Is Confluence HIPAA Compliant?

Short answer

Confluence is not HIPAA compliant on Standard or Premium plans. Atlassian offers a BAA for Confluence, but only through the Cloud Enterprise plan. Clinics using Confluence for clinical documentation — SOPs, incident reports, care coordination notes, or any content that references patients — must be on Enterprise with a signed BAA. Most small clinics are not, which means PHI in their Confluence workspace has no contractual protection.

BAA availability

Atlassian provides a HIPAA BAA for Confluence, Jira, and other Atlassian Cloud products — exclusively through the Atlassian Cloud Enterprise plan.

The following Atlassian Cloud plans have no BAA path:

• Free — no BAA
• Standard — no BAA
• Premium — no BAA

If your clinic is on any plan below Enterprise, no amount of configuration changes the fact that Atlassian has not agreed to serve as a HIPAA Business Associate for your workspace. Storing PHI in a non-Enterprise Confluence instance creates an unprotected disclosure.

To access the Enterprise plan, contact Atlassian’s sales team. Pricing is available through direct engagement or authorized Atlassian partners.

Confluence Data Center: a separate category

Confluence Data Center is the self-hosted version of Confluence. When a clinic or its IT vendor installs Data Center on its own infrastructure — whether on-premises servers, AWS, Azure, or another hosting environment — Atlassian is not the data processor. Atlassian does not provide a BAA for Data Center.

HIPAA compliance for a Data Center deployment depends on:

• The security and HIPAA compliance of the hosting environment (does the host have a BAA?)
• How the clinic configures access controls, authentication, and audit logging
• Whether the clinic’s IT vendor has executed its own BAA with the clinic
• How backups and disaster recovery are managed

Data Center deployments give the clinic more control, but they also assign the clinic full responsibility for the infrastructure layer that a SaaS provider would otherwise own.

Where PHI typically enters Confluence at clinics

Small clinics use Confluence for knowledge management, which means it often becomes the home for documents that are one step away from patient data. Common PHI exposure patterns:

Clinical SOPs containing patient scenarios. A procedure document that references “patients with condition X” or includes an example case with identifying details contains PHI.

Incident documentation. Post-incident reviews that name a patient or describe a case with enough detail to identify an individual contain PHI, even if the intent was internal process improvement.

Care coordination or huddle notes. Teams that use Confluence pages to capture patient lists, handoff notes, or care planning details are storing PHI without recognizing it.

Training materials. Onboarding documentation that uses real patient cases as examples — even lightly disguised ones — can constitute PHI if a reasonable person could identify the patient.

What a compliant Confluence setup requires

If the clinic commits to Atlassian Cloud Enterprise and executes the BAA, the following controls should be in place:

Access management. Configure Atlassian Access (the enterprise identity layer) with SSO and enforce multi-factor authentication. Apply space-level and page-level permissions to restrict PHI-containing content to authorized users only.

Audit logging. Atlassian Cloud Enterprise includes organization audit logs. Enable these and configure appropriate retention. Review access logs for PHI-containing spaces.

Data residency. Atlassian Cloud Enterprise allows data residency configuration for certain products in supported regions. Confirm residency settings for any PHI workloads.

External user controls. Restrict guest access and external sharing for spaces that contain PHI. Confluence’s default sharing settings may be too permissive for clinical content.

BAA scope. Confirm with Atlassian which products are explicitly named in your BAA. Jira, Confluence, and other Atlassian tools may each need to be addressed individually in the agreement.

The real risk for Standard and Premium clinics

Many small clinics operate on Confluence Standard or Premium for cost reasons. These are solid knowledge management tools, and for general administrative content — policies without patient data, IT runbooks, HR documentation, marketing assets — they serve their purpose.

The risk appears when the tool’s flexibility encourages staff to document clinical workflows in the same system. There is no natural barrier in Confluence that prevents a staff member from creating a page with patient information. Without a BAA, each such page is a potential breach.

Addressing this requires either upgrading to Enterprise (and executing the BAA) or establishing a clear policy that Confluence is not approved for any content that references patients, and training staff to understand why.

What PHIGuard does instead