Which AI notetakers are HIPAA compliant, and on which plan

Search “is [notetaker] HIPAA compliant” for any of the big four and the vendor’s own answer is yes. Read one more sentence and the answer is yes, on the Enterprise plan. This post is that second sentence for each vendor, quoted from their own pages, plus what it means if you are on the plan below.

Background first, briefly: there is no HIPAA certification, SOC 2 is not HIPAA, and the artefact that matters is a signed Business Associate Agreement covering the plan you are on. We wrote that up properly in HIPAA and AI note takers: what compliance actually requires. Everything below assumes it.

The table

Vendor	Will sign a BAA?	On which plan	What the vendor says
Otter	Yes	Enterprise only	”HIPAA compliance is only available for the Enterprise plan.” BAA via your account manager or sales.
Fireflies	Yes	Enterprise ($39/seat/mo billed annually, per its pricing page on 5 September 2026)	“The Fireflies HIPAA Compliant version is available on request.” Private storage and custom retention live on the same tier.
Fathom	Yes	Enterprise	Pricing page lists “HIPAA: signed BAA” as an Enterprise feature. Free, Premium, Team and Business do not include it.
Granola	Yes	Enterprise ($35/user/mo)	“Granola is HIPAA compliant for Enterprise customers.” “HIPAA support and BAAs are not available on Free, Personal, or Business plans.” Contact sales to enable it.

Four vendors, one pattern. The compliance does not travel with the software. It travels with the contract, and the contract is sold on the top tier.

What each vendor says, in its own words

Otter. Otter’s help centre states that it “is not a HIPAA-covered entity by default” and “becomes a Business Associate only when a signed BAA is in place”, that HIPAA compliance “is only available for the Enterprise plan”, and that customers must assess whether their use involves PHI and execute the BAA “before any such data is handled”. That last clause is the correct legal position and worth quoting back to anyone on a Pro plan using Otter with patients. Otter’s broader security posture, and the wiretap litigation it is defending, are in is Otter.ai safe?.

Fireflies. Fireflies publishes the tier restriction openly: HIPAA compliance, the signed BAA, private storage and custom data retention are Enterprise features, and its HIPAA page says the compliant version is “available on request”. It also states it has signed BAAs with its own speech and language-model vendors and enforces zero-day retention with them, which is the right shape of answer to the subprocessor question. Details in is Fireflies.ai safe?.

Fathom. Fathom’s pricing page is the source: “HIPAA: signed BAA” appears under Enterprise and nowhere else. The free plan is genuinely generous for individuals, with unlimited recordings and transcription, which is exactly why it is not the plan for PHI: the recordings live on Fathom’s servers and no BAA covers them.

Granola. Granola’s help centre is the most explicit of the four: “Granola is HIPAA compliant for Enterprise customers” and “HIPAA support and BAAs are not available on Free, Personal, or Business plans”. The pricing page lists Basic at $0, Business at $14 per user per month and Enterprise at $35, and HIPAA has to be enabled by contacting sales. Granola’s bot-free capture and its no-audio-stored policy are real advantages; they are not a BAA, and the audio still passes through Deepgram, AssemblyAI, OpenAI and Anthropic. See is Granola AI safe? for the sourced version.

What the plan below Enterprise actually gets you

The same encryption, the same SOC 2 report, the same privacy policy, and no contract.

For a solo practitioner that is the trap. The tool is marketed as HIPAA compliant, is genuinely HIPAA-capable on a tier you are not on, and every session you run through it on a Pro or Business plan is a disclosure of PHI to a vendor with no BAA. Under HIPAA that gap is the covered entity’s, meaning yours, not the vendor’s.

Two questions to ask in writing before entering any PHI, whichever vendor:

1. Will you sign a BAA for the plan I am on?
2. Which subprocessors receive PHI, and do you have BAAs with them?

If the answer to the first is “upgrade to Enterprise”, that is a clear answer, and you can decide whether the price is worth it.

The tools built for clinicians

If you need clinical documentation, a general meeting notetaker is the wrong product even on Enterprise. Upheal, Mentalyc, SimplePractice, AutoNotes and similar tools sign a BAA as a matter of course, produce SOAP and DAP notes, and integrate with practice management systems. They are what the “HIPAA compliant AI note taker” search is usually looking for, and the HIPAA post says so at more length.

Where a local tool sits

A tool that runs entirely on your own computer never creates, receives, maintains or transmits PHI on your behalf, so under the definition it is not a business associate and there is no BAA to sign, because there is no relationship for one to govern.

That is an argument about the definition, not a compliance claim. Private Notetaker records, transcribes and summarises on your own machine with no upload, which removes the vendor from the PHI path. It does not make you compliant. The Security Rule obligations move to you: disk encryption, access controls, encrypted backups, a device-loss procedure and your own retention policy. Some practitioners would rather carry that on a machine they control than manage a vendor and its subprocessors; others would not. Both are defensible, and the HIPAA post lays out the checklist.

It is also English only, with no EHR integration and no clinical note formats. If you need those, buy the clinical tool and get the BAA.

Vendor statements are quoted from Otter’s HIPAA help article, Fireflies’ HIPAA and pricing pages, Fathom’s pricing page and Granola’s help centre and pricing page, checked 16 September 2026 except where a date is given. Not legal advice. Plans and coverage change; confirm the BAA and the plan in writing before entering any PHI.