# Add a HIPPA / BAA policy to Asana **URL:** \ **Category:** Product Ideas\ **Tags:** government\ **Created:** [22 August 2018 22:25 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459 "2018-08-22T22:25:16Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Lauren7](https://luna1.co/8d76cd.png) [@Lauren7](https://forum.asana.com/u/Lauren7)\ **Post date:** [22 August 2018 22:25 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/1 "2018-08-22T22:25:16Z")
As a healthcare provider, I would love to be able to use Asana to keep track of tasks, including what contacts need to be made with patients, which patient records need updates, etc. I understand that the Box integration is HIPPA compliant, but I don’t need to upload files, I just need to be able to add patient names to tasks. Typically for these sorts of uses, the company would need to sign a HIPPA Business Associates Agreement. Will Asana do this? ---
**Author:** ![Michael\_A](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/michael_a/32/113866_2.png) [@Michael\_A](https://forum.asana.com/u/Michael_A)\ **Post date:** [22 August 2018 22:39 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/2 "2018-08-22T22:39:24Z")
Hi @Lauren7 Asana is not specific to the medical field and as such we do not have clearly identifiable HIPAA compliance standards, but we keep any data entered into Asana secure. Your data is not encrypted on the servers (for performance reasons), but we do encrypt over the wire via SSL. Security is something we take very seriously. Please take a look at this information: > **[Asana | Trust Center](https://security.asana.com/)** > > See how Asana manages their security program. > **[Terms & Policies • Asana](https://asana.com/terms#privacy-statement)** > > Asana is the easiest way for teams to track their work. From tasks and projects to conversations and dashboards, Asana enables teams to move work from start to finish—and get great results. > **[Privacy and security settings in Asana | Product guide • Asana Product Guide](https://asana.com/guide/help/faq/security)** > > Learn about privacy and security settings in Asana. One workaround we can offer is the use of our integration with Box, which is HIPAA compliant. The link to our Box integration below: > **[Adding comments & attachments to tasks | Product guide • Asana Product Guide](https://asana.com/guide/help/tasks/comments)** > > This section of the Asana Guide tells you how to add comments and attachments to tasks and explains how to use connected work links. Let me know if you have any further questions or concerns. ---
**Author:** ![Lauren7](https://luna1.co/8d76cd.png) [@Lauren7](https://forum.asana.com/u/Lauren7)\ **Post date:** [22 August 2018 23:07 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/3 "2018-08-22T23:07:13Z")
Ok thanks! Sounds like it’s a no-go for healthcare professionals if we need to add any PHI to a task (HIPAA requires a BAA be signed, even with really great security). Maybe someday in the future you’ll consider a HIPAA/BAA policy-- that would be awesome! ---
**Author:** ![Julia\_Blair](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/julia_blair/32/30362_2.png) [@Julia\_Blair](https://forum.asana.com/u/Julia_Blair)\ **Post date:** [4 March 2019 00:11 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/4 "2019-03-04T00:11:57Z")
Because I can’t find a convenient way to contact support I’m posting my question here. > **[What is HIPAA Compliance?](https://www.digitalguardian.com/blog/what-hipaa-compliance)** > > Learn about the Health Insurance Portability and Accountability Act (HIPAA) and the requirements for HIPAA compliance in Data Protection 101, our series on the fundamentals of information security. Please get back to me ASAP ---
**Author:** ![James\_Carl](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/james_carl/32/904_2.png) [@James\_Carl](https://forum.asana.com/u/James_Carl)\ **Post date:** [4 March 2019 00:18 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/5 "2019-03-04T00:18:12Z")
No it is not Hippa compliant. Only the integrations with files in Box and Dropbox are ---
**Author:** ![Bastien\_Siebman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/bastien_siebman/32/172354_2.png) [@Bastien\_Siebman](https://forum.asana.com/u/Bastien_Siebman)\ **Post date:** [4 March 2019 05:10 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/6 "2019-03-04T05:10:49Z")
See [Add a HIPPA / BAA policy to Asana - #2](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/2) for an official answer. ---
**Author:** ![Scot\_Diaz](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/scot_diaz/32/7776_2.png) [@Scot\_Diaz](https://forum.asana.com/u/Scot_Diaz)\ **Post date:** [18 July 2019 14:58 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/7 "2019-07-18T14:58:14Z")
While I understand that Asana offers the integrations as HIPPA compliant alternatives, how does Asana “enforce” or enable that to be the only way a user can add attachments? Can these fields be disabled once the integrations are utilized? ---
