ClickUp Brain vs Asana AI: which signs a HIPAA BAA?
Both can be covered by a BAA, on different terms. ClickUp signs one for ClickUp Brain only on Enterprise. Asana signs one for Asana AI only on Enterprise+; AsanaGov.
- Business associate
- ClickUp
- Tool
- ClickUp Brain
- Plans with a BAA
- Enterprise
- Checked
Some plans only
- Business associate
- Asana
- Tool
- Asana AI
- Plans with a BAA
- Enterprise+; AsanaGov
- Checked
Some plans only
Side by side
| ClickUp BrainClickUp | Asana AIAsana | |
|---|---|---|
| BAA | Some plans only | Some plans only |
| Plans with a BAA | Enterprise | Enterprise+; AsanaGov |
| How to get it | Not stated | Accept or sign online |
| AI features outside the BAA partly covered excluded |
|
|
| Sources | 5 sources | 3 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
ClickUp Brain
- Free / Unlimited / BusinessClickUp's own materials say HIPAA support is limited to the Enterprise plan.No BAA
- EnterpriseClickUp says it can support HIPAA for Enterprise customers by agreeing to a BAA. Enterprise is sold through sales, but no page describes how the BAA itself is requested or signed.Signs a BAA
Asana AI
- Personal (free)Asana's HIPAA terms bar submitting PHI into any free version.No BAA
- Starter / Advanced / EnterpriseAsana names Enterprise+ as the HIPAA tier. Legacy Enterprise customers who had not already enabled HIPAA must move to Enterprise+.No BAA
- Enterprise+A super admin accepts the BAA under Admin Console > Security > HIPAA compliance, and activation takes up to 24 hours. The domain must be a single Organization, with 2FA, SSO or Google auth. PHI goes only in specified task fields, comments and attachments. Integrations and personal access tokens are disabled by default.Signs a BAA
- AsanaGovHIPAA is available for AsanaGov domains through the same admin-console acceptance. A commercial BAA does not carry over, so a new one must be signed in the AsanaGov domain.Signs a BAA
If you handle patient data
Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information. Keep PHI out of the AI features listed as outside the BAA.
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.