Does Miro AI sign a BAA?
No BAA available
Miro does not sign BAAs. Its Master Cloud Agreement bars customers from using the services with protected health information and says Miro is not a HIPAA business associate. Miro AI is part of those services.
- Business associate
- Miro
- Tool
- Miro AI
- Plans with a BAA
- None
- Checked
No BAA
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| All plans (Free, Starter, Business, Enterprise, Education) | No BAA | Not offered | The Master Cloud Agreement lists patient, medical and other protected health information as Prohibited Data. It says the services are not built to meet HIPAA requirements and that Miro is not a Business Associate. The section has no written-agreement exception.[1] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Miro says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Miro AI | Excluded | The PHI ban covers the services, and Miro AI is part of them. The AI features addendum and the Miro AI admin security page do not mention HIPAA. Miro AI runs on Azure OpenAI and in-house models.[1],[2],[3] |
Workspace and collaboration AI that offer a BAA
- Adobe Acrobat AI AssistantBAA on: Acrobat Studio for enterprise: Analyzer in Acrobat, Acrobat Studio for enterprise: Knowledge Base in AcrobatSome plans only
- Airtable AIBAA on: Enterprise ScaleSome plans only
- Asana AIBAA on: AsanaGov, Enterprise+Some plans only
- Atlassian Rovo / Atlassian Intelligence (Confluence, Jira)BAA on: Enterprise, Standard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence)Some plans only
- Box AIBAA on: Enterprise / Enterprise Plus / Enterprise AdvancedSome plans only
- ClickUp BrainBAA on: EnterpriseSome plans only
All BAA-ready alternatives to Miro AI
Sources
- Master Cloud Agreement
- Miro AI Features Addendum (Japanese-language page)
- Miro AI admin security
- Miro Trust Center
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.