**Author:** ![Davy\_Montgomery](https://luna1.co/8d76cd.png) [@Davy\_Montgomery](https://forum.asana.com/u/Davy_Montgomery)\ **Post date:** [10 October 2019 19:34 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/8 "2019-10-10T19:34:21Z")
I know this was previously answered, but I wanted to revisit and confirm if Asana is able to meet HIPAA compliance and sign BAA’s? It looks like competitors (Monday & Smartsheets) will do so, so I wasn’t sure if Asana’s position had changed. We currently use Asana, and make sure no PHI gets added. I would greatly prefer to have the ability to add PHI to our projects though. This would typically be in the form of an attachment, but it could also be comments or task description. ---
**Author:** ![Omar1](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/omar1/32/45877_2.png) [@Omar1](https://forum.asana.com/u/Omar1)\ **Post date:** [11 December 2019 02:46 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/9 "2019-12-11T02:46:36Z")
I agree completely here. Asana is my favorite of all task/project management tools and I ahve used them all. It would be a shame not to use it now that I am needing to share questions regarding patients…etc. with others. It sounds to be that it is not a bit IT lift for them, they probably have all the security standards in place, they just dont want to bother looking into what it takes for them to state they are compliant and provide a BAA agreement like their competitors do. ---
**Author:** ![Ben\_Doremus](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/ben_doremus/32/46340_2.png) [@Ben\_Doremus](https://forum.asana.com/u/Ben_Doremus)\ **Post date:** [18 December 2019 17:53 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/10 "2019-12-18T17:53:44Z")
If they don’t encrypt data at rest, then it would be a pretty big technical lift for them. It’s never as easy as it seems. That being said, this is important enough that we may be moving off of the Asana platform because of it. ---
**Author:** ![Mallory\_Grimste](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/mallory_grimste/32/55405_2.png) [@Mallory\_Grimste](https://forum.asana.com/u/Mallory_Grimste)\ **Post date:** [17 May 2020 22:44 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/11 "2020-05-17T22:44:20Z")
As a healthcare provider I’d also love it if Asana would consider adding a Business Associate Agreement so that healthcare providers can use to track client info safely. That BAA is pretty important when it comes to HIPAA-compliance. It looks like you offer a ton of security and encryption already but that piece is what makes it usable from a healthcare provider’s needs. ---
**Author:** ![Ingrid\_Hartman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/ingrid_hartman/32/37153_2.png) [@Ingrid\_Hartman](https://forum.asana.com/u/Ingrid_Hartman)\ **Post date:** [3 June 2020 17:10 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/12 "2020-06-03T17:10:23Z")
Please please please add this! We need it more than ever in the time of COVID. ---
**Author:** ![Katy\_T](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/katy_t/32/166591_2.png) [@Katy\_T](https://forum.asana.com/u/Katy_T)\ **Post date:** [14 October 2020 02:23 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/13 "2020-10-14T02:23:48Z")
The last thread on HIPAA compliance was a long time ago. When will Asana become capable of BAA execution and HIPAA compliance? We need to collaborate in the health care industry and manage tasks. You’re killing me. ---
**Author:** ![Emily\_Roman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/emily_roman/32/283076_2.png) [@Emily\_Roman](https://forum.asana.com/u/Emily_Roman)\ **Post date:** [14 October 2020 08:37 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/14 "2020-10-14T08:37:38Z")
Hi @Katy_T, welcome to the Asana Community Forum! Because our product is not specific to the medical field, we do not have clearly identifiable HIPAA compliance standards. You can find more details in this post in the main feedback thread: > [@Add a HIPPA / BAA policy to Asana](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/2): > > Hi @Lauren7 Asana is not specific to the medical field and as such we do not have clearly identifiable HIPAA compliance standards, but we keep any data entered into Asana secure. Your data is not encrypted on the servers (for performance reasons), but we do encrypt over the wire via SSL. Security is something we take very seriously. Please take a look at this information: One workaround we can offer is the use of our integration with Box, which is HIPAA compliant. The link to our Box inte… I’ve also gone ahead and merged your post with the main thread to consolidate feedback. ---
