Add a HIPPA / BAA policy to Asana

[Patrick_Smith2]

I second this. HIPAA compliance all the way.

[anon9178078]

Agreed! I don’t want to store PHI in Asana, but I do want to be able to use some of the integrations with Google Workspace (my HIPAA-compliant calendar and email, for example).

[Tim_Thomas1]

Agree completely!
We are heavy users of Asana within our dev team and are expanding our project management focus to the rest of the or. We now have to consider other options.
Monday.com appears to be a viable alternative however we feel Asana is a better fit for us…
Please consider making HIPAA compliance a priority.

[dhj]

A lack of HIPAA BAA makes this a no-go for our company. I like the Asana system, but unfortunately we will have to go with a competitor – most of which do have HIPAA compliance policies and will sign a BAA for Enterprise users.

[lpb]

My understanding is that Asana’s Product team is currently exploring HIPAA compliance to better support companies in the healthcare industry.

Also, in the last several months they have rolled out the following limited solution that includes HIPAA compliance just in that specific environment:

Asana Smiles™️ for Align • Asana

cc/@Rebecca_McGrath, @Emily_Roman, @Nao_Kumazaki

Thanks,

Larry

[Heather_Hopkins1]

In the dental field HIPAA compliance is now available. Any dental practictioner with an Invisalign account can access this HIPAA compliant environment.

[Joe6]

Hello! Is there any update on offering the HIPAA BAA to all clients?

We cover dental clients in our practice but we are not a dental practice (Anesthesia). HIPAA compliance is really critical for our needs. Would strongly prefer not to use another solution for this aspect of our practice.

Thanks!

[Phil_Seeman]

@Joe6

Is there any update on offering the HIPAA BAA to all clients?

HIPAA Compliance is now available in Asana. For details, see:

HIPAA Compliance

Note that it requires an Enterprise subscription and an additional add-on option as well.

[dey95.arpita]

@Alec_Zopf

just FYI, speaking as the CTO of a digital health startup, your product does not need to be specific to the medical field in order be HIPAA compliant.

The scenario in which you would need to be HIPAA compliant is when a Covered Entity (health plan, hospital system, doctor’s office, etc) or a Business Associate of that Covered Entity wants to use your platform and wants to put any Protected Health Information into it. In that case, the CE or BA must perform a risk assessment on Asana (your ISO 27001 or SOC 2 Type II might obviate that need) and must sign a Business Associate Agreement with Asana, which puts in place provisions that require Asana to treat PHI in specific ways (including accounting for disclosures, breach notifications, etc).

HIPAA compliance is certainly non-trivial – it requires technical and organizational changes – and so it would make sense for Asana to say “No, we’re not HIPAA-compliant because it’s too big an investment for us at this point.”. But saying “we’re not specifically medical so we don’t support HIPAA-compliance” is probably not the right way to address these comments. There are plenty of companies that are not specifically medical that do support HIPAA compliance, e.g. Google, Amazon, Box.com , Sisense, Twilio, etc etc.

Thanks for your attention on these comments. Maybe someday it will be worth it for Asana to become capable of HIPAA compliance – sounds like there are some doctors that would love to use it!

Hi, Thank you for the insightful clarification on HIPAA compliance & I completely agree with you. Understanding that it’s not exclusive to the medical field but pertains to handling Protected Health Information under specific conditions is crucial. Your experience as a CTO in the digital health sector adds valuable context. It’s indeed a complex yet necessary consideration for platforms like Asana, opening possibilities for broader usage with robust compliance measures. Appreciate the comprehensive response!