Woman Cloud Migrate HIPAA

Atlassian Rolls Out HIPAA Support for Cloud Standard and Premium Tiers

August 31, 2023
Christian Lipski, Senior Technical Architect

Support for the Health Insurance Portability and Accountability Act (HIPAA) was rolled out to Jira and Confluence Cloud in Q1 of 2022, but was only available to organizations on the Enterprise cloud tier. This meant that small-to-medium-sized businesses with fewer than 1,000 users (the minimum for Enterprise) were effectively barred from migrating to Atlassian Cloud if they were required to adhere to HIPAA standards. That barrier is going to start coming down in September as Atlassian expands HIPAA support to the Premium and Standard cloud tiers!

Atlassian Roll Out Plan

Atlassian is on track to begin releasing HIPAA for Cloud Standard and Premium by the end of Q3 2023. They are careful to stress that this will be a "throttled" release, to give them time to detect any issues that were not identified during their testing. As a result, not all cloud customers will see this capability immediately. Nevertheless, with HIPAA support rolling out, now is the time to begin planning a move to the cloud, especially with the Server offering reaching End Of Life in February 2024.

Requirements for HIPAA

To assist with the adoption of HIPAA standards, Atlassian has provided an implementation guide detailing the process. The guide identifies three important steps to implement HIPAA:

1. Enter into a Business Associate Agreement (BAA) with Atlassian

This step involves legal paperwork, so it is best to begin that as soon as you are able by contacting Atlassian about Product Features.

2. Refrain from entering Protected Health Information (PHI) into fields that cannot be secured

Certain fields in Jira and Confluence are not secured by permissions, and so might be seen by those without the proper permissions. These fields include:

  • Confluence Space keys, Space names, and page titles
  • Jira issues, project names, project keys, and workflow scheme names
  • Surveys
  • Customer feedback

This step is the responsibility of the organization, and so must be incorporated into the global business process.

3. Turn off email and push notifications

Jira issues and Confluence pages may contain PHI, but as long as access is controlled properly, HIPAA rules are not violated. However, both applications have the ability to send notifications with information from those items, and that information may contain PHI. As a result, notifications must be disabled.

Following these steps will allow customers to meet the minimum requirements for HIPAA compliance.

Conclusion

HIPAA support for the Standard and Premium cloud tiers of Jira and Confluence is something that has been anticipated since the feature first rolled out for Enterprise in 2022. Now all paid tiers of the Cloud offerings allow companies to provide HIPAA compliance to their users in the convenience and efficiency of the Atlassian Cloud.

Once this feature is globally available, there is certain to be a sharp increase in the number of cloud migrations, so the sooner the process is begun the better. That advice is even more important for Server-based customers who need HIPAA, since February 2024 marks the end of support for all products on the Server platform. 

Reach out to discuss how Praecipio can help your organization move to the Cloud and ensure HIPAA compliance within your Atlassian tools.

Set Your Migration Up for Success

Learn About Cloud Migration with Praecipio

Get Started
Team Data
Share this resource
If you found this helpful, share it with your network