09/14/2026
⚠️ Signing a BAA with Atlassian does not make your instance HIPAA compliant. It makes it eligible. The rest is configuration, and that part is yours. Two months after Rovo came into the HIPAA program, here is what we keep finding in environments that turned it on.
→ Marketplace apps are not covered by Atlassian's BAA. If an app can see data that includes PHI, you need a BAA with that vendor, and getting it is on you. Pull your installed app list, mark the ones with access to HIPAA-tagged products, and ask each vendor for a BAA in writing.
→ Free and trial plans are not eligible to sign a BAA, and anyone with a company email can spin up their own Jira or Confluence site. Admin lists these under Shadow IT apps, but only if you have domain verification and Atlassian Guard Standard. Go look at that page today. If you cannot get to it, that is your first finding.
→ Notifications are mostly handled, but not entirely. Atlassian now uses notification templates that leave PHI out, so Jira email and push can stay on. Three switches are still yours: push notifications off in Confluence, Safe customer notifications on in JSM, and HIPAA-compliant alert notifications on in JSM.
→ Automation can send data out of Jira, and nothing warns you when it does. Atlassian's guidance covers rules that email PHI. Rules can also push issue data straight into an outside system, and that is the bigger risk. Start with every rule that sends an email or a web request, and check where it is sending.
→ PHI does not belong in metadata or naming fields. Atlassian's examples are Confluence space names, file names, AI agent names, and Jira app configurations, plus support tickets and surveys. Those are examples, not the full list. Write the rule down, because this one is behavior and behavior drifts.
Most of this sits in Atlassian's Implementation Guide, which is public and clear. The gap is that signing the BAA feels like the finish line when it is the entry requirement.
🔎 If you are running Atlassian in a regulated environment: which Marketplace apps have access to data in your HIPAA-tagged products, and do you have a BAA with each of those vendors?
APPsolute Best LLC is an Atlassian Solution Partner helping regulated and growing teams adopt Atlassian the right way: compliant, governed, and audit-ready.