Skip to main content
BAA Directory

Is Jira HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA on specific plans

Yes, on Atlassian's Standard, Premium and Enterprise plans. Atlassian signs a BAA that covers Jira, Jira Service Management and Confluence.

Automation and workspace. Checked on the vendor's own pages on .

Using Jira on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Atlassian says

“Customers who are subject to HIPAA compliance and want to partner with Atlassian purchase a Standard, Premium, or Enterprise Plan and enter into a Business Associate Agreement (BAA) that covers the applicable products and services.”

Source: Atlassian Trust Center, HIPAA, checked .

“Atlassian Cloud: Standard, Premium, and Enterprise plans for Jira, Jira Service Management, and Confluence”

Source: Atlassian Support, Sign a Business Associate Agreement (BAA) (Who can do this?), checked .

“You must have a BAA in place before PHI can be uploaded to our apps.”

Source: Atlassian Support, Sign a Business Associate Agreement (BAA), checked .

What the BAA covers and excludes

Excludes or limits, in Atlassian's words:

  • Atlassian Government Cloud: Atlassian Support lists a BAA there as “Not available” (Atlassian Support).
  • Apps you have not tagged for HIPAA: “After you’ve signed a BAA, you must tag your app and follow the HIPAA Implementation Guide before you upload any PHI into the apps.” (Atlassian Support)

What this means for ad tracking

Marketing and patient-access teams plan campaigns, track intake requests and document processes in Jira and Confluence, and an issue or a page can name a patient next to the service they asked about.

A BAA with Atlassian covers Jira, Jira Service Management and Confluence on an eligible plan, once each app is tagged for HIPAA. Atlassian says “HIPAA compliance is a shared responsibility between Atlassian and you” (Atlassian Support). The BAA does not cover an ad platform, so a conversion should reach Meta or Google as a neutral event with no ticket or page details.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Jira and Confluence for what they do well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does Jira sign a BAA?

Yes, through Atlassian, on Standard, Premium and Enterprise plans. In Atlassian's words: “Customers who are subject to HIPAA compliance and want to partner with Atlassian purchase a Standard, Premium, or Enterprise Plan and enter into a Business Associate Agreement (BAA) that covers the applicable products and services” (Atlassian). We checked Atlassian's own pages on November 9, 2026.

Is Jira HIPAA compliant?

Jira can hold patient information once your organization is on a Standard, Premium or Enterprise plan, has signed Atlassian's BAA, has tagged Jira for HIPAA and follows Atlassian's HIPAA Implementation Guide. Atlassian says its protections “enable our customers to operate our products in compliance with HIPAA” (Atlassian), and that “HIPAA compliance is a shared responsibility between Atlassian and you” (Atlassian Support). How you set up Jira still matters, so talk to your counsel about your own setup.

Is Confluence HIPAA compliant?

Confluence is covered the same way as Jira. Atlassian Support lists “Standard, Premium, and Enterprise plans for Jira, Jira Service Management, and Confluence” as eligible for its BAA (Atlassian Support). Sign the BAA and tag Confluence for HIPAA before any PHI goes into it.

How do you sign a BAA with Atlassian?

On Standard and Premium plans, an organization admin goes to Atlassian Administration, selects Security, then Data protection, then HIPAA compliance, selects Sign a BAA and submits the signatory's details. Atlassian then emails the signatory a copy of the BAA to sign. On Enterprise plans, Atlassian says to contact your Atlassian representative (Atlassian Support).

Does a BAA with Atlassian cover my ad pixels?

No. A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing a BAA, so a conversion sent to them needs to leave PHI behind. Curve Compliance sends that conversion server-side under a BAA it signs on every plan.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Atlassian before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call