All tools / Workspace and projects
Is Smartsheet HIPAA compliant?
Checked 6 Nov 2026 from 2 vendor sources
Smartsheet allows PHI only on PHI Eligible Services, naming the Enterprise plan, after a BAA is executed. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Trials | Not covered |
| Pro | Not covered |
| Business | Not covered |
| Early Access Program members on any plan | Not covered |
| Enterprise | Covered |
What the BAA leaves out
- Brandfolder
- Smartsheet University, Community and other Smartsheet Sites
- Third-party integrations and third-party attachment storage are the customer’s responsibility
How to get the BAA
Contact your Smartsheet account manager or submit the Smartsheet for Healthcare contact form.
What the vendor says to do
- Execute a BAA before adding PHI
- Follow the vendor’s safe sharing policy article and configure access controls
What we couldn’t confirm
Smartsheet’s help article also mentions Advanced Work Management, while its eligible list names only Enterprise. It doesn’t address AI features. Confirm with the vendor.
Proof from the vendor
- Smartsheet and HIPAAPHI Eligible Services, excluded plans and products, how to obtain
- Trust CenterHealthcare customers on Enterprise may use PHI after executing a BAA
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.