Otter.ai signs a business associate agreement (BAA) on its Enterprise plan only, not on Basic, Pro or Business. The BAA covers the Otter meeting agent, Notetaker and transcripts. Public and link-based sharing is excluded. This check is one entry in the directory of Is it HIPAA compliant? All vendors.
Is Otter.ai HIPAA compliant? BAA by plan, covered services and exclusions
Conditional A BAA is available on the Otter.ai Enterprise plan only, and the main exclusion is public and link-based transcript sharing, which must be disabled whenever PHI is involved (verified 2026-10-19).
Short answer
Otter.ai offers a BAA on the Enterprise plan for the Otter meeting agent, Notetaker and transcripts. The Basic, Pro and Business plans are not covered. The BAA is started through an account manager or Sales, and it must be executed before any PHI is handled. For definitions of BAA and PHI, see the HIPAA glossary (BAA, PHI).
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Basic | Not covered | Not available | Not published by the vendor |
| Pro | Not covered | Not available | Not published by the vendor |
| Business | Not covered | Not available | Not published by the vendor |
| Enterprise | Available | Contact the account manager or Sales | Listed as an add-on on the pricing page; price not published by the vendor |
Minimum seats for the Enterprise BAA: Not published by the vendor.
What the BAA covers and what it excludes
Covered under the Enterprise BAA:
- The Otter Enterprise workspace
- The AI meeting agent
- Otter Notetaker
- Transcripts and recordings
Excluded:
- Public and link-based transcript sharing. It must be explicitly disabled when PHI is involved. A care coordinator who pastes a transcript link into an email or a patient-facing portal is outside the BAA.
- Automatic Notetaker joining and calendar auto-join, unless the customer controls them. If the Notetaker auto-joins every meeting on a staff member's calendar, it can record a call that was never meant to be transcribed, such as a case review or a billing dispute call.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Yes |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" does not mean a control is absent. It means the control is not stated on the pages checked. Ask Otter for these details in writing during procurement, especially encryption, audit logging and data residency, which most security reviews require.
How to use Otter.ai with PHI
A signed BAA is one part of the picture. The rest is the customer's responsibility. For a clinic or MSP, the checklist looks like this:
- Execute the BAA on Enterprise before any PHI is handled. A pilot with real patient calls on Pro does not count as a trial. It is a disclosure of PHI to a vendor without a BAA.
- Disable public and link-based sharing. Confirm the setting at the workspace level, not only in individual accounts.
- Control Notetaker and calendar auto-join. Decide which meetings may be recorded, and stop the Notetaker from joining others automatically.
- Restrict access with roles and SSO. Limit who can open transcripts that contain PHI, and remove access when staff leave.
- Keep Basic, Pro and Business out of PHI workflows. Block personal Otter accounts on practice devices where your policy requires it.
- Train staff and set meeting-recording policies. Cover when to record, how to announce it, where transcripts are stored and how long they are kept.
- Check the meeting platform too. Otter often joins calls on other platforms, and those platforms have their own terms. See Is Zoom HIPAA compliant? as an example.
Compliance depends on the signed BAA, the configuration and the organization's policies. Using Otter.ai under a BAA does not make an organization HIPAA compliant by itself.
Alternatives with a BAA
These AI note-taking and transcription tools publish BAA terms. The list is in alphabetical order and is not influenced by payment. Each verdict reflects the vendor's own BAA page, so check the individual entry before relying on it.
- Fathom: yes, BAA from the Free plan
- Fireflies.ai: conditional, Enterprise
- Granola: conditional, Enterprise
- Plaud: conditional, Starter
- Read AI: conditional, Enterprise+ on an annual plan
For a side-by-side view, see HIPAA-compliant AI transcription tools.
Sources
- HIPAA | Otter.ai – Help Center — Help article, checked 2026-10-19. "Getting Started: HIPAA compliance is only available for the Enterprise plan. Reach out to your account manager to start the Business Associate Agreement (BAA) process or contact our Sales team to learn more."
- Otter.ai Pricing — Pricing page, checked 2026-10-19. "HIPAA compliance (add-on)"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Is Otter.ai HIPAA compliant?
Only conditionally. Per Otter's help article, a BAA is available on the Enterprise plan for the meeting agent, Notetaker and transcripts. Without an executed BAA, and without disabling public and link-based sharing, Otter.ai should not be used with PHI.
Does Otter.ai sign a BAA on the Basic, Pro or Business plan?
No. The vendor's help article limits the BAA to the Enterprise plan. Basic, Pro and Business are not covered, so none of them should handle PHI.
How do I get a BAA from Otter.ai for the Enterprise plan?
Contact your Otter account manager or Sales. The pricing page lists "HIPAA compliance (add-on)", but no price is published. The BAA must be executed before any PHI is recorded or transcribed.
Can I use Otter.ai link sharing or auto-join with PHI?
No, not by default. Public and link-based sharing is excluded from the BAA and must be explicitly disabled when PHI is involved. Automatic Notetaker joining and calendar auto-join are also excluded unless the customer controls them.