Is Otter.ai HIPAA compliant?
Checked 6 Nov 2026 from 2 vendor sources
Otter says it becomes a business associate only after a signed BAA arranged through an account executive, and its pricing page lists HIPAA compliance only as an Enterprise add-on. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Enterprise with HIPAA add-on | Covered |
What the BAA leaves out
- Public and link-based transcript sharing is not appropriate with PHI and must be disabled
How to get the BAA
Contact your Otter account executive to start the process.
What the vendor says to do
- Sign the BAA before any PHI is handled
- Set policies so PHI is not captured by accident
- Admins restrict member Notetaker use under Workspace, Members, Notetaker as needed
- Review calendar integrations and auto-join settings
- Disable public, link-based and external sharing in Workspace settings
- Enforce 2FA and configure SSO
- Deactivate departing members, ideally within 24 hours
- Review usage in Workspace Analytics and audit conversations
- Ask the account executive about custom retention
What we couldn’t confirm
Otter’s help article names no plans. The plan limit comes from its pricing page, which doesn’t use the word BAA. Confirm with Otter’s sales team.
Proof from the vendor
- HIPAA (Otter.ai help)BAA through account executive, must be signed before PHI, setup controls
- Otter pricingEnterprise card lists HIPAA compliance as an add-on; Basic, Pro and Business do not mention HIPAA
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.