Does Atlassian Rovo / Atlassian Intelligence (Confluence, Jira) sign a BAA?
Only on some plans or setups
Atlassian signs a BAA for Standard, Premium and Enterprise plans of Jira, Jira Service Management, Jira Product Discovery and Confluence. It says Rovo Chat, Agents, Search and in-app AI in those apps fall under that BAA once Atlassian Support provisions Rovo for the HIPAA site. The Rovo MCP server, CLI, browser extension and mobile/desktop apps are excluded.
Not fully covered by the BAA: Rovo MCP server, Rovo CLI, Rovo browser extension, Rovo mobile and desktop apps; Trial or early-access AI features and third-party apps.
- Business associate
- Atlassian
- Tool
- Atlassian Rovo / Atlassian Intelligence (Confluence, Jira)
- Plans with a BAA
- Standard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence); Enterprise
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Free / trial | No BAA | Not offered | Atlassian says free and trial plans cannot sign BAAs.[1],[2] |
| Standard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence) | Signs a BAA | Accept or sign online | An org admin starts the BAA under Atlassian Administration > Security > Data protection > HIPAA compliance > Sign a BAA, and the signatory gets it by email (90 days to sign). After signing, tag the apps as HIPAA and follow the HIPAA Implementation Guide before uploading PHI. To use Rovo, ask Atlassian Support to provision it for the HIPAA site.[3],[1],[2],[4] |
| Enterprise | Signs a BAA | Through sales | Enterprise customers sign the BAA through their Atlassian representative instead of the self-serve form. The same configuration and Rovo provisioning steps apply.[3],[2] |
| Atlassian Government Cloud | No BAA | Not offered | Atlassian says the BAA process and HIPAA Rovo provisioning are not available for Government Cloud.[3],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Atlassian says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Rovo ChatStandard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence), Enterprise | Covered | Atlassian lists it as HIPAA-eligible under its existing BAA on HIPAA-enabled sites, once Support has provisioned Rovo.[3],[1] |
| Rovo AgentsStandard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence), Enterprise | Covered | Atlassian lists Rovo Agents as HIPAA-eligible. Rovo cannot write to Atlassian apps that are not HIPAA-enabled, or to external systems through third-party connectors.[3] |
| Rovo SearchStandard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence), Enterprise | Covered | Atlassian lists Rovo Search across its apps as HIPAA-eligible.[3] |
| In-app AI in Jira, Confluence, JSM and Jira Product Discovery (formerly Atlassian Intelligence)Standard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence), Enterprise | Covered | Atlassian lists in-app AI experiences in these four apps as HIPAA-eligible. The HIPAA pages do not use the name 'Atlassian Intelligence'.[3],[1] |
| Rovo web searchStandard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence), Enterprise | Not stated | The HIPAA Implementation Guide suggests considering turning web search off, because search parameters may go to the destination site's systems. Atlassian does not say outright whether it is covered.[1] |
| Rovo MCP server, Rovo CLI, Rovo browser extension, Rovo mobile and desktop appsStandard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence), Enterprise | Excluded | Atlassian names these as not HIPAA-compliant for now. It says the list is not exhaustive.[3],[1] |
| Trial or early-access AI features and third-party appsStandard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence), Enterprise | Excluded | Trial and early-access features are not automatically covered. Third-party products need their own BAA, and the Atlassian BAA excludes them.[1],[5] |
Workspace and collaboration AI that offer a BAA
- Adobe Acrobat AI AssistantBAA on: Acrobat Studio for enterprise: Analyzer in Acrobat, Acrobat Studio for enterprise: Knowledge Base in AcrobatSome plans only
- Airtable AIBAA on: Enterprise ScaleSome plans only
- Asana AIBAA on: AsanaGov, Enterprise+Some plans only
- Box AIBAA on: Enterprise / Enterprise Plus / Enterprise AdvancedSome plans only
- ClickUp BrainBAA on: EnterpriseSome plans only
- Coda AI (Superhuman Docs AI)BAA on: Docs EnterpriseSome plans only
All BAA-ready alternatives to Atlassian Rovo / Atlassian Intelligence (Confluence, Jira)
Sources
- The HIPAA Implementation Guide
- Sign a Business Associate Agreement (BAA)
- Use Rovo for HIPAA organizations
- Atlassian HIPAA compliance resources
- Atlassian Business Associate Agreement
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.