page; for Chatwoot, SSO with SAML is part of the paid Enterprise Edition. Confirm that multi-factor authentication is enforced at the identity provider, since the application itself may not enforce it. Test a login with a non-admin account. The step is complete when local password logins for staff are disabled or limited to a documented break-glass account.
Encrypt transport and storage
Your platform team terminates TLS on every browser, API and mailbox connection that carries ePHI, and encrypts the database volumes, attachment storage and backups at rest using the controls your hosting provider offers. Where FreeScout uses S3-compatible storage for attachments, the storage bucket must be encrypted and private. Check that email connections use encrypted protocols. The step is complete when a scan of external endpoints shows only encrypted connections and your encryption settings are written into the system security plan.
Configure unique accounts, logoff and access rules
Your support manager creates one account per person, removes shared logins, and assigns agents to mailboxes and teams based on their need to know, not on convenience. Your platform team sets an automatic logoff for idle sessions in the application or at the identity provider, and documents the emergency access procedure for the administrator account. The step is complete when an access review lists each user, their role and their mailboxes, and the automatic logoff setting is tested and recorded.
Set backup, restore and audit logging
Your operations team schedules encrypted backups of the database and attachment storage, stores them separately from the application, and tests a restore into a non-production environment. Audit logging of logins, exports and administrative changes should be enabled, forwarded to your log store and retained according to your policy. The step is complete when a restore test has succeeded, the recovery steps are written down, and log retention is confirmed with your compliance lead.
Document the risk analysis and the security plan
Your security and compliance leads complete a risk analysis covering the systems, flows and safeguards from the earlier steps, then record the administrative, physical and technical safeguards and the decisions behind each one. HHS states that no Security Rule standard requires certification, so the goal is documentation you can show to the HHS Office for Civil Rights, your auditors and your business associates. The step is complete when the signed risk analysis, the security plan and the business associate agreements are stored together and scheduled for review.

Safeguards you own once the help desk runs in your environment

Moving the help desk into your own environment moves the Security Rule safeguards for that system to you. The six areas below map to the administrative, physical and technical safeguards that apply to any system holding ePHI, and each one needs a named owner and evidence before patient conversations arrive.

Access control and unique user identification

Every agent needs a separate login so that each action in a conversation traces to one person. Decide how FreeScout or Chatwoot accounts map to your identity provider, who can see patient threads by mailbox or team, and how accounts are removed when staff leave. Confirm whether single sign-on and LDAP or SAML options are included in the edition you choose, since FreeScout lists these as paid modules.

Audit logging and activity review

The Security Rule expects you to record and examine activity in systems that hold ePHI. Confirm which events the application writes (logins, ticket views, exports, mailbox changes), where logs are shipped, how long they are kept, and who reviews them. Logs should sit on storage the help desk administrators cannot quietly edit.

Transmission and storage encryption

Encrypt traffic between agents, the web server and mail servers with TLS, and encrypt the database and attachment storage at rest. The Security Rule treats encryption as addressable, so you must either implement it or document why an alternative is reasonable and appropriate. Record the decision for each path, including IMAP and SMTP connections to your mail provider.

Backup and contingency planning

Define backups for the database, attachments and configuration, test restores on a schedule, and write a contingency plan for outages and ransomware. Chatwoot needs PostgreSQL and Redis, and FreeScout needs MySQL, MariaDB or PostgreSQL, so each component needs its own backup and recovery step. Restore tests are the evidence an assessor will ask to see.

Hosting and email vendor agreements

Any cloud provider that stores or transmits ePHI for you, and any email or SMS provider that carries patient messages, may be a business associate. Under 45 CFR 164.314 the contract must require Security Rule compliance, flow the same terms to subcontractors, and require incident reporting. Ask each provider whether it will sign a business associate agreement before routing any patient conversation through it.

Security incident reporting and response

Write a procedure for identifying, containing and reporting security incidents, including any breach of unsecured PHI, and define who notifies the covered entity and within what period. Your business associate contract sets the reporting duty to the covered entity, so the procedure must match it. Rehearse the process with support leads, since an exposed mailbox is often found by an agent rather than a monitoring alert.

