Is Asana HIPAA compliant?
Only on Asana's top tier with the HIPAA feature switched on — and even then Asana forbids using it as your system of record or for contacting patients, so it is a staff task tracker and nothing more.
Applies to Asana with the HIPAA compliance feature. Last reviewed against Asana's own documentation. Next review January 19, 2027.
Reviewed by Dr. Rachel Foster, MD — Pediatrician and small practice owner.
What you must do
- Consolidate existing Workspaces or Divisions into a single Organization — the feature is only available domain-wide.
- Enable the HIPAA compliance feature through the admin console before any patient information is submitted.
- Enable two-factor authentication, single sign-on or Google Authentication for all end users.
- Give every end user a dedicated email domain. Asana does not permit personal email domains unless it agrees otherwise in writing.
- Limit visibility on a need-to-know basis using private tasks and private projects.
- Monitor for unusual activity yourself using the APIs and audit log — Asana states you are solely responsible for this.
- Execute separate agreements with every third-party provider you connect, including App Directory integrations.
- Expect features to disappear: some AI tools, certain integrations and personal access tokens may be disabled by default, and re-enabling them is at your own risk.
Does Asana sign a business associate agreement?
Yes. Asana offers one. Asana's plan comparison lists HIPAA compliance as an opt-in feature on its top tier. Confirm eligibility with Asana before relying on it. The addendum becomes effective when you enable the HIPAA feature in accordance with Asana's use requirements; it is incorporated into your existing agreement. Work with your account team to confirm eligibility first.
What this means in practice
Asana will act as a business associate, but two of its published conditions rule out the way most practices imagine using it. Asana states you shall not use its services as a system of record for patient information, and shall not use them to communicate directly with, or provision accounts to, patients, plan members, their families or employers. What remains is an internal task tracker for staff — never a chart, never a patient portal.
Before any patient information goes in, you must fold existing Workspaces and Divisions into a single Organization, because the feature works only domain-wide; enable it in the admin console; and require two-factor authentication, single sign-on or Google Authentication for every user. Personal email domains are not permitted unless Asana agrees otherwise in writing.
Expect the product to shrink once it is on. Asana says some AI tools, certain third-party integrations and personal access tokens may be unavailable or disabled by default, and that re-enabling them is at your own risk. Integration providers, App Directory apps included, need their own agreements — Asana does not sign for them.
How organizations get this wrong
The specific mistakes we see with Asana, not generic advice.
- Inviting a patient as a guest to a project, which Asana prohibits along with any direct patient communication or account provisioning.
- Treating Asana boards as the record of care, when Asana forbids using the service as a system of record.
- Re-enabling AI tools or integrations that the HIPAA feature disabled by default, which Asana says you do at your own risk.
- Onboarding a contractor on a personal email domain, which Asana does not permit unless it has agreed otherwise in writing.
What the agreement does not cover
- Using Asana as a system of record for patient information — prohibited outright.
- Communicating directly with, or provisioning accounts to, patients, plan members, their families or employers.
- Any free version of the Asana services.
- Asana's support and professional services — patient information must not be sent by email, support portal, tickets or chat bots.
- Third-party integration providers, including App Directory apps.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
Agreement accepted and activated by an admin inside the product
Named on Microsoft's in-scope list, so task tracking sits under an agreement you already have
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Asana, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Asana’s own published documentation, read on the date shown.
- HIPAA Use Requirements and Limitations — Asana. Published August 29, 2025. Read July 29, 2026.
- Business Associate Addendum (HIPAA) — Asana. Published August 29, 2025. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Asana’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.