Yes (as of 2026-10-28). A BAA is available on all plans (Free, Premium, Team, Business, Enterprise) through Fathom's blanket BAA. The main exclusion is that third-party and AI assistant integrations are not addressed by the BAA page. A countersigned BAA is listed only on Enterprise. This is a statement about Fathom's published BAA terms, not a certification. See all checked tools in Is it HIPAA compliant? All vendors.
Short answer
Fathom's standard terms incorporate a blanket BAA that binds any customer who enters the Service Agreement as a Covered Entity, including customers on the Free plan. An individually signed BAA is an Enterprise feature and is requested at [email protected].
The covered service is the Fathom AI notetaker: recordings, transcripts and AI summaries. Whether Fathom is appropriate for your clinic still depends on your configuration, your integrations and your internal policies.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | Blanket BAA | Incorporated by reference into the Terms and Conditions | Not published by the vendor (the plan itself starts at $0) |
| Premium | Blanket BAA | Incorporated by reference into the Terms and Conditions | Not published by the vendor |
| Team | Blanket BAA | Incorporated by reference into the Terms and Conditions | Not published by the vendor |
| Business | Blanket BAA | Incorporated by reference into the Terms and Conditions | Not published by the vendor |
| Enterprise | Blanket BAA and countersigned BAA on request | Terms and Conditions; countersigned BAA requested at [email protected] | Custom pricing through sales |
No plan is excluded from the blanket BAA. A countersigned BAA is not listed on any plan below Enterprise.
What the BAA covers and what it excludes
Covered
- The Fathom AI notetaker: recordings, transcripts and AI summaries, which are the Services under the Service Agreement.
Excluded or not addressed
- An individually signed BAA is available only on Enterprise.
- Third-party integrations and AI assistant integrations (Claude, ChatGPT, Zapier, CRM syncs) are not addressed by the BAA page.
If a front-desk team pushes meeting summaries into a CRM or an automation tool, that data leaves Fathom. Each integration that touches PHI needs its own vendor review. For one common example, see Is Zapier HIPAA compliant?.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published" means the vendor's checked pages do not state it. It does not mean the control is absent. This page does not infer controls from the BAA.
How to use Fathom with PHI
The terms below are defined in the HIPAA glossary.
- Accept or request the BAA before anyone records a meeting that includes PHI. For the blanket BAA, confirm that your organization is entering the Service Agreement as a Covered Entity.
- Decide whether the blanket BAA is enough for your risk assessment or whether you need a countersigned BAA. The latter requires Enterprise.
- Keep integrations and AI assistant connections switched off unless each one has its own BAA. A practice that connects a CRM or an AI chat tool to meeting summaries has created a separate PHI flow.
- Control who can record, view and share. Limit recording to the staff and meeting types that need it, such as care-coordination huddles rather than every call.
- Set a staff policy on patient consent and meeting use, including when recording is allowed and who may share a transcript.
- Ask Fathom for the security documentation it does not publish (encryption, audit logging, third-party reports) and file the answers in your vendor inventory.
- Review the setup when you change plans or add integrations.
Compliance depends on the signed BAA, your configuration and your policies. Using Fathom does not make an organization HIPAA compliant by itself.
Alternatives with a BAA
Other AI notetakers list BAA terms at different plan levels. This list is factual and not a ranking.
- Fireflies.ai: conditional, BAA from Enterprise
- Granola: conditional, Enterprise
- Otter.ai: conditional, Enterprise
- Plaud: conditional, Starter
- Read AI: conditional, Enterprise+ annual
Compare more options in HIPAA-compliant AI transcription tools.
Sources
- Is Fathom HIPAA-compliant? | Fathom Help Center — Help article, checked 2026-10-28. "We are fully HIPAA compliant and recently launched a blanket BAA here (and linked it in our Terms and Conditions). If you'd prefer a signed BAA between you and Fathom, please reach out at [email protected]."
- Fathom Business Associate Agreement (BAA) — BAA page, checked 2026-10-28. "By entering into the Service Agreement as a Covered Entity, Covered Entity agrees to the terms of this Agreement."
- Fathom Pricing 2026: Free Plan or Plans from $15/mo — Pricing page, checked 2026-10-28. "Single sign-on integration / Okta SCIM provisioning / Organization wide security controls / Increased cyber security insurance coverage / Custom contracts & red-line support / Dedicated Customer Success & channel / HIPAA: signed BAA"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Is Fathom's Free plan covered by a BAA?
According to Fathom's BAA page, the blanket BAA in its standard terms applies to any customer entering the Service Agreement as a Covered Entity, and the Free plan is not excluded. Whether it is suitable for PHI depends on your own review, including the integrations and controls Fathom does not publish.
Do I need a countersigned BAA, or is the blanket BAA enough?
That is your privacy officer's call. The blanket BAA is incorporated into the Terms and Conditions with no signature step. A countersigned BAA is listed only on Enterprise and is requested at [email protected]. If your policy or a payer contract requires a signed copy on file, you need Enterprise.
Are Fathom's integrations with Claude, ChatGPT, Zapier or CRMs covered by the BAA?
Not according to the BAA page, which does not address them. Treat each integration as a separate vendor: get its BAA, or keep it disconnected from PHI.
Does Fathom publish SOC 2, HITRUST or ISO 27001 reports?
No. The pages checked on 2026-10-28 do not state any of them. Ask Fathom directly for current documentation, and note that its absence from public pages is not proof that no report exists.