Conditional A BAA is available on the annual Enterprise+ plan for the Read AI workspace, meeting notetaker, reports and transcripts; Free, Pro, Enterprise and monthly Enterprise+ have none (verified 2026-10-28). See All vendor HIPAA checks for other tools.
Short answer
Read AI signs a BAA only on annual Enterprise+, which has a 5-license minimum. SAML SSO and domain capture must be set up first. The BAA is obtained through Read's support after purchase, and Read then verifies the workspace settings. Enterprise+ starts at $29.75 per user per month, billed annually.
A clinic that wants a notetaker in meetings involving PHI therefore needs the annual contract, an identity setup and a signed agreement before the first recorded meeting. A Free or Pro account used for a patient-related huddle has no BAA behind it.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | No | Not applicable | Not published by the vendor |
| Pro | No | Not applicable | Not published by the vendor |
| Enterprise | No | Not applicable | Not published by the vendor |
| Enterprise+ (monthly) | No | Not applicable | $39.75 per user per month |
| Enterprise+ (annual) | Yes | Contact support after purchase; SAML SSO and domain capture first | $29.75 per user per month, billed annually |
The monthly Enterprise+ price is higher than the annual one, and monthly billing carries no BAA. Choosing monthly billing to "try it first" does not put PHI under a BAA.
What the BAA covers and what it excludes
Covered: the Read AI workspace, the meeting notetaker, and meeting reports and transcripts.
Not covered or unavailable:
- Free, Pro and Enterprise plans have no BAA.
- The Ada AI email assistant is unavailable in HIPAA workspaces.
- Push integrations are off by default when HIPAA is enabled: Notion, HubSpot, Asana, Jira, Confluence, Salesforce, Microsoft Teams and Linear.
- Meeting titles, calendar event descriptions and support tickets must not contain ePHI.
The last point matters in practice. A calendar invite titled with a patient's name and procedure sits outside the protected content, so front-desk and care-coordination staff need a naming rule before the notetaker joins any meeting. For definitions of the terms used here, see the HIPAA glossary: BAA and ePHI.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
An evaluator who needs a stated hosting region, HITRUST or ISO 27001 cannot confirm them from Read's published material. The audit log is delivered through a webhook, so someone has to receive and retain that stream.
How to use Read AI with PHI
The BAA is one part of the arrangement; the customer carries the rest. Steps for an evaluator or MSP:
- Buy annual Enterprise+ with at least 5 licenses.
- Configure SAML SSO and domain capture.
- Contact support after purchase and sign the BAA.
- Have Read verify the workspace settings.
- Keep ePHI out of meeting titles, calendar event descriptions and support tickets.
- Review the default-off push integrations before enabling any of them. Each integration that handles PHI needs its own agreement with that vendor, and leaving them off is the safer default.
- Set a staff policy on which meetings may be recorded, for example allowing the notetaker in billing-team reviews but not in sessions where a clinician discusses a named patient, unless leadership has approved it.
Compliance depends on the signed BAA, configuration and policies, not on the tool alone. For policy templates and rollout steps, see the HIPAA guides.
Alternatives with a BAA
These meeting-notetaker and transcription tools publish a BAA on at least one plan. Verdicts follow the same rule as this page: conditional means a BAA exists only on a named plan.
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Fathom | Yes | Free |
| Fireflies.ai | Conditional | Enterprise |
| Granola | Conditional | Enterprise |
| Otter.ai | Conditional | Enterprise |
| Plaud | Conditional | Starter |
For the full comparison, see HIPAA-compliant AI transcription tools.
Sources
- Security & Privacy Overview – Read Help Center — Help article, checked 2026-10-28. "Read is now able to offer a BAA to support HIPAA compliance. Due to the advanced security features required, this is only supported for users on an annual Enterprise+ plan, and it is required to set up both SAML authentication and domain capture for the workspace before proceeding with signing the BAA"
- Enabling HIPAA Compliance in Read AI Workspaces – Read Help Center — Help article, checked 2026-10-28. "Ensuring your organization is on an annual Enterprise+ plan (5 license minimum). Signing a Business Associate Agreement (BAA), which outlines the responsibilities and obligations for HIPAA compliance. Working with the Read AI Team to verify that your Workspace settings and permissions are properly configured for HIPAA compliance."
- Enabling HIPAA Compliance in Read AI Workspaces – Read Help Center — Help article, checked 2026-10-28. "Customer data is encrypted at rest using at least AES-256. Data is encrypted in transit with TLS 1.2 or greater. […] Workspace audit logs can be set up via webhook: Workspace Audit Logs. […] Please note that Ada is not available for users in a HIPAA-compliant workspace."
- Read AI Pricing — Pricing page, checked 2026-10-28. "Enterprise+ $29.75 billed annually, $39.75 billed monthly. Support for enabling HIPAA compliance in your Read workspace."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Does Read AI offer a BAA on the Free or Pro plan?
No. The BAA is available only on the annual Enterprise+ plan. Free, Pro, Enterprise and monthly Enterprise+ have none, so PHI should not go through them.
What do I need to set up before Read AI signs a BAA?
SAML SSO and domain capture must be configured first. After purchasing annual Enterprise+, you contact support to obtain the BAA, and Read then verifies the workspace settings.
Is the Ada email assistant available in a HIPAA workspace?
No. Ada, Read's AI email assistant, is unavailable in HIPAA workspaces and is not covered by the BAA.
How many licenses are required for a Read AI BAA?
At least 5. The annual Enterprise+ plan has a 5-license minimum, priced from $29.75 per user per month billed annually.