What evidence regulators and assessors ask for

What documentation do HIPAA auditors expect to see for a support tool?

Auditors expect written evidence that the safeguards in 45 CFR Part 164 Subpart C are in place and operating, not just configured. For a support platform holding patient conversations, that usually means a risk analysis and risk management record covering the help desk, its database, mailboxes and attachments, plus the policies that govern who may access them. Expect to show access reviews, audit log samples, encryption configuration for data at rest and in transit, and backup test records showing that restores were actually tried. If a vendor or hosting provider touches ePHI, the business associate contract is part of the same file. The exact set depends on your own risk analysis, so confirm the list with your privacy and security officers before you build the evidence folder.

How does HHS enforce the HIPAA Security Rule?

The HHS Office for Civil Rights enforces the Security Rule through complaints, compliance reviews and audits. A complaint can start an inquiry, and a review or audit can examine your documentation and systems whether or not a breach has occurred. HHS has stated that no Security Rule standard requires an entity to certify compliance, and that private certifications do not prevent HHS from later finding a violation. Civil money penalties are inflation-adjusted, with the range for penalties assessed on or after 28 January 2026 running from $145 to $2,190,294 per violation under 45 CFR 102.3, with a calendar-year cap of $2,190,294. Penalty exposure therefore depends on the violation category and your response, which is one reason the written risk analysis matters.

Do we need an independent assessor or a HITRUST assessment for HIPAA?

No. Neither an independent assessor nor a HITRUST assessment is a HIPAA requirement, and HHS does not issue or recognize a HIPAA certificate. Some customers and partners ask for third-party assurance in contracts, which is a commercial decision rather than a regulatory one. HITRUST offers assessments with e1 and i1 validity of one year and r2 validity of two years, based on CSF v11.9.0 available from 24 September 2026. These assessments are performed by authorized assessors, and DeployOpen does not issue audit reports, attestations or certifications. If a contract requires one, ask the customer which assessment type and validity period they accept before scoping any work.

What does a business associate contract need to cover for a self-hosted help desk?

Under 45 CFR 164.314(a)(2)(i), a business associate contract must require the business associate to comply with the Security Rule, flow the same terms down to subcontractors that handle ePHI, and report security incidents, including breaches of unsecured PHI, to the covered entity. When you self-host, the organization running the software is often the covered entity itself, so no business associate contract is needed for your own systems. It becomes relevant if a hosting provider, managed service firm or implementation partner can access ePHI. In that case, collect the signed contract and confirm the subcontractor chain before any engineer receives access. Have legal counsel review the wording.

What encryption and access evidence should we keep for FreeScout or Chatwoot?

Keep configuration records that show how each control is applied in your environment, not only what the product supports. Typical items include:

TLS settings for the web server and mail connections, and the certificate inventory
Database encryption at rest and the key management arrangement
Unique user identification for each agent, with role assignments and the review history
Automatic logoff settings and emergency access procedures
Single sign-on or LDAP configuration if you use the paid modules or the Chatwoot Enterprise Edition features

For FreeScout, SAML SSO and LDAP are paid modules, while Chatwoot lists SSO with SAML on its Enterprise Edition plan. Confirm which features your chosen edition and modules actually provide before writing them into the risk analysis.

Why do backup test records matter for a patient conversation system?

A backup that has never been restored is weak evidence of recoverability. Assessors look for records showing that backups ran on schedule, that restores were tested on a defined cadence, and that the results were documented with any failures and fixes. For a Chatwoot deployment, that means including PostgreSQL data, Redis where relevant, and uploaded attachments in the test scope. For FreeScout, include the MySQL, MariaDB or PostgreSQL database and the mail storage. Record who ran each test, what was restored, and how long it took, using your own measured results rather than vendor figures.

How do the EU health rules change the evidence we keep?

