Miro is an AI-powered visual collaboration platform that allows teams to brainstorm, plan projects, map processes, create diagrams, and work together on a shared digital canvas.

With Miro, organizations can create and share boards, organize workflows, and collaborate in real time or asynchronously.

Is Miro HIPAA compliant? Yes, Miro can be HIPAA compliant, but only for qualifying Enterprise customers that sign a business associate agreement (BAA) and obtain contractual terms permitting the use of protected health information (PHI).

 

What changed this year?

As of August 2026, we reviewed an update from Miro, namely an official Miro guide last updated November 27, 2025, which now states that the Enterprise plan offers additional compliance features and BAAs for organizations that require HIPAA compliance.

However, Miro’s standard Master Cloud Agreement, published February 1, 2024, still prohibits PHI and states that Miro is not a business associate under HIPAA. Healthcare organizations must therefore obtain an executed BAA and written terms that override this standard restriction before entering PHI into Miro.

 

Will Miro sign a BAA?

Yes, Miro says it offers BAA to qualifying customers on its Enterprise plan, as described in its official product guide.

Miro does not publish a copy of its BAA for public review. Healthcare organizations should request the agreement from Miro and verify that it applies to their account, intended services, and planned uses of PHI before using the platform with regulated data.

 

What does the Miro BAA cover?

Miro does not publicly disclose the detailed scope of its BAA. Its official guide states, “Miro’s Enterprise plan offers additional compliance features and Business Associate Agreements (BAAs).”

Healthcare organizations should confirm that their executed BAA covers:

  • The specific Miro services and features that will create, receive, maintain, or transmit PHI
  • Safeguards for PHI
  • Security incident and breach reporting
  • Miro subcontractors that may handle PHI
  • Access, amendment, and accounting obligations when applicable
  • The return or deletion of PHI when the relationship ends

These items are points to verify in the agreement, not confirmed descriptions of Miro’s unpublished BAA.

 

What does the Miro BAA exclude?

Miro does not publicly identify the exclusions in its BAA. Its standard Master Cloud Agreement states, “Miro is not a Business Associate as defined under HIPAA,” and defines HIPAA-regulated patient, medical, and protected health information as prohibited data.

Miro’s Marketplace Terms of Use also state that the Miro Marketplace and Miro Apps are not intended to meet HIPAA requirements. The Master Cloud Agreement says third-party platforms are not subject to that agreement. Healthcare organizations should therefore not assume that Miro AI, Marketplace apps, integrations, beta features, or other connected services are covered unless the signed BAA expressly includes them.

 

Conclusion

Miro may be HIPAA compliant for qualifying Enterprise customers that sign a BAA and receive written authorization to use covered Miro services with PHI. A standard Miro account, including an Enterprise account without those additional contractual terms, should not be used to create, receive, maintain, or transmit PHI.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a BAA?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information, known as PHI.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.