Does Smartsheet AI sign a BAA?
Only on some plans or setups
Smartsheet signs a BAA for its Enterprise plan through an account manager or its healthcare form. Its HIPAA article, BAA and AI security materials never say whether Smartsheet AI features are inside the BAA, so AI coverage is unknown.
- Business associate
- Smartsheet
- Tool
- Smartsheet AI
- Plans with a BAA
- Enterprise
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Trials / Pro / Business | No BAA | Not offered | Smartsheet lists these as not PHI-eligible. EAP members, Brandfolder and Smartsheet University/Community sites are also ineligible.[1] |
| Enterprise | Signs a BAA | Through sales | Request through your account manager or the Smartsheet for Healthcare form. PHI may go only into PHI Eligible Services. Customers configure the controls under a shared-responsibility model. Third-party attachments and integrations need their own arrangements.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Smartsheet says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Smartsheet AI features (in-app generative AI)Enterprise | Not stated | Neither the HIPAA help article nor the BAA mentions AI. Smartsheet's AI whitepaper says its AI follows the platform's compliance standards, naming SOC 2 and GDPR but not HIPAA. It uses Azure OpenAI and Amazon Bedrock.[1],[2],[3],[4] |
| Smartsheet MCP ServerEnterprise | Not stated | Data goes to whichever AI platform the customer connects. The BAA restricts sending PHI to third parties, but Smartsheet does not address the MCP server and HIPAA directly.[3],[2] |
Workspace and collaboration AI that offer a BAA
- Adobe Acrobat AI AssistantBAA on: Acrobat Studio for enterprise: Analyzer in Acrobat, Acrobat Studio for enterprise: Knowledge Base in AcrobatSome plans only
- Airtable AIBAA on: Enterprise ScaleSome plans only
- Asana AIBAA on: AsanaGov, Enterprise+Some plans only
- Atlassian Rovo / Atlassian Intelligence (Confluence, Jira)BAA on: Enterprise, Standard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence)Some plans only
- Box AIBAA on: Enterprise / Enterprise Plus / Enterprise AdvancedSome plans only
- ClickUp BrainBAA on: EnterpriseSome plans only
All BAA-ready alternatives to Smartsheet AI
Sources
- Smartsheet and HIPAA
- Smartsheet HIPAA Business Associate Agreement
- Smartsheet AI Data Security Whitepaper
- Responsible AI at Smartsheet
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.