Is ClickUp HIPAA compliant? What the Enterprise BAA actually covers
Only on the Enterprise plan, and only once a business associate agreement is signed. ClickUp lists HIPAA as included on Enterprise and its Max tier; Free Forever, Core and Business carry no agreement, so patient information has no place in an account on those plans. With the agreement in place, ClickUp becomes a vendor you may put patient information into — which is a starting point, not a finished answer.
The agreement covers ClickUp itself. It does not reach the email accounts, chat tools and automation platforms a workspace is usually connected to, and it does not turn a project-management tool into a clinical record system. So even a clinic on Enterprise should keep some workflows elsewhere. This page sorts which is which, and what to do if your account is on a lower plan.
This is general information to help you ask better questions, not legal advice. Where it turns on your specific facts, it says so, and the person who should sign off is your compliance officer or healthcare counsel.
Which ClickUp plans offer a business associate agreement?
Enterprise, and Max, which ClickUp sells with Enterprise's features. ClickUp's pricing page (opens in new window) shows HIPAA compliance as included on those two tiers and not on the others. Every lower plan, including older accounts still on Unlimited, has no agreement available.
Two terms carry the rest of this page. Protected health information (PHI) is health information that identifies a patient — a name next to an appointment reason is enough. A business associate agreement (BAA) is the contract HIPAA requires between a healthcare organisation and any vendor that creates, receives, stores or transmits PHI on its behalf; the HHS guidance on business associates (opens in new window) sets out what it has to contain.
| Plan | BAA available? | Can it hold PHI? |
|---|---|---|
| Free Forever | No | No |
| Core, or Unlimited on older accounts | No | No |
| Business | No | No |
| Enterprise | Yes, signed with ClickUp | Yes, inside ClickUp, once the BAA is signed |
| Max | Yes, as part of its Enterprise features | Yes, on the same terms as Enterprise |
The order matters. Sign first, then put PHI in — a list built on Business and filled with patient names is out of bounds from the day it was created, not from the day someone upgrades. Plan names and features change, so confirm the current terms with ClickUp on the day you decide.
What does ClickUp's BAA cover?
ClickUp's own handling of the PHI you put into it. The agreement commits ClickUp to safeguard that data, limit its use and disclosure, and report incidents to you. It sits on top of the security programme ClickUp describes on its security page (opens in new window).
- Data at rest. ClickUp states that all data is encrypted at rest with AES-256.
- Data in transit. ClickUp states that web application traffic is encrypted over TLS 1.2.
- Access controls. Enterprise provides the controls — roles, permissions, sign-in policies — but who can see which space is configured by you, not by ClickUp.
- Audits. ClickUp lists SOC 2 Type 2 and ISO 27001 among its attestations. Those describe ClickUp's controls; they are not a HIPAA certification, because no such government certification exists.
What does the BAA not cover?
Anything that is not ClickUp. A BAA binds the vendor that signs it, so the moment a task, comment or form answer leaves the platform — in a notification email, a Slack message, a Zap or a webhook — it is on the other vendor's side of the line, and that vendor needs its own agreement.
| Area | Covered by ClickUp's BAA? | What remains your responsibility |
|---|---|---|
| Tasks, docs, comments and attachments | Yes, on Enterprise with the BAA signed | Who is invited to each space, and what staff type into it |
| Email notifications | Only until they leave ClickUp | The inbox they land in, and whether it is under its own BAA |
| Native integrations (Gmail, Slack, Google Drive) | No | A BAA with each connected vendor, or no PHI flowing to it |
| Zapier, Make and webhooks | No | The same — and Zapier signs no BAA at all |
| ClickUp Brain and other AI features | Only if your agreement names them | Getting that in writing before AI runs on a space with PHI |
| Public links and guest access | The features exist; their use is yours | Turning off public sharing and reviewing guests on PHI spaces |
| Exports | No, once the file is downloaded | Where exported spreadsheets are saved and sent |
| Policy and training | No — this is outside any platform | Risk analysis, written policies, staff training, breach response |
AI deserves a specific check. ClickUp's AI privacy FAQ says it has agreements in place with the language-model providers it uses, which is encouraging but is not the same as your BAA naming ClickUp Brain. Ask ClickUp to confirm in writing which AI features your agreement covers before anyone summarises or drafts from a space that holds patient records.
Which healthcare workflows fit in ClickUp under a BAA?
Operational work that supports care without being the clinical record. ClickUp is built for tasks, projects and internal documentation, and with the agreement signed and access set carefully, a practice can use it for the coordination around patients — keeping the detail to the minimum each task needs.
- Task management. Follow-ups such as “call back about a referral” or “chase missing records”, assigned to the right person, carrying a record number rather than a diagnosis.
- Project tracking. Opening a new location, onboarding a provider, rolling out a new system or running a compliance audit. Most of this never touches PHI at all.
- Internal documentation. Standard operating procedures, front-desk scripts, training material and policy drafts.
