Six AI note takers are compared below on one question: will the vendor sign a business associate agreement (BAA), on which plan, and how do you get it? Only Fathom signs on every plan, including Free. The other five sign only on specific plans or on request.
This directory is published by Chanty, Inc., which lists its own product as one vendor among others. Chanty is team chat, not a transcription tool, and does not appear in this table. No placement depends on payment or on Chanty's interest. The directory reports each vendor's published terms and does not audit vendors.
Summary: six vendors, who signs a BAA and where
Of six vendors checked, one has a BAA on every plan including Free (Fathom: yes). Five are conditional, signing only on specific plans or on request: Plaud, Read AI, Granola, Fireflies.ai and Otter.ai. None is rated no, and none publishes nothing.
For Plaud and Fathom, the route to a BAA involves emailing the vendor or a countersigned request, so the plan alone does not settle it. For the wider picture across tool types, see HIPAA-compliant software by category.
Quick answer: which AI note takers and transcription tools sign a BAA, and from which plan
- Fathom: yes. BAA available on the Free plan, under a blanket BAA in the vendor's Terms.
- Plaud: conditional. BAA available from the Starter plan, by request.
- Read AI: conditional. BAA available on Enterprise+, annual billing.
- Granola: conditional. BAA available on Enterprise.
- Fireflies.ai: conditional. BAA available on Enterprise.
- Otter.ai: conditional. BAA available on Enterprise.
The order above is fixed and does not rank quality.
Comparison table
| Vendor | Verdict | BAA from plan | How to obtain | Pricing from | Encryption at rest | Audit log | SSO | SOC 2 | Last verified |
|---|---|---|---|---|---|---|---|---|---|
| Fathom | Yes | Free | Blanket BAA incorporated by reference into the Terms and Conditions (accepted by entering the Service Agreement as a Covered Entity); a countersigned BAA on request to [email protected], listed on the pricing page under Enterprise. | $0 (Free plan); signed BAA tier: Enterprise, custom pricing via sales | Not published by the vendor | Not published by the vendor | Yes | Not published by the vendor | 2026-10-28 |
| Plaud | Conditional | Starter | Request a signed BAA by emailing [email protected]; the team walks the customer through obtaining and signing it. Compliance documentation (HIPAA validation report, SOC 2) via the Drata Trust Center access form. | $0 (Starter plan, per help center all plans are covered); BAA by request | Yes | Not published by the vendor | Not published by the vendor | Yes | 2026-10-28 |
| Read AI | Conditional | Enterprise+ (annual) | Contact Read AI support after purchasing an annual Enterprise+ plan; SAML authentication and domain capture must be configured first; Read AI team then verifies workspace settings. | $29.75/user/month billed annually (Enterprise+, 5-license minimum) | Yes | Yes | Yes | Yes | 2026-10-28 |
| Granola | Conditional | Enterprise | Enterprise customers request a signed BAA through the Granola sales team; HIPAA workspace configuration and org-wide retention are set up by Granola's team. | $35/user/month (Enterprise) | Yes | Not published by the vendor | Yes | Yes | 2026-10-28 |
| Fireflies.ai | Conditional | Enterprise | On request; sign the BAA on the BAA contract page in the workspace settings and enable Private Storage | $39 per seat/month, billed annually (Enterprise) | Not published by the vendor | Not published by the vendor | Yes | Yes | 2026-10-20 |
| Otter.ai | Conditional | Enterprise | Contact your Otter account manager or the Sales team to start the BAA process; a BAA must be executed before any PHI is handled. | Not published by the vendor | Not published by the vendor | Not published by the vendor | Yes | Yes | 2026-10-19 |
Each vendor's entry gives the exact source and date for its verdict.
Vendors that do not sign a BAA
No vendor among the six is currently rated no or unknown. The full list of vendors checked is at Is it HIPAA compliant? All vendors.
For tools not listed here, these are the usual reasons a tool is excluded:
- It is a free or individual plan that sits outside the vendor's BAA.
- It trains models on customer data.
- It is a consumer app with no business agreement at all.
Check any unlisted tool against these three before it records anything in your practice.
What counts as HIPAA-compliant AI note takers and transcription tools
A note taker that joins a patient call, or records a clinical conversation, creates protected health information (PHI) in two forms: the audio and the transcript. Summaries, action items and shared links derived from them are PHI too. The HIPAA glossary defines PHI and BAA.
"HIPAA compliant" is not a property of a product. The question is whether the vendor signs a BAA for that product and plan, states whether recordings train models, and lets you control retention. Most meeting assistants sign only on business or enterprise plans, if at all. For how AI features change the picture, see AI tools and PHI.
Typical exclusions are free and individual plans, model training on customer data, and consumer apps.
How to choose
- Match the BAA to the plan you will buy. A vendor that signs on Enterprise does not cover a team that buys a lower tier. Read the business associate agreement guide for what to look for in the document itself.
- Get the BAA executed before any PHI is recorded. Check whether setup steps are prerequisites. Read AI requires SAML and domain capture, and Fireflies.ai requires Private Storage.
- Ask in writing whether recordings or transcripts train models. Also ask about retention and deletion controls. A front desk that records a billing call has the same exposure as a clinician.
- Check encryption at rest, audit logging, SSO and a SOC 2 report. Treat anything the vendor does not publish as a question to ask, not as proof the control is missing.
- Check data residency and where recordings are stored. Granola, for example, hosts in the US.
- Review connected integrations and sharing links. Each recipient system that touches PHI needs its own BAA.
- Define staff rules. Cover consent to record, who may enable the bot, and which meetings are excluded, such as patient-identifiable case reviews on a plan without a BAA.
Related
- HIPAA-compliant video conferencing: many note takers join through a meeting platform, which needs its own BAA.
- HIPAA guides: longer explanations of BAAs and AI tools.
- Recent changes in vendor HIPAA status: updates when a vendor changes plan coverage or terms.
FAQ
Does any AI note taker sign a BAA on its free plan?
Among the six checked, Fathom does: a blanket BAA in its Terms is available on every plan, including Free. Plaud's route starts at the Starter plan and works by request. The other four need Enterprise or Enterprise+. See free plans and BAAs for why free tiers are usually excluded elsewhere.
Which AI note takers require an Enterprise plan to get a BAA?
Read AI (Enterprise+, annual billing), Granola, Fireflies.ai and Otter.ai. Read AI's listed price is $29.75/user/month with a 5-license minimum, Granola's is $35/user/month, and Fireflies.ai's is $39/seat/month billed annually. Otter.ai's pricing is not published by the vendor.
What setup is needed before a BAA applies to my workspace?
It varies by vendor. Read AI requires SAML and domain capture. Fireflies.ai requires Private Storage. Plaud's BAA comes by request, so email the vendor, and Fathom's route includes a countersigned request. Confirm the steps against the vendor's own BAA and terms before recording anything.
Is a signed BAA enough to record patient calls?
No. The BAA covers the vendor's handling of PHI. Your organization still has to configure access, decide who may enable the recorder, obtain consent to record where required, set retention, and make sure every connected system that receives transcripts has its own BAA.