Is Smartsheet HIPAA compliant?
BAA on select plansPHI with conditionsSOC 2 Type II
Will Smartsheet sign a HIPAA BAA?
Sometimes — Smartsheet signs a HIPAA BAA only on specific plans or add-ons.
Smartsheet signs a BAA (via account manager) only for Enterprise plan customers, and PHI may be uploaded only into 'PHI Eligible Services'; Add-Ons and third-party storage are excluded.
PHI eligibility
PHI is permitted only with a signed BAA on an Enterprise (non-legacy) plan and only within PHI Eligible Services.
SOC 2
SOC 2 Type II
Trust center
Sub-processors
—
Notes
No HIPAA-specific product; security measures audited annually to SOC 2 standards. Brandfolder and Add-Ons are excluded from HIPAA coverage.
Get notified when this changes
We track Smartsheet's BAA and HIPAA status. Leave your email and we'll send one note if the verdict on this page changes.
How to request and sign a BAA with Smartsheet
Sometimes — Smartsheet signs a HIPAA BAA only on specific plans or add-ons.
Request routeThrough sales / your account team
- 1Get on a qualifying planSmartsheet signs a BAA (via account manager) only for Enterprise plan customers, and PHI may be uploaded only into 'PHI Eligible Services'; Add-Ons and third-party storage are excluded.
- 2Request the Business Associate AgreementSmartsheet arranges the BAA through its sales / account team. If you have an account executive, ask them to start the BAA for your plan; otherwise contact Smartsheet sales (or open a request from its trust center) and reference the qualifying plan above.
- 3Confirm what PHI is allowed before you store anyPHI is permitted only with a signed BAA on an Enterprise (non-legacy) plan and only within PHI Eligible Services. Match your configuration to this scope before putting protected health information into Smartsheet.
Last verified 2026-05-31 · Plan tiers and BAA terms change often — confirm the current process directly with Smartsheet before you rely on it. This is cited public information, not legal advice.
Frequently asked questions
Does Smartsheet sign a HIPAA Business Associate Agreement (BAA)?
Sometimes — Smartsheet signs a HIPAA BAA only on specific plans or add-ons. Smartsheet signs a BAA (via account manager) only for Enterprise plan customers, and PHI may be uploaded only into 'PHI Eligible Services'; Add-Ons and third-party storage are excluded.
Is Smartsheet HIPAA compliant?
Smartsheet can be HIPAA-compliant only on the specific plans or add-ons where it will sign a Business Associate Agreement (BAA). PHI is permitted only with a signed BAA on an Enterprise (non-legacy) plan and only within PHI Eligible Services.
Can you store PHI (protected health information) in Smartsheet?
PHI is permitted only with a signed BAA on an Enterprise (non-legacy) plan and only within PHI Eligible Services.
Is Smartsheet SOC 2 certified?
Smartsheet reports a SOC 2 Type II attestation according to its public security documentation.
How do I request a HIPAA BAA from Smartsheet?
Smartsheet arranges the BAA through its sales / account team. If you have an account executive, ask them to start the BAA for your plan; otherwise contact Smartsheet sales (or open a request from its trust center) and reference the qualifying plan above. Confirm current terms directly with Smartsheet before storing PHI.
What plan do I need to sign a BAA with Smartsheet?
Smartsheet signs a BAA (via account manager) only for Enterprise plan customers, and PHI may be uploaded only into 'PHI Eligible Services'; Add-Ons and third-party storage are excluded.
Sources
https://www.smartsheet.com/legal/hipaa-baa
https://www.smartsheet.com/legal/hipaa-implementation-guide
This page is cited public information, not legal or compliance advice. A BAA's availability can depend on your specific plan, region, and contract. Always confirm current terms with Smartsheet before processing protected health information.
Check another vendor
See all HIPAA compliant project management software →
Browse all 105 vendors by category →