If you handle patient data in the EU, the evidence burden extends beyond HIPAA. Under GDPR Articles 32 and 34, controllers must show appropriate security measures and manage breach notification. NIS2 lists health as a sector of high criticality, covering healthcare providers and certain manufacturers. France's data protection authority fined a hospital EUR 500,000 on 3 September 2026 for external access without VPN or multi-factor authentication and for access controls that ignored the care team's need to know. Keep access justifications, MFA records and need-to-know rules as evidence. Confirm applicability with your legal team, since HIPAA and EU rules overlap but are not identical.

What does DeployOpen prepare for HIPAA readiness, and what does it not do?

DeployOpen plans, implements, hardens, backs up, documents and supports self-hosted open-source platforms in your own infrastructure, and it prepares systems, controls and evidence for compliance assessments. Within an agreed written scope, that can include configuration records, access and logging setup, backup procedures and restore testing, and documentation of how each safeguard is implemented. DeployOpen does not issue audit reports, attestations or certifications, and it does not decide what your risk analysis concludes. Independent auditors, HHS and HITRUST assessors make those determinations. Your privacy and security officers remain accountable for the final compliance position.

Why the penalty range and pending rule change the decision

The civil money penalty range is the first number to put in front of your board. For penalties assessed on or after 28 January 2026, the inflation-adjusted HIPAA penalty runs from $145 to $2,190,294 per violation, with a calendar-year cap of $2,190,294 (45 CFR 102.3). The HHS Office for Civil Rights enforces the rule through complaints, compliance reviews and audits, so the question for a support platform is not whether a violation can be assessed but whether you can show, per system, who accessed which patient conversation and under which safeguard. If a self-hosted FreeScout or Chatwoot instance holds ePHI, the access logs, encryption settings, unique user identification and automatic logoff belong to your risk analysis, not to a vendor's certificate. There is no HIPAA certification to hold up, so your evidence has to be produced in your own environment.

The rule itself is also moving. HHS proposed a major Security Rule revision on 6 January 2025 (90 FR 898). As of October 2026, no final rule has been published, and the Unified Agenda entry for RIN 0945-AA22 projects final action for July 2027. Treat the proposal as the direction of travel. Ask your privacy and security officers which proposed controls, such as asset inventories, network mapping and stricter recovery testing, would require changes to a help desk that you host yourself, and budget for those changes in the same review cycle as your current risk analysis. Confirm the current status on the Federal Register and reginfo.gov before any decision is final.

Regional expectations point the same way. NIS2 Annex I lists health as a sector of high criticality, covering healthcare providers and medical device manufacturers. In September 2026 the French CNIL fined Hopital Prive de la Loire EUR 500,000 under GDPR Articles 32 and 34, finding that external access to its patient record system lacked VPN and multi-factor authentication and that access controls ignored the care team's need to know. For a support inbox, the lesson is concrete: require MFA for every agent and admin login, restrict access to the mailboxes and conversations each team needs, and make sure remote access to the help desk server goes through a controlled path.

How much does a HIPAA help desk migration cost and take?

What does a self-hosted HIPAA help desk actually cost to run?

The software licence is the smallest visible line item, and the cost is driven by the components around it. FreeScout is licensed under AGPL-3.0 and its core product is free to download and use, so your spend goes to servers, the database, email, backups, and the people who configure and maintain them. Chatwoot's Community Edition is also free under the MIT Expat licence, but its self-hosted plans list Premium Support at $19 per agent per month and Enterprise Edition at $99 per agent per month, so the licence line grows with headcount only if you buy those tiers. Confirm with each vendor which features require a paid tier before you budget.

Which costs are one-time and which recur every year?

One-time costs include the risk analysis, initial configuration, email integration, data migration of past conversations, and hardening. Recurring costs include cloud or hosting fees, backups and storage, email delivery, monitoring, patching and upgrades, per-agent subscriptions if you buy them, and the staff time needed to keep the system current. FreeScout's paid modules, such as SAML SSO and LDAP Integration, are sold as lifetime licences for a single instance with lifetime updates, so those are closer to one-time purchases. Ask each vendor whether any module or plan has an annual renewal.

What does the HIPAA part add to the cost?

