Conditional A BAA is available on Granola's Enterprise plan only, and the main exclusions are the mobile apps and every non-Enterprise plan (verdict date 2026-10-28).
Granola is an AI meeting-notes and transcription tool. If your clinic wants to use it for meetings that include PHI, you need the Enterprise plan, a signed BAA, and the desktop or laptop app. Other tools in the same situation are listed in the all-vendors directory.
Short answer
BAA available on Enterprise for desktop and laptop apps. Enterprise starts at $35/user/month, and you request the BAA through Granola sales. It is not available on Free (Basic) or Business.
The BAA currently covers the desktop and laptop apps only, not the mobile apps. For definitions of the terms, see the HIPAA glossary (BAA, PHI).
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free (Basic) | Not available | Not applicable | Not published by the vendor |
| Business | Not available | Not applicable | Not published by the vendor |
| Enterprise | Available | Signed BAA requested through Granola sales. Granola's team sets up the HIPAA workspace configuration and org-wide retention. | From $35/user/month |
What the BAA covers and what it excludes
Covered
- Granola desktop and laptop apps (meeting notes and transcription)
Excluded
- Free (Basic) and Business plans
- Mobile apps
- SSO on any plan other than Enterprise, and on Enterprise it requires 50+ seats
A common gap in practice: a clinic signs the Enterprise BAA, then a clinician opens Granola on a phone to capture a hallway case discussion. That use is outside the BAA's current scope.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Yes |
| SSO | Yes |
| Data residency | US |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
According to the vendor, no EU, UK or other regional data residency is offered.
How to use Granola with PHI
Use this checklist before any PHI enters a meeting note. The HIPAA guides cover vendor onboarding in more depth.
- Sign the BAA first. Do not record or transcribe any PHI until the BAA is executed.
- Confirm the Enterprise plan. Free (Basic) and Business accounts have no BAA, so keep them out of any workflow that involves PHI.
- Use the desktop or laptop app only. Keep the mobile apps off for PHI, and say so in your written policy.
- Have Granola configure the HIPAA workspace and retention. Granola's team does this for Enterprise customers. Ask for the org-wide retention setting in writing.
- Manage SSO and offboarding. SSO is on Enterprise with 50+ seats. Remove departed staff promptly so they lose access to stored notes.
- Set staff policy on recording consent and training. Decide which meetings may be recorded and how participants are told. Train staff on what is allowed.
Compliance depends on the signed BAA, your configuration and your policies, not on the tool alone.
Alternatives with a BAA
Each verdict is summarized here and detailed on the linked page. The list is in no particular order.
- Is Fathom HIPAA compliant?: yes, BAA from the Free plan
- Is Fireflies.ai HIPAA compliant?: conditional, Enterprise
- Is Otter.ai HIPAA compliant?: conditional, Enterprise
- Plaud: conditional, Starter plan
- Read AI: conditional, Enterprise+ on annual billing
For other categories of tools that can sign a BAA, see HIPAA-compliant software by category.
Sources
- Security, Privacy & Data FAQs — Help article, checked 2026-10-28. "Yes — Granola is HIPAA compliant for Enterprise customers and can sign a Business Associate Agreement (BAA). […] HIPAA support is not available on Free or Business plans […] Our BAA currently covers the Granola desktop and laptop apps only."
- Security, Privacy & Data FAQs — Help article, checked 2026-10-28. "Data is encrypted both at rest and in transit. […] All data is stored on Amazon Web Services (AWS) servers located in the United States. […] We do not offer EU, UK, or other regional data residency at this time. […] Granola holds SOC 2 Type II certification. […] Yes — SSO is available on Enterprise plans for organisations with 50+ seats."
- Granola for regulated teams: HIPAA workspaces, retention windows, redaction and deletion | Granola — Vendor page, checked 2026-10-28. "Granola's Enterprise plan includes HIPAA compliance features through a Business Associate Agreement (BAA), configurable retention and access controls, and PHI handling protocols. Basic and Business plans do not include BAA or HIPAA workspace configuration."
- HIPAA compliant AI transcription: What a BAA covers and what it does not | Granola — Vendor page, checked 2026-10-28. "Enterprise customers can request a signed BAA through the Granola sales team"
- Privacy Policy — Terms, checked 2026-10-28. "HIPAA-enabled Services and BAAs are available only for Enterprise Services accounts"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Is Granola HIPAA compliant on the Free or Business plan?
No BAA is available on Free (Basic) or Business, so neither plan should be used with PHI. A BAA is available only on Enterprise.
Does Granola sign a BAA and how do I get one?
Yes, on Enterprise. You request the signed BAA through Granola sales. Granola's team then sets up the HIPAA workspace configuration and org-wide retention. Enterprise starts at $35/user/month.
Does Granola's BAA cover the mobile app?
No. The BAA currently covers the desktop and laptop apps only. Keep the mobile apps off for any meeting that includes PHI.
Where is Granola data stored and is it encrypted?
The vendor states that data residency is in the US on AWS, and it does not offer EU, UK or other regional residency. It publishes encryption in transit and at rest. Granola does not publish an audit log, HITRUST or ISO 27001 status, and it does list SOC 2.