Is Asana HIPAA compliant? BAA, plans and safe use

Short answer from Asana's own documentation

One gap: Asana's public terms tie the HIPAA feature to "the applicable Subscription Tier" without naming the tier. Asana's privacy page (opens in a new tab) confirms that "HIPAA compliance for Asana is governed by Asana's Business Associate Addendum (BAA)," and its trust center (opens in a new tab) lists HIPAA, but the datasheet there is gated. Asana's help-center article on HIPAA didn't load when we tried it. Before you sign, get Asana to confirm in writing which tier your contract needs.

What HIPAA requires before patient information goes in

The rule is short. Your practice may let a vendor "create, receive, maintain, or transmit protected health information on its behalf" only with documented "satisfactory assurance" that the vendor will protect it (45 CFR 164.502(e) (opens in a new tab)). The document is a written contract meeting 45 CFR 164.504(e) (opens in a new tab), which lists what it must say, from safeguards and breach reporting to returning data at the end. Our guide to business associate agreements walks through each clause.

Signing isn't the finish line. Asana's addendum puts duties on the practice too, including to "submit or disclose only Minimally Necessary amount of PHI" and to remove PHI when a patient's permission is revoked. Configuration and daily use decide whether a project is actually safe.

The free marketing audit flags patient-data risks already on your website, such as ad pixels on patient forms, from public information only.

Which Asana plans a BAA can cover

Prices from asana.com/pricing, October 22, 2026. The pricing page marks HIPAA compliance as "Opt-in" with "see requirements."

Whatever the tier, the Use Requirements set these conditions before PHI goes in:

1. The HIPAA feature is "only available on a Domain-wide basis," so separate workspaces or divisions must first be combined into one organization.
2. An admin must "enable the Asana HIPAA compliance feature through your admin console."
3. Every user signs in with "two factor authentication, SSO, or Google Authentication."
4. Users have accounts on your practice's own email domain; personal email domains aren't allowed.
5. Expect "some Asana AI tools, integrations with certain third-party services, and personal access tokens" to be unavailable or off by default. Turning them back on is at your own risk.
6. App Directory integrations need their own BAAs with you. Asana doesn't sign those for you.

Task tools and the minimum necessary rule

HIPAA's minimum necessary standard says a covered entity "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose" (45 CFR 164.502(b) (opens in a new tab)). In a task tool, that comes down to what you type in the title, the description and the comments.

Asana's own limits back this up:

• Need-to-know access. The Use Requirements expect PHI visible only to staff "on a need-to-know basis," using private tasks and private projects.
• Not the chart. Asana can't be your system of record for PHI. The EHR holds the record; Asana holds the to-do.
• No patients inside. You can't use it "to communicate directly with or provision accounts to patients, plan members, their families, or employers."
• No PHI through side doors. PHI "may not be submitted through other Asana services," which includes support channels such as email and chat bots.

Safe uses and unsafe uses for a practice

Safe on any plan, because no patient information is involved:

• Blog and social content calendars, campaign launches, website redesigns
• Hiring, onboarding, credentialing renewals, compliance training tracking
• Facilities, equipment service and supply reorders

Workable only with the HIPAA feature on and the addendum in effect:

• Referral and prior-authorization follow-ups in a private project, with minimum detail and a pointer to the EHR
• Front-desk callback queues limited to the staff who make the calls

Unsafe:

• Any patient name or condition on the free Personal plan
• Inviting a patient, or a patient's family member, into a project
• Uploading intake forms or lab PDFs as the only copy
• Syncing a patient project to a chat or calendar app with no BAA of its own
• Asking Asana support about a specific patient's task

Safer setup or alternatives

If you only need project management for marketing and operations, keep Asana and keep patients out of it. Add a one-line rule to your staff handbook.

If patient workflows need a home, compare that against the task lists inside your EHR or practice management system, which you likely already have a BAA for. Our monday and Notion verdicts apply the same test, and the HIPAA and marketing software hub lists every tool we've checked.

Medfy doesn't sell Asana. Many callback tasks begin as website inquiries, and in Medfy those arrive in an access-controlled patient inbox. Submissions from its HIPAA-compliant forms and chat are stored in separate, encrypted HIPAA databases in the US or Canada, covered by the BAA Medfy signs with each practice for its own services. See how Medfy handles patient data.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Will Asana sign a BAA?

Yes. Asana publishes a Business Associate Addendum, last updated August 29, 2025, that takes effect when your organization enables Asana's HIPAA feature under its posted use requirements. Those requirements include a single domain-wide organization, two-factor authentication, SSO or Google sign-in for every user, and no PHI in support chats or email. Ask Asana sales to confirm in writing that your subscription tier includes the HIPAA feature.

Is the free version of Asana HIPAA compliant?

No. Asana's HIPAA Use Requirements say customers "shall not submit PHI into any free version of the Asana SaaS Services." The free Personal plan, built for one or two people, is therefore off-limits for anything that names a patient or describes their care. It remains fine for marketing calendars, website projects and other practice work that never involves patient information.

Can a practice use Asana without patient information?

Yes, on any plan. If no protected health information goes in, Asana's BAA isn't needed. Content calendars, campaign launches, hiring, compliance training and facilities work all qualify. The trap is the task title: "Call Mrs. Chen about her biopsy" is PHI. Agree on a rule that patient-specific work lives in the EHR, and review your projects for stray names every few months.

What is a HIPAA-compliant alternative to Asana?

The safest choice is often the system you already have a BAA with: most EHR and practice management platforms include task lists for callbacks and referrals. If you want a separate work-management tool for patient tasks, compare vendors on one test: a signed BAA for your exact plan, plus settings you can actually enforce. monday.com and Notion are common comparisons.