Is Asana HIPAA Compliant for Therapists?
Quick Answer
Technically yes, but not realistically for a solo or small practice. Asana offers a Business Associate Agreement only on its Enterprise+ tier, activated by a Super Admin in the admin console — a process that takes about 24 hours to complete, and no PHI should be entered before it's done. If you were considering Trello as an alternative: don't. Atlassian explicitly excludes Trello from its BAA program at any price.
Written & fact-checked by the Therapy HIPAA Hub editorial team — see our editorial standards.
Verified October 2026 against Asana's official HIPAA compliance help article
BAA Available?
Yes
On Which Plan
Enterprise+ only (plus legacy Enterprise accounts that already activated the HIPAA feature)
Asana's Enterprise+ tier is priced and structured for large organizations, with per-seat enterprise pricing far beyond what a solo or small practice would spend on task management. Even though a compliant path technically exists, it's not a realistic option for most of this site's readers — a general project board without client PHI on it is the safer use case regardless of plan.
What to Use Instead for Client Work
Keep client-specific tasks and scheduling inside your EHR (SimplePractice's calendar and client portal are already BAA-covered) — use Asana, if at all, only for non-clinical practice admin like marketing or supply ordering, with no client names or case details ever entered.
Affiliate link — we may earn a commission at no extra cost to you.
Why Trello Isn't Even Worth Considering as an Alternative
Trello and Asana are often compared as similar task-board tools, but their HIPAA stories are completely different. Atlassian, Trello's parent company, offers BAAs for Jira, Jira Service Management, and Confluence — but explicitly excludes Trello, stating it does not support storing sensitive personal information at all. There is no plan, no price point, and no workaround that makes Trello HIPAA-eligible.
Asana's Real but Impractical Compliance Path
Asana's HIPAA feature is gated behind Enterprise+, their top subscription tier, and must be explicitly activated — a Super Admin signs a Business Associate Addendum in the admin console, and the feature takes roughly 24 hours to go live. Until that activation completes, no PHI should be entered into the workspace. This is a genuine, documented compliance path — just one built for large healthcare organizations, not a one- or two-person therapy practice.
Trusted by 225,000+ Therapists
50% Off Your First 4 Months of SimplePractice
SimplePractice is the #1 HIPAA-compliant practice management platform for therapists. Includes a signed BAA, encrypted messaging, telehealth, and full insurance billing.
Limited-time summer offer · No credit card required for trial
Need HIPAA-compliant email only? See Hushmail for Healthcare →
FAQ — Asana and HIPAA
Can a solo therapist realistically get Asana's HIPAA feature?
Technically the compliance path exists on Asana's Enterprise+ tier, but it's priced and structured for large organizations. Most solo and small practices will find it far more practical to keep client-related tasks inside their EHR instead.
Is Trello a HIPAA-compliant alternative to Asana?
No. Atlassian explicitly excludes Trello from its HIPAA/BAA program — unlike Jira or Confluence, there is no plan or price tier that makes Trello eligible. Don't use Trello for anything involving client information.
Can I use Asana's free or Starter plan if I never mention client names?
A board with no client-identifying information at all (e.g., general marketing tasks) carries low risk regardless of plan. But this requires strict discipline — the moment a task references a specific client, even indirectly, you're outside what a non-Enterprise+ plan can safely hold.