Last verified: October 2026, against Otter.ai's own pricing, security and help pages. General information, not legal advice — confirm with your compliance officer or attorney.
Is Otter.ai HIPAA compliant? Otter offers HIPAA compliance only as an add-on to its Enterprise plan, and its public pages don't explain how a business associate agreement (BAA) is signed. For most practices using Otter on a Basic, Pro or Business plan, the answer is no: keep it out of any meeting where a patient is discussed.
Short answer (dated) from Otter's own documentation
Short answer (verified October 2026): Otter's pricing page (opens in a new tab) lists "HIPAA compliance (add-on)" under the Enterprise plan only; Basic, Pro and Business list no HIPAA option. Otter's privacy and security page (opens in a new tab) says "We follow HIPAA requirements in how we collect, store, and process health-related information," and its trust center (opens in a new tab) lists HIPAA among its compliance items. None of these pages describes how to obtain a BAA. Get one signed for your workspace before any protected health information (PHI) is recorded.
Where PHI shows up in meeting transcripts
A note-taker writes down everything, including what nobody meant to put in writing. In a practice, PHI turns up in:
- Case discussions and huddles: "Mrs. Alvarez in room 3 needs her A1c rechecked."
- Telehealth visits, if a bot joins the video call.
- Billing and collections calls with a patient's balance and insurance details.
- Vendor calls where someone shares a screen with the schedule open.
- Staff meetings that drift into a specific complaint or incident.
HHS lists an "independent medical transcriptionist, or the vendor of an app, that provides transcription services to a physician" as a business associate (HHS business associate guidance (opens in a new tab)). An AI note-taker transcribing those conversations falls in the same role, so it needs a BAA. Our business associate agreements guide covers what that contract does.
Plans, BAAs and admin controls to check
| Plan (Otter pricing page, Oct 2026) | Pricing | HIPAA listed? |
|---|---|---|
| Basic | Free | No |
| Pro | Per user, self-serve | No |
| Business | Per user, self-serve | No |
| Enterprise | Contact sales | "HIPAA compliance (add-on)" |
Before signing, ask Otter for these in writing:
- A signed BAA that names your workspace and the HIPAA add-on.
- Training terms. Otter says no customer data is used to train its AI service providers' models, and that it "uses a proprietary method to de-identify user data before training our models." Ask whether that de-identification applies to a HIPAA workspace and whether you can opt out.
- Encryption and hosting. Otter states server-side AES-256 encryption on AWS S3 storage.
- Admin controls for sharing, retention and auto-join across all seats.
The HIPAA Security Rule still requires your own access controls and training on top of anything Otter provides.
Recording consent: federal and state rules
HIPAA isn't the only law in play. Federal wiretap law lets a participant record when "one of the parties to the communication has given prior consent" (18 U.S.C. 2511(2)(d) (opens in a new tab)). Several states set a higher bar:
- California makes it an offense to record a confidential communication "without the consent of all parties" (Penal Code 632 (opens in a new tab)).
- Florida permits interception "when all of the parties to the communication have given prior consent" (Florida Statutes 934.03 (opens in a new tab)).
- Washington requires the consent of all participants, and treats a recorded announcement that the conversation is being recorded as consent (RCW 9.73.030 (opens in a new tab)).
Other states have their own statutes. When people join from several states, follow the strictest rule: announce the recording and make sure the announcement is captured.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Auto-join bots: the risk nobody notices
Once a calendar is connected, Otter's Notetaker can "automatically record, transcribe, provide a summary, and share your conversations" (auto-join article (opens in a new tab)). One auto-join option, "Meetings with a video link," joins every calendar event that has a Zoom, Google Meet or Microsoft Teams link.
Sharing is the second half. Otter's auto-share settings (opens in a new tab) include "All event guests," which shares the notes with everyone invited. Settings changed on an individual event override the account default. So one staff member's calendar can send a transcript of a case discussion to an outside guest without anyone deciding to.
The platforms have their own HIPAA terms, covered in Zoom and HIPAA and Google Meet and HIPAA. Copilot's meeting recap raises similar questions; see Copilot and HIPAA.
Rules for AI note-takers in a practice
Safe without a BAA: internal operations meetings with no patient details, such as rota planning, vendor demos and marketing check-ins.
Unsafe without a BAA and a written policy: case discussions, telehealth sessions, morning huddles, and calls with patients or their families.
- Default auto-join to "Meetings I manually select" and auto-share to "Don't share."
- One approved note-taker, on a practice-managed account. No personal accounts.
- Announce every recording and keep the announcement in the transcript.
- Hosts remove unknown bots before clinical discussion starts.
- Set a retention period and delete transcripts that drifted into PHI.
Medfy does not record meetings or calls. Its HIPAA-relevant data is website form and chat submissions, stored in separate, encrypted regional databases under the practice's BAA; see how Medfy handles patient data. For the full vendor checklist, start at HIPAA-compliant AI, or run a free marketing audit on your public website.
Frequently asked questions
Does Otter.ai sign a BAA?
Otter's public pages, as of October 2026, list HIPAA compliance as an add-on to the Enterprise plan and list HIPAA in its trust center, but they don't describe how a business associate agreement is offered or signed. Ask Otter's sales team for a signed BAA that covers your workspace before any patient information is recorded. Until you have it, keep Otter out of patient conversations. Confirm with your compliance officer.
Can we use Otter to transcribe telehealth visits?
Only with a signed BAA from Otter on a plan that includes its HIPAA add-on, a written policy, and patient consent where your state requires it. HHS lists transcription vendors as business associates. Your telehealth platform's BAA doesn't extend to a separate note-taker that joins the call, so check what documentation tools your platform or EHR already covers before adding one.
Do we need consent to record a meeting?
Federal law allows recording when one party to the conversation consents. Some states require every party's consent, including California for confidential communications, Florida and Washington. When participants are in different states, follow the strictest rule: announce the recording at the start and capture the announcement. This is general information, not legal advice, so confirm your state's rule with an attorney.
How do I stop an AI note-taker from joining meetings?
In Otter, change the default auto-join setting to Meetings I manually select and set auto-share to Don't share, or disconnect the calendar altogether. For bots that arrive with outside guests, the host can remove the participant, and your video platform's waiting room keeps uninvited attendees out. Add a line to your AI policy that names who may turn auto-join on.