Medical practices need to separate two things that general software advice conflates, and getting this wrong is a compliance problem rather than an inconvenience.
Clinical systems hold patient records, appointments, prescriptions and clinical notes. These are regulated, and you use a purpose-built practice management or EHR system for them.
Operational projects are everything else — an accreditation submission, a new site fit-out, recruitment, a policy review cycle, an equipment procurement. This is ordinary project work, and general project management software handles it.
The rule that follows is simple and important: patient-identifiable information does not go in your project management tool. Not in a task title, not in a comment, not in an attachment.
Why This Matters More Than Feature Comparison
Health information is among the most heavily protected categories of data anywhere.
United States. Protected health information falls under HIPAA. Any vendor processing PHI on your behalf is a business associate and requires a signed Business Associate Agreement. General project tools like Asana, Trello and monday.com do not typically offer BAAs on standard plans. Using them for PHI is a breach exposure, not a grey area.
UK and EU. Health data is special-category data under UK GDPR and GDPR, requiring both a lawful basis and a separate condition for processing, plus appropriate safeguards. UK practices also operate under NHS information governance requirements and the Data Security and Protection Toolkit.
Everywhere. Breach notification obligations apply, and health data breaches attract the highest penalties and the most reputational damage.
The practical consequence: your project tool is for operational work, and it should be configured so that patient data cannot casually end up there. Take advice specific to your jurisdiction and regulator.
Clinical Systems (For Completeness)
These are not project management tools and you will already have one, but the distinction matters:
- UK: EMIS Web, SystmOne, Vision for general practice
- US: Epic, Cerner, athenahealth, eClinicalWorks, DrChrono
- Allied health: Cliniko, Jane, WriteUpp — practice management for physiotherapy, therapy and similar
- Dental: Dentally, Software of Excellence, Dentrix
Patient scheduling, records and clinical workflow live here. Everything below is for the other work.
Project Tools for Practice Operations
Asana
Well suited to recurring compliance work. One task, one owner, one due date, with recurring tasks for periodic reviews and dependencies for sequenced work like an accreditation submission.
Suits: practices with regular audit and policy review cycles.
Trello
Simple, free tier, and adequate for a small practice tracking a handful of operational projects. Low training burden matters when the people using it are clinicians and administrators, not project managers.
monday.com
Typed columns suit tracking things with attributes — equipment servicing schedules, staff training and certification expiry, policy review dates.
Suits: practices tracking compliance registers as well as projects.
ClickUp
More features per pound, with the caveat that it needs configuring down before non-technical staff will use it.
Microsoft Planner and Microsoft 365
Worth naming specifically. Many practices already run Microsoft 365, and Planner is included. For UK NHS organisations, Microsoft 365 is widely used within existing information governance arrangements.
Microsoft will sign a BAA for HIPAA-covered US customers on appropriate plans, which distinguishes it from most general project tools.
Suits: practices already on Microsoft 365 — start here before buying anything.
Smartsheet
Spreadsheet-like, with compliance certifications and BAA availability on some plans. Used in healthcare operations for this reason.
How They Compare
| Tool | Recurring tasks | Registers / trackers | BAA availability | Best for |
|---|---|---|---|---|
| Asana | Strong | Limited | Not standard | Compliance cycles |
| Trello | Via automation | Basic | Not standard | Small practices |
| monday.com | Yes | Strong | Not standard | Registers and projects |
| ClickUp | Strong | Good | Not standard | Value, needs configuring |
| Microsoft Planner | Good | Via Lists | Yes, appropriate plans | Existing Microsoft 365 |
| Smartsheet | Yes | Strong | Some plans | Healthcare operations |
BAA availability and compliance certifications change. Verify directly with the vendor for your specific plan rather than relying on any article — and if a vendor will not sign a BAA, do not put PHI in it regardless of features.
What Practices Actually Use These For
Concrete, because generic project management advice does not translate.
Accreditation and inspection preparation. CQC in England, Joint Commission or state requirements in the US, RACGP in Australia. These are genuine projects with evidence requirements, owners and deadlines.
Policy review cycles. Policies need periodic review with a documented date and reviewer. A recurring task with an owner is exactly right.
Staff training and certification tracking. Mandatory training, professional registration renewal, DBS or background check expiry, immunisation status. A register with expiry dates and alerts — and note this is HR data, not patient data, so a general tool is appropriate with proper access controls.
Equipment servicing and calibration. Scheduled maintenance with evidence retained.
Significant event and incident follow-up. Here you must be careful — record the action and owner, not the patient. “Review consent process for procedure X” is fine; anything identifying a patient is not.
Recruitment and onboarding. Checklists covering references, registration checks, IT access and induction.
Common Mistakes to Avoid
- Putting patient information in a project tool. Not in task titles, comments or attachments. This is the rule that matters most.
- Assuming a general tool is HIPAA-compliant. Most will not sign a BAA on standard plans. Verify before, not after.
- Using a project tool for patient scheduling. That is your clinical system’s job.
- Not checking what Microsoft 365 already includes. Planner is bundled and Microsoft will sign a BAA on appropriate plans.
- No access controls. Not every staff member needs visibility of HR or incident-related tasks.
- Describing incidents identifiably. Record the action, not the patient.
- No retention policy. Operational records have retention requirements too.
- Rolling out without training clinical staff. If they will not use it, your compliance register is fiction.
FAQs
Can I use Asana or Trello in a medical practice?
For operational projects, yes — accreditation, policy reviews, equipment, recruitment. Not for anything patient-identifiable, because these vendors do not typically offer a Business Associate Agreement on standard plans.
What is a Business Associate Agreement?
Under HIPAA, a required contract with any vendor processing protected health information on your behalf. Without one, using that vendor for PHI is a compliance breach. Ask before signing up, not after.
Is Microsoft 365 suitable?
Microsoft will sign a BAA for HIPAA-covered customers on appropriate plans, which distinguishes it from most general project tools. Many practices already have it, and Planner is included. Confirm your specific plan.
Do I need separate clinical and project systems?
Yes. Clinical systems are regulated and built for patient records. Project tools handle operational work. Trying to use one for the other creates either compliance exposure or an unusable clinical workflow.
How do I track staff training compliance?
A register with expiry dates and automated alerts — monday.com, Smartsheet or Microsoft Lists all work. This is HR data rather than patient data, so a general tool is appropriate with proper access controls.
Can I record incident follow-up actions?
Record the action and owner, not patient-identifiable details. “Review consent process” is appropriate; anything identifying an individual belongs in your clinical or incident system.
Key Takeaways
- Clinical systems and project tools are separate. Never mix them.
- Patient-identifiable information does not belong in a project tool — including task titles.
- Most general tools will not sign a BAA. Verify before using them for anything sensitive.
- Check Microsoft 365 first; Planner is included and Microsoft will sign a BAA on appropriate plans.
- Use these for accreditation, policy cycles, training registers and equipment — the work that is genuinely projects.
Where to Start
List your operational projects and recurring compliance obligations, then check whether Microsoft 365 is already available to you. Set one rule before anyone starts: no patient information in the tool, ever.
For related decisions, see our guides to project management software, scheduling software and form builders, which covers HIPAA-eligible options for intake.