Smartsheet High-Risk Data Deadlines: What You Need to Know

We’ve heard from you about the deadlines for high-risk data in Smartsheet, a collaboration platform used across Stanford for project management and workflows. This article clarifies what each deadline means and what actions you need to take. 

Two deadlines, two actions 

In November, we shared upcoming changes for Smartsheet. These changes align with Stanford Medicine’s policy for high-risk data, address data protection gaps, and prepare us for vendor-driven changes that will significantly increase license costs after October 2026. 

Action one: Stop adding new high-risk/PHI data 

Starting Nov. 15, 2025, we asked you to stop adding any new high-risk data or protected health information (PHI) to Smartsheet. This applies to all Smartsheet features including sheets, reports, dashboards, forms, and file storage. 

What this means: You can continue to use your existing processes, workflows, and sheets that contain high-risk/PHI data. However, do not create new processes, workflows, sheets or forms for use with high-risk/PHI data. 

This ensures current projects can continue uninterrupted while preventing new high-risk/PHI data workflows from being added to Smartsheet going forward. 

Action two: Migrate all existing high-risk/PHI data 

By Oct. 25, 2026, you need to move all existing high-risk/PHI data and processes out of Smartsheet and into approved alternative solutions. 

What this means: All high-risk/PHI data must be completely migrated out of Smartsheet by this date. University IT will no longer support Smartsheet for high-risk/PHI data after Oct. 25, 2026. 

What if I don’t work with high-risk data or PHI? 

You may continue using Smartsheet for low-risk and moderate-risk data and general project management both now and after these deadlines.

Need help? 

Review alternative platforms approved for high-risk data or contact the Information Security Office with questions about data classification or migration planning. We appreciate your attention to these important security deadlines.