HIPAA adds work rather than a separate licence. The Security Rule applies to electronic protected health information you create, receive, maintain or transmit, and it requires administrative, physical and technical safeguards, including unique user identification and encryption addressed through a documented risk analysis. Your hosting provider and email provider may need a business associate agreement under 45 CFR 164.314 if they handle ePHI. There is no HIPAA certification to purchase, so budget for the internal and external review that proves your controls work, not a certificate. Confirm each provider's BAA terms directly with them.

How long does a migration from Help Scout usually take?

No duration figure is supplied for this migration, so treat any timeline as something to agree in writing rather than assume. The time depends on the volume of past conversations and attachments, how many mailboxes and saved replies need recreating, whether you need SSO or LDAP, and how long the risk analysis and sign-off take in your organization. Help Scout's data export is rate limited on its plans, so large archives take longer to pull. Ask for a schedule with phases and checkpoints in the quote.

Can our own IT team run this migration without outside help?

Your team can do it, but it needs people with mail server, Linux, database and HIPAA security experience, and it needs time set aside from other work. The technical setup is not the hard part for most teams. Chatwoot requires Ruby 3.2 or later, PostgreSQL and Redis 7.0 or higher, and lists Ubuntu 20.04 as its only officially supported Linux distribution, while FreeScout runs on Nginx, Apache or IIS with PHP and MySQL, MariaDB or PostgreSQL. Your own staff still need to own the risk analysis, policies and incident procedures, which no installer provides.

What should a written fixed-scope quote include for a HIPAA help desk?

Ask for a fixed scope with named deliverables, including the platform choice, hosting architecture, email integration, migration method, the list of mailboxes and modules, and the controls that will be configured. The quote should state what is excluded, such as the risk analysis, policy writing or third-party audits. Request separate lines for implementation, data migration, hardening, backup testing, documentation and ongoing support, and ask which items recur. DeployOpen works to written scope, does not publish a price list, and prepares evidence for assessments without issuing audit reports or certifications.

Which numbers should we confirm with vendors before signing?

Confirm the current Chatwoot per-agent prices and which features each tier includes, since SSO with SAML and SLA policies sit in the Enterprise Edition. Confirm which FreeScout modules you need, their lifetime licence prices and whether they cover one instance only. Confirm the latest supported versions of FreeScout and Chatwoot with the release pages before you plan the build, because both ship updates regularly. Also confirm your hosting provider's and email provider's BAA terms and data residency options.

How should we budget for ongoing operations after go-live?

Budget for patching, upgrades, backup restore tests, log review, access reviews and periodic risk analysis updates. These are recurring and often larger than the first-year licence line. Email deliverability work, such as SPF, DKIM and DMARC checks, also needs attention as senders change. Ask whether a retainer covers upgrades, continuous testing and support, and what response expectations it sets. Retainers are available, but their terms should come from the written scope rather than from this page.

How DeployOpen works on this

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source help desks inside your own cloud accounts, data centers or air-gapped networks. For a HIPAA-aligned FreeScout or Chatwoot deployment, we start from the safeguards your organization owns and build the platform and its evidence around them.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope names which platform, FreeScout or Chatwoot, and which mailboxes, channels and patient-facing workflows are in it.
The scope lists which Security Rule safeguards DeployOpen prepares controls and evidence for, and which remain your responsibility.

How we build

We install and configure the chosen platform in your environment, including PostgreSQL or MySQL, web tier, email integration and backups.
We set up unique user accounts, role separation, session timeouts and encryption settings, and document how each is configured.
We run security testing against the deployed help desk and its APIs, and record findings and fixes in the project file.

How we hand over

You receive architecture diagrams, configuration records, access procedures and runbooks for the help desk environment.
Backup and restore procedures are documented and tested, with the results recorded for your compliance file.
Your team receives a walkthrough of administration, user onboarding and incident reporting for the deployed system.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers cover platform patching, release upgrades and periodic review of configuration against your written scope.
Questions about HIPAA obligations, business associate agreements and audit readiness should go to your legal and compliance advisers and independent assessors.