Fili Atlassian Team

I am posting this update on a few threads to ensure customers that have expressed interest get to see it: Yesterday we announced that Atlassian is ready to sign BAA agreements for compliance with the HIPAA law provisions for the Enterprise Plan version of JSW and Confluence. More information…

HIPAA related update: Yesterday we announced that Atlassian is ready to sign BAA agreements for compliance with the HIPAA law provisions for the Enterprise Plan version of JSW and Confluence. More information here: https://www.atlassian.com/trust/compliance/resources/hipaa We will soon update our public roadmap to include…

Yesterday we announced that Atlassian is ready to sign BAA agreements for compliance with the HIPAA law provisions for the Enterprise Plan version of JSW and Confluence. More information here: https://www.atlassian.com/trust/compliance/resources/hipaa We will soon update our public roadmap to include a timeline for JSM…

Hello @Rob Yardman , * On Encryption in transit and at rest you can find more details here: https://www.atlassian.com/trust/security/security-practices#encryption-of-data * On Data Residency, what data set is kept in the US when…

Hi @Kyle Hughes , fair call - we should have changed that to "on the works" last update (we have a quarterly cadence). * We are on track to sign BAAs as part of our Cloud Enterprise Edition for JSW and Confluence in February. * We will publish a timeline for JSM imminently, I expect to have it in the public roadmap in the…

Hello @Daniel McVay , Per our public roadmap we are set to offer HIPAA compliance for JSW and Confluence in Q1-Q2 of 2022 calendar year, it is looking more like Q1 so we should have news on this for you soon! https://www.atlassian.com/roadmap/cloud?category=compliance&

Hello @DRFavreau , We currently don't have CJIS in our roadmap, I am not an expert in CJIS but my understanding is that there is no standardized assessment approach to determining whether a Cloud solution is considered CJIS compliant, we will be happy to provide you all information available to help make the determination…

happy to schedule a call @David Rodman , send me an email to fselvas at Atlassian dot com and we can find a time 

Thank you for the input @Carmen Nadeau , we will do all in our power to keep the timeline as it stands today 

Hello @Brooklyn Trumpy , not yet, it should be a couple more weeks. Meeting Monday and Tuesday to discuss this, will define that timeline for JSM as soon as possible! 

Hello @David Rodman , The process of migration is independent from the capability of keeping data resident in a specific region. You can definitely create a Cloud instance, set it up for data residency in a specific region, and then migrate your on premise data to it... or the other way around (the former is more advisable…

Hi Jason, we will NOT be ready to sign BAAs for JSM in February For February we are aiming to sign BAAs for JSW and Confluence only I do hope early next year we can publish a timeline for JSM though 

Thank you @Dylan sawchuk We will share a timeline as soon as possible! 

@GC , I apologize, I don't recall seeing any messages. Can you contact me at fselvas at Atlassian dot com? or give me here your email and I will reach out to you 

Apologies I missed the ping @Brooklyn Trumpy , and thank you for the prompt @Matthew King . Jira and Confluence - we are still on track to begin signing BAAs early 2022, don't take this as a commitment but likely February. JSM is still on the works, I can't offer you a solid timeline yet but I have been working on it with…

Thank you for your question, We are working with multiple agencies and an sponsor toward obtaining an ATO at the Moderate level for Jira & Confluence, that doesn't meet the requirements you are describing. We currently don't have plans in our roadmap for the type of offering required to satisfy what you enumerate. If you…

Thank you for the post @Brook , you are correct current plans only encompass Jira and Confluence and not JSM. I am working with the JSM team to agree on priority and roadmap. Question: in your JSM implementation, do you allow your end customers to create accounts directly in it? 

Hello @Roy Hernandez , I can connect with you for more details. please contact me at fselvas at Atlassian dot com 

Hello @Roy Hernandez , I can connect with you for more details. please contact me at fselvas at Atlassian dot com 

There are strong indications that PHI in email is simply to be avoided: https://www.securitymetrics.com/static/resources/orange/HIPAA_Compliant_Emails_White_Paper.pdfSUMMARY Do not send emails containing PHI outside of your network. Instead, use secure services like patient portals. However, if you need to send emails,…

Hi @Jigesh.Veetil , please see the comments on a similar response above and let me know what you think 

Agree with the point @Jamie Hess made above, we can likely configure things so that the notification will be bounced in that case, which would mean a lost communication. Would that be acceptable? 

Thank you @Wyatt Davis , We do have at rest and in transit encryption, not sure if this is what you meant: https://www.atlassian.com/trust/security/security-practices#encryption-of-data We don't offer today the signature functionality though 

@Phillip Hocking , we have HIPAA compliance in our roadmap for Jira and Confluence: https://www.atlassian.com/roadmap/cloud?category=compliance&selectedProduct=. WOuld you be willing to discuss details of your use case? I can schedule a call 

Hello Wyatt, There is work in progress to evaluate if a combination of Release Tracks capability, with 3rd party services (we are currently collaborating with SoftComply) could satisfy these regulations. There is no final determination yet, we can update you once we have made further progress cc: @Matt Tse 

Hello, if you are following this thread and are willing to have a call - email exchange I would appreciate if I can ask you about email notifications & PHI. How have you seen other Cloud Providers deal with this and which of those approaches work best for you. Please drop me a note at FSelvas at Astlassian dot Com Thank…

Hello @Volkan Kaya , When you asked " * What is the main reason why customers cannot put sensitive data on your cloud option? " Are you referring in specific to the limitations placed by our terms of services? If not I would appreciate if you can clarify 

You are correct @Mehran Moss , we have it tagged in our current roadmap as 2023: https://www.atlassian.com/roadmap/cloud?category=compliance& 

Thank you for the question. We are working towards readiness for FedRAMOP Moderate, which currently requires FIPS 140.2. When the regulation calls for 140.3 we will upgrade our Encryption accordingly 

Thank you for the post Thomas, as you have assumed this is not an easy y/n answer. For 'Who has access to our data?" we've outlined our approach in our Cloud Security Statement and our Privacy Policy." I hope this helps