Does Asana AI sign a BAA?
Only on some plans or setups
Asana signs a BAA on its Enterprise+ tier, accepted by a super admin in the admin console. Asana warns that some Asana AI tools are not HIPAA-compliant and may be unavailable or off by default once HIPAA is on, but it does not say which ones.
Not fully covered by the BAA: Some Asana AI tools (unspecified); AI features on AsanaGov HIPAA domains.
- Business associate
- Asana
- Tool
- Asana AI
- Plans with a BAA
- Enterprise+; AsanaGov
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Personal (free) | No BAA | Not offered | Asana's HIPAA terms bar submitting PHI into any free version.[1] |
| Starter / Advanced / Enterprise | No BAA | Not offered | Asana names Enterprise+ as the HIPAA tier. Legacy Enterprise customers who had not already enabled HIPAA must move to Enterprise+.[2] |
| Enterprise+ | Signs a BAA | Accept or sign online | A super admin accepts the BAA under Admin Console > Security > HIPAA compliance, and activation takes up to 24 hours. The domain must be a single Organization, with 2FA, SSO or Google auth. PHI goes only in specified task fields, comments and attachments. Integrations and personal access tokens are disabled by default.[2],[1] |
| AsanaGov | Signs a BAA | Accept or sign online | HIPAA is available for AsanaGov domains through the same admin-console acceptance. A commercial BAA does not carry over, so a new one must be signed in the AsanaGov domain.[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Asana says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Some Asana AI tools (unspecified)Enterprise+ | Excluded | Asana says some features, including some Asana AI tools, are not HIPAA-compliant. They may be unavailable or disabled by default once HIPAA is on, and turning them on is at the customer's own risk. Asana does not name the specific tools.[1],[2] |
| Asana AI / AI Studio (all other AI features)Enterprise+ | Not stated | The help page says enabling HIPAA changes how Asana AI features behave but gives no details. AI Studio is not mentioned on the HIPAA pages, and Asana's AI Studio FAQ page failed to load.[2],[1] |
| AI features on AsanaGov HIPAA domainsAsanaGov | Partly covered | Asana's AsanaGov HIPAA announcement says AI features may only use approved services that have a signed BAA.[3] |
Workspace and collaboration AI that offer a BAA
- Adobe Acrobat AI AssistantBAA on: Acrobat Studio for enterprise: Analyzer in Acrobat, Acrobat Studio for enterprise: Knowledge Base in AcrobatSome plans only
- Airtable AIBAA on: Enterprise ScaleSome plans only
- Atlassian Rovo / Atlassian Intelligence (Confluence, Jira)BAA on: Enterprise, Standard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence)Some plans only
- Box AIBAA on: Enterprise / Enterprise Plus / Enterprise AdvancedSome plans only
- ClickUp BrainBAA on: EnterpriseSome plans only
- Coda AI (Superhuman Docs AI)BAA on: Docs EnterpriseSome plans only
All BAA-ready alternatives to Asana AI
Compare Asana AI
- Asana AI vs monday.com AImonday.com AI: some plans
- ClickUp Brain vs Asana AIClickUp Brain: some plans
Sources
- HIPAA Use Requirements and Limitations
- HIPAA compliance
- HIPAA is now available for Asana Gov customers
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.