Conditional A business associate agreement (BAA) is available on request for the Starter, Pro, Unlimited and Team plans, and the main exclusion is that Plaud does not automatically de-identify spoken patient identifiers before third-party LLM processing. Verdict date: 2026-10-28. This covers Plaud Note, Plaud NotePin and the Plaud app, because all three send recordings to the same Plaud cloud service for transcription and AI summaries. It is one of our all vendor HIPAA checks.
Short answer
A BAA is available on Starter, Pro, Unlimited and Team for the Plaud cloud service (recordings, transcription and AI summaries). You get it by emailing [email protected].
Plaud's help center says its HIPAA, SOC 2 and ISO 27001 compliance applies to all four plans alike. But no plan states that the BAA is included automatically, and no public BAA text exists. Until you hold a signed BAA, treat every Plaud plan as unsuitable for patient recordings.
The accurate wording is "BAA available on plan X for services Y", not "Plaud is HIPAA compliant" and not "HIPAA certified". HIPAA has no certification.
Which plans include a BAA
The HIPAA glossary (BAA, PHI) defines the terms used below.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Starter | Available on request; not automatic | Email [email protected] | Not published by the vendor (plan listed from $0) |
| Pro | Available on request; not automatic | Email [email protected] | Not published by the vendor |
| Unlimited | Available on request; not automatic | Email [email protected] | Not published by the vendor |
| Team | Available on request; not automatic | Email [email protected] | Not published by the vendor |
To request one, email [email protected] for a signed BAA. Plaud's team walks the customer through signing. Supporting documentation is available through the Drata Trust Center access form.
Team adds workspace-level data residency and a formal data processing agreement (DPA). The other three plans do not.
What the BAA covers and what it excludes
Covered
- The Plaud cloud service for recordings, transcription and AI summaries from Plaud Note, NotePin and the Plaud app.
Excluded or not established
- Automatic redaction of spoken identifiers. Names, dates of birth and medical record numbers said aloud in an exam room go to third-party LLM processing as spoken.
- Workspace-level data residency and a formal DPA on Starter, Pro and Unlimited. These come only with Team.
- A public BAA text. Whether the BAA covers third-party LLM subprocessors is not published by the vendor.
The help-center answer on masking is quoted in the Sources section below.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | US, EU (Frankfurt), Singapore, Japan |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
Plaud does not publish an end-to-end encryption claim, so don't assume one. For an evaluator, the missing audit log and access-control details matter. A privacy officer cannot show who listened to or exported a recording if the vendor publishes no such controls.
How to use Plaud with PHI
- Get the signed BAA before any PHI is recorded. A request email is not an agreement. Don't pilot with real patient visits first.
- Confirm in writing which plan and which subprocessors the BAA covers. Coverage of third-party LLM subprocessors is not published.
- Plan for spoken identifiers reaching LLMs. Nothing is redacted. If a clinician says a patient's full name and date of birth at the start of a visit, that audio is processed as spoken. Set a rule for what is said aloud on a recording.
- Choose the Team plan if you need workspace-level data residency or a formal DPA. Pick the region (US, EU, Singapore or Japan) before onboarding staff.
- Set device, access and retention policies. Decide who holds the recorder or app, how devices are locked and lost, and how long recordings and summaries are kept.
- Train staff on consent and on when to record. Recorder use in hallways, waiting rooms or phone calls creates exposure that a BAA doesn't address.
- Review every export into other tools. A summary pasted into an EHR note, email or shared drive needs its own BAA with that vendor.
Compliance depends on the signed BAA, your configuration and your policies.
Alternatives with a BAA
These AI meeting and transcription tools have a BAA route. Each is listed with its status on this site, not ranked, and placement never depends on payment. See the full HIPAA-compliant AI transcription tools table.
- Fathom: yes, BAA from the Free plan.
- Fireflies.ai: conditional, Enterprise.
- Granola: conditional, Enterprise.
- Is Otter.ai HIPAA compliant?: conditional, Enterprise.
- Read AI: conditional, Enterprise+ on annual billing.
Sources
- Does Plaud automatically mask/remove patient-identifiable information before using AI? – Plaud — Help article, checked 2026-10-28. "To request a signed Business Associate Agreement (BAA), contact [email protected]. The team will walk you through obtaining and signing the BAA."
- Does Plaud automatically mask/remove patient-identifiable information before using AI? – Plaud — Help article, checked 2026-10-28. "No. Plaud does not automatically redact patient-identifiable information (such as names, date of birth, or medical record numbers) that is spoken in a recording before it is processed by an AI model."
- Plaud's certifications and compliance – Plaud — Help article, checked 2026-10-28. "All certifications and compliance standards apply to all plans. ISO 27001/27701, GDPR, SOC 2, HIPAA and EN 18031 compliance cover Starter, Pro, Unlimited, and Team plans alike. Plaud Team introduces advanced administrative controls. In addition to our standard certifications, the Team plan provides Workspace Level Data Residency, and a formal Data Processing Addendum."
- Plaud Trust Center: Security, Privacy & Compliance — Trust center, checked 2026-10-28. "Data is stored and processed in local, or the most appropriate, regional data center. Plaud currently has data centers in the US, Europe (Frankfurt), Singapore, and Japan. […] All data is encrypted using HTTPS/TLS 1.2+ in transit and AES-256 at rest."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Is Plaud Note or NotePin HIPAA compliant?
Conditional. Plaud Note, NotePin and the Plaud app all use the same Plaud cloud service, and a BAA for that service is available on request on Starter, Pro, Unlimited and Team. It is not automatic. The device alone is not the question. The signed BAA, your settings and your policies decide whether PHI can be recorded.
How do I get a signed BAA from Plaud?
Email [email protected] and request a BAA. Plaud's team walks you through signing. Documentation can be requested through the Drata Trust Center access form. Whether the BAA costs extra is not published by the vendor.
Does Plaud remove patient-identifiable information before AI processing?
No. Plaud's help center answers "No" on masking. Identifiers spoken in a recording are not automatically redacted before third-party LLM processing. The public sources do not say whether the BAA covers those LLM subprocessors.
Do all Plaud plans have the same HIPAA coverage?
Plaud's help center says HIPAA, SOC 2 and ISO 27001 compliance cover Starter, Pro, Unlimited and Team alike, and the BAA is available on all four by request. The difference is Team, which adds workspace-level data residency and a formal DPA. No plan includes the BAA automatically.