Skip to main content
BAA Directory

Is Asana HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on the Asana Enterprise+ tier. A super admin agrees to Asana's Business Associate Addendum in the admin console to turn on HIPAA compliance.

Automation and workspace. Checked on the vendor's own pages on .

Using Asana on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Asana says

“Available on the Asana Enterprise+ tier, as well as legacy tier Legacy Enterprise for existing customers who have already enabled the feature.”

Source: Asana Help Center, Asana HIPAA compliance, checked .

“Please note that a super admin must agree to Asana’s BAA in the admin console to activate HIPAA compliance.”

Source: Asana Help Center, Asana HIPAA compliance, checked .

What the BAA covers and excludes

Excludes or limits, in Asana's words:

  • Features that may be unavailable or disabled by default once HIPAA compliance is on: "These features include, but are not limited to, some Asana AI tools, integrations with certain third-party services, and personal access tokens." (Asana HIPAA Use Requirements and Limitations)
  • Third-party integration providers, including apps in Asana's App Directory: "Asana does not enter into business associate agreements with these third party providers."

What this means for ad tracking

Marketing and patient-access teams track campaigns, intake requests and follow-ups in Asana, and a task can name a patient next to the service they asked about.

A BAA with Asana covers that work on an eligible tier with HIPAA compliance turned on. It does not cover the integrations you connect or an ad platform, so a conversion should reach Meta or Google as a neutral event with no task details.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Keep Asana for what it does well. Curve carries the conversion signal to your ad platforms separately, under its own BAA.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • A fixed field list per platform, so each ad platform receives only the fields set for it.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • When identifiers are enabled, Curve hashes them with SHA-256.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Asana HIPAA compliant?

Yes, on the Asana Enterprise+ tier. A super admin agrees to Asana's Business Associate Addendum in the admin console to turn on HIPAA compliance. With a signed BAA, Asana can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Asana sign a BAA?

Yes, on the Asana Enterprise+ tier. A super admin agrees to Asana's Business Associate Addendum in the admin console to turn on HIPAA compliance. In Asana's words: “Available on the Asana Enterprise+ tier, as well as legacy tier Legacy Enterprise for existing customers who have already enabled the feature.” We checked Asana's own pages on October 5, 2026.

Which Asana plans include a BAA?

Asana makes HIPAA compliance available on its Enterprise+ tier, and on Legacy Enterprise only for existing customers who already enabled the feature. Legacy Enterprise customers who have not enabled it need to move to Enterprise+. A super admin agrees to the Business Associate Addendum in the admin console.

Does a BAA with Asana cover my ad pixels?

No. A BAA covers the data Asana handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with Asana.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Asana before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call