HIPAA, ClickUp, Monday and Asana: The PHI-Safe Setup (Chart Numbers Only)

Search "HIPAA-compliant project management" and you get roundups ranking tools by whether they offer a Business Associate Agreement. Useful, but it answers the wrong question. The safest way to use any of these tools is to never put patient data in them in the first place. Do that, and the whole compliance question dissolves.

The question the roundups skip

A BAA is a legal agreement about how a vendor will handle your protected health information. It matters only if PHI is going to live in the vendor's tool. The roundups assume it will, and then rank tools by how well they protect it. But that assumption is a choice, not a requirement. If you decide that no PHI ever enters the project tool, there is no PHI for a BAA to cover, and the entire ranking becomes irrelevant. The question worth asking is not "which tool is compliant," it is "how do I run operations without putting patient data in a project tool at all." That reframing is the whole guide.

What each tool actually requires

For completeness, here is where a BAA sits on the major tools as of 2026, so you can see what the chart-numbers-only method lets you skip.

The pattern is the same everywhere: a BAA is a top-tier feature, and you only need it if you put PHI in the tool. Keep PHI out and any tier is safe on this axis, which is what makes the method both safer and dramatically cheaper.

The chart-numbers-only method

The method is one rule with a clean split behind it. The project tool holds workflow. The EHR holds patients. In the tool, a task is identified by a chart number, a status, an owner, and a date, never by a name, a date of birth, a diagnosis, or any identifier that ties the record to a person. The chart number is a pointer: when a staff member needs the patient, they open that chart in the EHR, where the PHI properly lives and is properly protected. The tool answers "what needs doing and by whom." The EHR answers "who is this and what is their information." Because the two never mix, the project tool contains only operational data, which is not PHI, and the compliance surface shrinks to nothing. Any demonstration or template uses sample data for the same reason. This is exactly the boundary the systems in the Zero-Slip build and every tracker are designed around.

Setting it up, and the mistakes to avoid

Putting the method in place is mostly discipline, plus a few guardrails. Set the convention explicitly: every task references a chart number, full stop, and staff are trained that names and diagnoses never go in a title, description, comment, or attachment. Watch the fields that leak. The common PHI mistakes in project tools are not the obvious ones; they hide in a task title with a patient's name, a comment adding "the diabetic patient," an uploaded document with a face sheet, or a custom field for date of birth. Each of those quietly turns an operational tool into one holding PHI. Name a reviewer who spot-checks that the convention is holding, especially in the first weeks and after onboarding a new hire, since new staff are the most likely to paste in a name out of habit. Bake the rule into onboarding from day one, as in the onboarding checklist, and it becomes second nature rather than a policy people forget.

Why this is safer, not just cheaper

The cost savings are real, standard tiers instead of Enterprise, but the security argument is the stronger one. When you put PHI in a tool and protect it with settings and a BAA, you are managing a risk: a misconfiguration, an over-shared board, a departing employee with access, any of them can expose data that is genuinely there. When you keep PHI out entirely, there is no risk to manage, because the data that was never in the tool cannot leak from it. A BAA is a promise about how a breach will be handled; the chart-numbers-only method is a design where the breach has nothing to take. That is a categorically stronger position, and it is available to any practice willing to hold one simple line. It is the same principle behind running operations remotely without ever touching patient data, described in how I run US operations from 8,000 miles away. To put it into practice, see the ClickUp setup and Monday setup guides.

Where to go next

• The Zero-Slip Prior Auth System: Exactly What $1,250 Buys (Full Scope) live

  The full scope of the Zero-Slip Prior Auth System: a 14-day build in your own tools, the.

• New-Hire Onboarding Checklist for Medical Practices (MA and Front Desk, Week One) live

  A free week-one onboarding checklist for medical practice new hires: a day-by-day plan for MA.

• How I Run US Practice Operations From 8,000 Miles Away live

  How a remote consultant runs US practice operations from overseas: owned systems not presence,.

• ClickUp vs Monday vs Asana for a medical practice live

  An honest 2026 comparison of ClickUp, Monday, and Asana for a medical practice: pricing, ease.

Frequently asked questions