Monday.com is a cloud-based work management platform. Teams use it to plan projects, track tasks, manage workflows, and run CRM, software development, and service operations from customizable boards, dashboards, and automations.

With Monday.com, teams can centralize their work and automate repetitive processes. They can also connect hundreds of third-party tools and use built-in AI features to manage day-to-day operations.

Is Monday.com HIPAA compliant? Yes, based on our research, Monday.com can be HIPAA compliant.

 

What changed this year?

As of September 2026, our review did not identify any publicly disclosed changes to Monday.com's HIPAA-related policies or BAA terms.

 

Will Monday.com sign a business associate agreement (BAA)?

Yes, Monday.com will sign a business associate agreement, which can be reviewed here. Admins can accept it in the account's Administration > Security > Compliance settings and then click "Activate HIPAA Compliance." The BAA can also be signed through DocuSign.

 

What does the Monday.com BAA cover?

The Monday.com BAA covers the use and disclosure of protected health information (PHI), stating, "The Business Associate may use and disclose PHI necessary to perform its obligations to the Covered Entity as set out in the Agreement or as otherwise permitted or Required by Law under HIPAA, provided that Business Associate shall not use or disclose PHI in a manner that would not be permitted if done by the Covered Entity."

 

What does the Monday.com BAA exclude?

The BAA has three main limitations.

It only applies to Enterprise plans. The agreement says it applies only if you use the enterprise tier and have enabled the HIPAA feature. If you downgrade to another plan, you are no longer covered by the HIPAA compliance program.

Third-party integrations are not covered. monday.com offers 200+ integrations and a marketplace of apps. The BAA says customers are solely liable for any PHI exchanged with third-party services. It also says those providers are not business associates of monday.com and disclaims liability for their actions.

Some features are restricted. On HIPAA-enabled Enterprise accounts, the broadcast feature, which shares board views publicly, is disabled to prevent accidental disclosure of PHI.

 

Conclusion

Monday.com signs a BAA and can be HIPAA compliant, but only on the Enterprise plan with HIPAA compliance activated, and only if any connected third-party apps are HIPAA compliant too.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQS

What is a business associate agreement?

A business associate agreement (BAA) is a legally binding contract establishing a relationship between a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and its business associates. The purpose of this agreement is to ensure the proper protection of personal health information (PHI) as required by HIPAA regulations.

 

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting the privacy and security of certain health information, known as protected health information (PHI).

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.