All tools / Workspace and projects
A
On some plansIs Asana HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
Asana offers a Business Associate Addendum on its Enterprise+ tier, and on Legacy Enterprise only for customers who already enabled it, accepted by a super admin. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Legacy Enterprise customers who have not enabled HIPAA must move to Enterprise+ | Not covered |
| Enterprise+ | Covered |
| Legacy Enterprise (only customers who already enabled HIPAA) | Covered |
What the BAA leaves out
- PHI in Goals
- PHI outside project or task descriptions, task titles, custom fields, comments and attachments
- Integrations and Personal Access Tokens are disabled by default and need super admin review
How to get the BAA
A super admin accepts the BAA in the admin console under Security, HIPAA compliance.
What the vendor says to do
- Super admin opens the admin console Security tab, HIPAA compliance, and accepts the BAA and use requirements
- Allow 24 hours for activation across the domain
- Review already enabled apps in App Management and approve new apps
Proof from the vendor
- Asana Help Center HIPAA compliance articleTier eligibility, acceptance steps, PHI locations, integrations default
- Asana pricingFeature table lists HIPAA as opt-in, tier mapping not readable
- Asana for EnterpriseLists HIPAA among supported standards
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.