Official stance on MCP and HIPAA accounts

[Michael Hamilton]

This solution was pitched since we are blocked from running Rovo as it's not been blessed for use on Enterprise HIPAA products.  Curious if hosting onsite through MCP is allowed.

[Ajay _view26_]

Hi @Michael Hamilton 

Welcome to the community!

Based on the current Atlassian docs, I would be very cautious about treating MCP as a HIPAA-safe workaround.

Two important points from the official documentation:
- Atlassian explicitly says Rovo is not HIPAA compliant and the BAA does not cover it
- the Atlassian Rovo MCP Server is a cloud-hosted service, not something you self-host inside your own environment

Rovo data, privacy, and usage guidelines

If you need an official answer for compliance review, I would push for a written response from Atlassian Security / Support rather than relying on Community interpretation.

[Michael Hamilton]

      Thanks for sharing, Atlassian needs to provide a solution for HIPAA and GOVT segments or face the music of loosing us as customers.  Can not pitch AI solutions and toolings as the future, yet alienate your clientele.  

      We've had a couple of calls with Compliance and Support that all lead to the same type of answer...  Uncertainty.  Our team actually has their own AWS hosted LLM module that only our systems connect to.  In theory we should be able to connect our LLM to our Atlassian services. 

    The suggestion from support was to check out this MCP connection.