TLDR
Yes, Smartsheet is HIPAA compliant, but only on Enterprise plans starting at approximately $15,000/year. All Smartsheet add-ons are excluded from the BAA — including WorkApps, Resource Management, Brandfolder, Bridge, and Dynamic View. There is no HIPAA mode toggle; customers must manually configure compliance per Smartsheet's implementation guide. For small medical practices, the pricing floor and configuration burden make Smartsheet impractical.
The Short Answer
Smartsheet is HIPAA compliant on Enterprise plans only. Enterprise starts at approximately $15,000 per year and scales to $250,000+ depending on users and modules. Lower tiers, Free, Pro ($9/user/month), and Business ($19/user/month), do not offer a BAA.
The second critical fact: every Smartsheet add-on is excluded from the BAA scope. WorkApps, Resource Management, Brandfolder, Bridge, and Dynamic View are all outside the compliance boundary, even on Enterprise.
Which Tiers Are HIPAA-Eligible
<DataTableBlock caption=“Smartsheet HIPAA eligibility by tier” headers={[“Tier”, “Pricing”, “BAA Available”, “Add-Ons in BAA”]} rows={[ [“Free”, “$0”, “No”, “N/A”], [“Pro”, “$9/user/mo”, “No”, “N/A”], [“Business”, “$19/user/mo”, “No”, “N/A”], [“Enterprise”, “$15,000–$250,000+/yr (custom)”, “Yes”, “None — all excluded”], ]} />
The gap between Business ($19/user/month, no BAA) and Enterprise (HIPAA-eligible, custom-priced) is significant. No intermediate tier provides a BAA at a predictable, self-serve price.
The Add-On Exclusion Problem
Smartsheet’s add-on exclusion is the broadest of any major project management vendor. The excluded products are:
- WorkApps — Smartsheet’s low-code portal builder, used to create lightweight apps from Smartsheet data
- Resource Management (formerly 10,000ft) — staffing and capacity planning module
- Brandfolder — digital asset management and content library
- Bridge — Smartsheet’s workflow automation platform for cross-system integrations
- Dynamic View — role-based filtering that lets different users see tailored views of the same sheet
Many organizations adopt Smartsheet for the core spreadsheet functionality and expand into add-ons over time. In a healthcare environment, the compliance picture degrades with each add-on that gets used.
No HIPAA Mode — Manual Configuration Required
Smartsheet requires Enterprise customers to follow an implementation guide to configure security controls:
- Audit log activation and retention settings
- User access control policies
- Data retention configuration
- SSO and authentication requirements
- Integration security settings
The implementation responsibility sits with the customer. Misconfiguration is the customer’s compliance liability, not Smartsheet’s. For small practices without dedicated IT staff, this is an ongoing operational burden.
The Enforcement Context
OCR enforcement targets small practices disproportionately. Penalties apply regardless of organization size.
A practice using Smartsheet Business because Enterprise pricing is out of reach, or using Smartsheet Enterprise but relying on Bridge automations for PHI routing, has compliance exposure that OCR regularly investigates and penalizes.
Who Should Use Smartsheet Enterprise for Healthcare
Smartsheet Enterprise is appropriate for large health systems and hospital networks with existing Smartsheet deployments, IT departments to manage configuration, legal staff to review the add-on exclusions, and budgets that can accommodate Enterprise pricing.
For small practices (3-50 staff), the combination of Enterprise-only access, all-add-on exclusions, and manual compliance configuration makes Smartsheet a poor fit for clinical task management.
Alternatives for Small Medical Practices
PHIGuard starts at $99/month flat for up to 8 staff, BAA at every tier, no add-on exclusions, no manual configuration. Dock Health starts at $15/user/month with full HIPAA compliance included. Both handle compliant task management without enterprise procurement.
- Business Associate Agreement (BAA)
- A contract required by HIPAA between a covered entity (a medical practice) and any vendor handling protected health information on its behalf. Smartsheet provides a BAA only on Enterprise plans; all add-ons are explicitly excluded from the BAA scope regardless of plan.
DEFINITION
- Smartsheet Bridge
- Smartsheet's workflow automation platform, used to build cross-system automations and integrations. Bridge is explicitly excluded from Smartsheet's HIPAA BAA, meaning any workflows built with Bridge that touch PHI are not covered.
DEFINITION
- Dynamic View
- A Smartsheet add-on providing role-based data access — allowing different users to see filtered views of the same sheet. Dynamic View is explicitly excluded from Smartsheet's HIPAA BAA.
DEFINITION
Q&A
Is Smartsheet HIPAA compliant for medical practices?
Smartsheet is HIPAA compliant on Enterprise plans only, at custom pricing starting around $15,000/year. All add-ons are excluded from the BAA. There is no automated HIPAA configuration — customers must implement compliance manually. For small practices, the pricing floor and configuration burden make it impractical.
Q&A
Which Smartsheet add-ons are covered by the HIPAA BAA?
None. Smartsheet's BAA covers only the core Smartsheet platform. WorkApps, Resource Management, Brandfolder, Bridge, and Dynamic View are all explicitly excluded. Workflows built on these tools — which represent significant portions of how enterprise teams actually use Smartsheet — are outside HIPAA coverage.
Q&A
What happens if a practice uses Smartsheet Business (no BAA) for patient tasks?
Using Smartsheet Business or any lower tier for tasks involving protected health information is a HIPAA violation. There is no BAA in place. OCR penalties for small practices typically run $20,000–$35,000 at the median, with maximums reaching $500,000.
Want to learn more?
Frequently asked