Is Trello HIPAA Compliant? No — Atlassian Does Not Offer a BAA for Trello

The Short Answer

Trello is not HIPAA compliant. Atlassian does not offer a Business Associate Agreement for Trello on any plan. Private board settings, access controls, and security configurations do not change that. Using Trello for tasks that involve protected health information is a HIPAA violation regardless of how you have configured it.

Why Trello Can’t Be Used with PHI

HIPAA requires any vendor handling protected health information on your behalf to sign a Business Associate Agreement. That contract makes the vendor legally accountable for how they handle PHI and what steps they take if there is a breach.

Atlassian has not made Trello available under a BAA. You can set your boards to private, restrict access to staff only, and avoid storing document attachments. The moment a task contains a patient name, a diagnosis, or any other protected health information, your practice is out of compliance. No security setting substitutes for a signed BAA.

Atlassian does offer BAAs for some of its products — Jira Software and Confluence in certain enterprise agreements. Trello is not on that list. If you need a kanban board with HIPAA compliance, you need to look at other tools.

What This Means for Small Practices

Many small practices use Trello because it is free, familiar, and fast to set up. For non-clinical administrative tasks — supply orders, equipment maintenance, marketing — it works fine.

PHI tends to creep in. A front desk staffer adds a patient name to a card to track paperwork. A provider attaches a referral note to a board. Someone titles a card with an appointment reason. None of these feel like a compliance incident in the moment. They are just the ordinary way people use task boards. In Trello, each one creates a HIPAA problem because there is no BAA covering the data.

The Compliance Gap

Trello has no HIPAA mode because Atlassian never offered a BAA for it. There is nothing to configure.

Some practices try to manage this with internal policies: no patient names on cards, initials only, keep PHI in the EHR. These policies are hard to enforce and do not close the legal gap. Atlassian has made no contractual commitment to protect PHI that ends up in Trello. If a staffer breaks the rule, your practice holds the liability alone.

Who Should Use Trello

Trello works well for non-clinical tasks that stay clear of patient data. A practice can use it for supply tracking, facilities work, and internal projects — as long as clinical task management lives in a separate, HIPAA-compliant tool.

Who Should Look Elsewhere

If PHI-related task management is the goal, Trello is the wrong tool. ClickUp Business Plus at $19/user/month includes a BAA and supports a self-serve upgrade. PHIGuard starts at $20/month flat for up to 10 staff with a BAA at every tier and compliance program features built in. Dock Health at $15/user/month was built for healthcare teams. All three will sign a BAA. Trello will not, and that is the only thing that matters for HIPAA.