Is Trello HIPAA compliant? Does it sign a BAA?
The answer
No public statement
No public statement offering a BAA for Trello. Atlassian says it can sign BAAs for Jira, Jira Service Management, Jira Product Discovery and Confluence, and Trello is not on that list. Its customer agreement bars protected health information without a BAA.
Automation and workspace. Checked on the vendor's own pages on .
Using Trello on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What Atlassian says
“We can sign BAAs for Standard, Premium, and Enterprise plans for Jira, Jira Service Management, Jira Product Discovery, and Confluence. Free and trial plans are not eligible to sign BAAs.”
“Unless the parties have entered into a ‘Business Associate Agreement,’ Customer must not (and must not permit anyone else to) upload to the Cloud Products (or use the Cloud Products to process) any patient, medical or other protected health information regulated by the Health Insurance Portability and Accountability Act.”
What this means for ad tracking
Teams use Trello boards for content calendars, campaign tasks and sometimes intake follow-ups, and a card can carry a patient's name next to the service they asked about.
Without a BAA for Trello, patient details should stay off its boards, and a lead or booking you count as a conversion should reach your ad platforms with no health details.
Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.
A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.
How Curve helps
- Curve gives you a conversion signal that does not depend on Trello or a browser pixel carrying patient details.
- Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
- A fixed field list per platform, so each ad platform receives only the fields set for it.
- PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
- When identifiers are enabled, Curve hashes them with SHA-256.
- Consent management for your site, alongside the tracking.
- A HIPAA-compliant setup done by Curve's team, with a BAA signed on every plan.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Is Trello HIPAA compliant?
No public statement offering a BAA for Trello. Atlassian says it can sign BAAs for Jira, Jira Service Management, Jira Product Discovery and Confluence, and Trello is not on that list. Its customer agreement bars protected health information without a BAA. Ask Atlassian directly before sending it patient information.
Does Trello sign a BAA?
No public statement offering a BAA for Trello. Atlassian says it can sign BAAs for Jira, Jira Service Management, Jira Product Discovery and Confluence, and Trello is not on that list. Its customer agreement bars protected health information without a BAA. In Atlassian's words: “We can sign BAAs for Standard, Premium, and Enterprise plans for Jira, Jira Service Management, Jira Product Discovery, and Confluence. Free and trial plans are not eligible to sign BAAs.” We checked Atlassian's own pages on October 5, 2026.
Can I use Trello with patient data?
Not until a BAA covers it. Atlassian's customer agreement bars protected health information in its cloud products unless the parties have entered into a Business Associate Agreement, and Atlassian lists Jira, Jira Service Management, Jira Product Discovery and Confluence as the products it can sign BAAs for. We found no statement offering one for Trello, so ask Atlassian directly and keep Protected Health Information out of Trello until a BAA is in place.
Can I still track ad conversions that come through Trello?
Yes, when the conversion reaches your ad platforms without health information. Curve sends conversions server-side under a BAA it signs on every plan, with neutral event names and SHA-256 hashed identifiers.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you. Book a call to get started.
Sources
- Atlassian Support, Understand HIPAA compliance for Atlassian apps
- Atlassian Customer Agreement, Section 6.3
- Atlassian Trust Center, HIPAA
- Atlassian Support, Sign a Business Associate Agreement (BAA)
- Trello legal page (redirects to the Atlassian Customer Agreement)
Last checked . Vendors change their plans and terms, so confirm the current terms with Atlassian before you send it patient data.
Related tools
- Does Asana sign a BAA?Signs a BAA on specific plans. Enterprise+ tier; Legacy Enterprise only if already enabled.
- Does monday.com sign a BAA?Signs a BAA on specific plans. Enterprise plan with the HIPAA compliance feature enabled.
- Does Smartsheet sign a BAA?Signs a BAA on specific plans. Enterprise plan, excluding Legacy Enterprise.
- Does Slack sign a BAA?Signs a BAA on specific plans. Enterprise-level plan plus the Slack HIPAA Enabled SKU.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call