**Author:** ![anon67365715](https://luna1.co/8d76cd.png) [@anon67365715](https://forum.asana.com/u/anon67365715)\ **Post date:** [20 January 2021 21:55 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/15 "2021-01-20T21:55:09Z")
@Emily_Roman – just FYI, speaking as the CTO of a digital health startup, your product does not need to be specific to the medical field in order be HIPAA compliant. The scenario in which you would need to be HIPAA compliant is when a Covered Entity (health plan, hospital system, doctor’s office, etc) or a Business Associate of that Covered Entity wants to use your platform and wants to put any Protected Health Information into it. In that case, the CE or BA must perform a risk assessment on Asana (your ISO 27001 or SOC 2 Type II might obviate that need) and must sign a Business Associate Agreement with Asana, which puts in place provisions that require Asana to treat PHI in specific ways (including accounting for disclosures, breach notifications, etc). HIPAA compliance is certainly non-trivial – it requires technical and organizational changes – and so it would make sense for Asana to say “No, we’re not HIPAA-compliant because it’s too big an investment for us at this point.”. But saying “we’re not specifically medical so we don’t support HIPAA-compliance” is probably not the right way to address these comments. There are plenty of companies that are not specifically medical that do support HIPAA compliance, e.g. Google, Amazon, [Box.com](http://Box.com), Sisense, Twilio, etc etc. Thanks for your attention on these comments. Maybe someday it will be worth it for Asana to become capable of HIPAA compliance – sounds like there are some doctors that would love to use it! ---
**Author:** ![Nick\_R](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/nick_r/32/57564_2.png) [@Nick\_R](https://forum.asana.com/u/Nick_R)\ **Post date:** [9 February 2021 19:56 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/16 "2021-02-09T19:56:29Z")
We too would love to see HIPAA compliance in Asana at [Tidepool.org](http://Tidepool.org) and I appreciate your comments @anon67365715 . ---
**Author:** ![anon2707772](https://luna1.co/8d76cd.png) [@anon2707772](https://forum.asana.com/u/anon2707772)\ **Post date:** [17 March 2021 15:56 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/17 "2021-03-17T15:56:00Z")
I agree with those who have said that a BAA is necessary here. As a member of the Asanaverse, I would love to see Asana become HIPAA-compliant for the sole reason of making more of their integrations HIPAA-compliant. It would allow even **more** companies to use it and would grow adoption of existing, fantastic features. I can speak from experience that it’s incredibly frustrating to have to find workarounds for my own company because “non-medical” companies don’t understand that their product is used in healthcare settings. ---
**Author:** ![Robert\_Jeanmenne](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/robert_jeanmenne/32/75060_2.png) [@Robert\_Jeanmenne](https://forum.asana.com/u/Robert_Jeanmenne)\ **Post date:** [9 April 2021 14:42 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/18 "2021-04-09T14:42:17Z")
Ok Guys…Let’s look at this: You have thousands of people using Asana for free. Medial people would PAY BIGTIME for HIPAA compliance. So easy to implement that upgrade! I see many dentists, oral surgeons , doctors…and I mean a lot…coordinating all the office tasks with Asana. Yet we want to coordinate patient flow. Medial offices pay much more for things…asana would be a minor bill , but a major income stream for you guys. Also a major help to all of us frontline providers braving covid ! Help us out and make asana more profit…we want to pay you for it! ---
**Author:** ![Chels\_B](https://luna1.co/8d76cd.png) [@Chels\_B](https://forum.asana.com/u/Chels_B)\ **Post date:** [14 April 2021 02:23 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/19 "2021-04-14T02:23:44Z")
I agree completely here. I love Asana, but my org does special needs advocacy and that means we sometimes need to reference PHI or store PHI documents. We will have to move to Monday because they are HIPAA compliant. This is disappointing as Asana is so much more intuitive. ---
**Author:** ![Mike\_Iley](https://luna1.co/8d76cd.png) [@Mike\_Iley](https://forum.asana.com/u/Mike_Iley)\ **Post date:** [27 July 2021 20:18 UTC](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459/20 "2021-07-27T20:18:22Z")
Submitting my vote for HIPAA compliance! Please implement before we have to switch! [Next page](https://forum.asana.com/t/add-a-hippa-baa-policy-to-asana/29459.md?page=2)