Conditional. Fireflies.ai offers a BAA on its Enterprise plan only, on request, and only for workspaces with Private Storage enabled. The Free, Pro and Business plans have no BAA and should not be used with PHI.
Is Fireflies.ai HIPAA compliant? Verdict: conditional
Conditional Last verified 2026-10-20.
A BAA is available on the Enterprise plan only, on request. The main exclusion is any workspace without Private Storage. This page reports the vendor's published terms. It is not an audit of Fireflies.ai and not legal advice.
Short answer
A BAA is available on Enterprise for Fireflies meeting recording, transcription and notes in a workspace with Private Storage. Free, Pro and Business are excluded.
The setup is fragile. Fireflies' help article states that a plan downgrade or storage change immediately disables HIPAA compliance. Picture a billing change that moves your clinic's workspace off Enterprise, or an admin who switches storage. Every recording made afterward sits outside the BAA.
See All vendor HIPAA checks for other tools.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | Not available | Not published by the vendor | Not published by the vendor |
| Pro | Not available | Not published by the vendor | Not published by the vendor |
| Business | Not available | Not published by the vendor | Not published by the vendor |
| Enterprise | Available on request | Sign on the BAA contract page in workspace settings and enable Private Storage | Enterprise: $39 per seat/month, billed annually; Private Storage add-on |
Enterprise requires Private Storage, which is an Enterprise add-on. The $39 per seat/month, billed annually, comes from the vendor's Enterprise help article. The vendor does not publish a minimum seat count.
What the BAA covers and what it excludes
Covered
- Fireflies meeting recording, transcription and notes, in an Enterprise workspace with Private Storage.
Excluded
- Any workspace without Private Storage.
The sources checked list no other covered or excluded features. Do not assume the BAA extends to anything beyond the items above, such as third-party integrations, without written confirmation from Fireflies.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Private Storage lets organizations choose where recordings and transcripts are stored |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" means the pages checked did not state it. It does not mean the control is absent.
How to use Fireflies.ai with PHI
- Confirm the plan. Only Enterprise is eligible. Do not pilot on Free, Pro or Business with real patient discussions.
- Sign the BAA before any PHI is recorded. Use the BAA contract page in workspace settings. A verbal assurance from a sales rep is not a BAA.
- Enable Private Storage and keep it on. The BAA depends on it.
- Block downgrades and storage changes. Limit billing and workspace admin rights to a named owner, and require privacy-officer sign-off before any plan or storage change.
- Restrict who can record meetings. A care coordinator running case-review huddles needs the tool. A front-desk employee joining a vendor call probably does not.
- Set a staff policy on what may be recorded. Define which meetings (for example, care-team rounds versus personal calls) may be captured and who reviews transcripts.
- Check connected apps separately. Anything that receives transcripts needs its own coverage.
Compliance depends on the signed BAA, your configuration and your policies, not on the tool alone. Terms such as BAA and PHI are defined in the HIPAA glossary (BAA, PHI).
Alternatives with a BAA
These are different product types, not like-for-like meeting transcription tools. Statuses are as recorded in this directory.
- Amazon Bedrock: yes, all AWS accounts. See Amazon Bedrock HIPAA status.
- Microsoft Azure: conditional.
- OpenAI ChatGPT and API: conditional (ChatGPT for Healthcare).
- Anthropic Claude: conditional (Claude Enterprise). See Anthropic Claude HIPAA status.
- Doximity GPT: yes (Member, free).
Another AI recorder to compare: Is Otter AI HIPAA compliant?. For more options by tool type, browse HIPAA-compliant software by category, including its AI transcription and AI tools entries.
Sources
- Set up HIPAA compliance for your workspace — Help article, checked 2026-10-20. "HIPAA compliance is only available on Enterprise plans."
- Set up HIPAA compliance for your workspace — Help article, checked 2026-10-20. "Plan downgrades or storage changes will immediately disable HIPAA compliance."
- Learn about the Fireflies Enterprise plan — Help article, checked 2026-10-20. "Available upon request for organizations that require healthcare data compliance. Activation requires a signed Business Associate Agreement (BAA)."
- Learn about the Fireflies Enterprise plan — Pricing page, checked 2026-10-20. "The cost is $39 per seat/month, billed annually."
- Fireflies Pricing — Pricing page, checked 2026-10-20. "SOC 2 Type II compliance"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does Fireflies.ai sign a BAA?
Yes, on the Enterprise plan, on request. You sign on the BAA contract page in workspace settings and enable Private Storage.
Is the Fireflies.ai Free, Pro or Business plan safe for PHI?
No. No BAA is available on these plans, so they should not be used with PHI.
What happens to HIPAA compliance if we downgrade or change storage?
According to the vendor's help article, a plan downgrade or storage change immediately disables HIPAA compliance. Treat any such change as a stop-recording event until the Enterprise plan and Private Storage are restored.
How much does Fireflies.ai Enterprise cost?
$39 per seat/month, billed annually, per the vendor's Enterprise help article. Any separate Private Storage fee is. The vendor does not publish a minimum seat count.