- Administrative queues. Prior authorisation or referral follow-up tracked as tasks, with the clinical documents themselves left in the system they came from.
Which healthcare workflows should stay out of ClickUp?
The ones where ClickUp would become the system of record for patient care, or the gateway through which patient data enters the practice. Even under a BAA, those belong in systems built for them, where the record, its history and patients' rights over it are managed in one place.
- Patient intake forms. Intake answers belong in the EHR or a form tool integrated with it. Collected in ClickUp, they become tasks visible to everyone on the list, copied into notifications, and kept apart from the patient's chart.
- Clinical notes. ClickUp is not an electronic health record. Notes kept in tasks or docs sit outside the chart your clinicians, auditors and patients rely on.
- Billing and insurance data. Claims, policy numbers and payment details belong in the billing or practice-management system and its own integrations, under that vendor's agreement.
- Patient-facing messages. Reminders and recalls sent from ClickUp leave through email or SMS tools; send them from the scheduling system instead.
What are the options for a clinic on a lower ClickUp plan?
Three, and the right one depends on how much patient data your team genuinely needs inside ClickUp. Whichever you choose, the decision and the data flow behind it should be written down before anything changes, so your compliance officer has something concrete to sign.
- Upgrade to Enterprise. ClickUp quotes Enterprise individually. It makes sense when PHI really does need to sit next to the work — and the integration and AI checks above still apply.
- Keep PHI out entirely. Run ClickUp for operations, projects and documentation, and keep every patient detail in the clinical systems. Be careful with “anonymous” shortcuts: HHS's de-identification guidance (opens in new window) treats record numbers and initials as identifiers, so whether a field is safe is a question for your compliance officer.
- Use a dedicated HIPAA platform for patient data. Move the patient-touching workflow into a system whose vendor signs a BAA — often one you already pay for, such as the EHR or practice-management system — and let ClickUp hold the work around it.
If PHI is already in a lower-plan account, do not quietly delete it and move on. Whether that needs assessing as a potential breach is a question for your compliance officer, and the tasks, their history and your notes are the evidence they will need. HHS publishes a guide to who counts as a covered entity (opens in new window) if you are unsure HIPAA applies to you at all.
What we build, and what we do not claim
There is no government HIPAA certification for software or consultants, and we hold none. What we do is map the data flow before anything connects, decide with you which workflows belong in ClickUp, keep patient information out of integrations that have no agreement, and hand over documentation your compliance officer can review. They decide what is acceptable; we build to that decision.
Where to go next
If you run ClickUp and need spaces, automations and integrations built around a clear data boundary, the ClickUp automation consultant page covers that work. If a Zap sits between ClickUp and your other systems, read whether Zapier is HIPAA compliant first. If your practice also runs GoHighLevel, the guide to GoHighLevel and HIPAA explains the same agreement-stops-at-the-edge pattern. Still choosing a work-management tool? The monday.com vs ClickUp comparison and the guide to monday.com and HIPAA cover the alternative. For the clinical side of automation, see AI automation for healthcare practices.
Common questions about ClickUp and patient data
Does ClickUp sign a BAA on the Business plan?
No. ClickUp's pricing page lists HIPAA compliance as included on Enterprise and Max only, and not on Free Forever, Core or Business. On those plans there is no business associate agreement, so protected health information should not go into a task, a doc, a comment, a form or an attachment.
Does ClickUp's BAA cover the integrations we connect?
Assume not. A business associate agreement binds the vendor that signs it, so Gmail, Slack, Zapier, Make or any app connected to ClickUp needs its own agreement before PHI reaches it. ClickUp's own AI features are a separate question: confirm in writing that your agreement names them before using them on patient data.
Can I use ClickUp for patient scheduling?
Not as the system of record. On Enterprise with a signed BAA, staff can track internal follow-up tasks about appointments, but booking, reminders and the calendar patients interact with belong in your scheduling or practice-management system. Reminders sent from ClickUp would leave through email or SMS tools that need their own agreement.
What is the difference between HIPAA compliant and HIPAA compatible?
Software alone cannot be HIPAA compliant; compliance describes how your organisation handles health information. HIPAA compatible, or HIPAA eligible, describes a vendor that will sign a BAA and provides the safeguards you need. A vendor badge saying HIPAA compliant describes the vendor's programme, not your setup.
Does Lightray AI hold a HIPAA certification?
No, and there is no government HIPAA certification for software or consultants to hold. What we offer is a documented data flow, workflows that keep patient information out of tools without an agreement, and a build your compliance officer can review before anything goes live.
Free consultation
Tell us what is costing you the most time
Describe the process. You get a straight read on whether it is worth automating, roughly what it would take, and what we would tackle first — on a call that costs nothing.
- Under an hour, free, and no obligation
- Fixed price per stage, agreed before any work starts
- You own everything we build, documented and in your accounts
- If you do not need us, we will say so on that call
The form is the fastest way to reach us — we reply from a real person, usually within one business day.