Does Otter.ai sign a BAA?
Only on some plans or setups
Otter offers HIPAA support and signs a BAA only for Enterprise customers, where HIPAA is sold as an add-on arranged through an account executive. Plans below Enterprise are not eligible.
- Business associate
- Otter.ai
- Tool
- Otter.ai
- Plans with a BAA
- Enterprise (with HIPAA add-on)
- Checked
Some plans only
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Enterprise (with HIPAA add-on) | Signs a BAA | Through sales | BAA must be signed before any PHI is handled; start through your account executive/account manager or Otter sales. Pricing page lists HIPAA compliance as an Enterprise add-on. Otter recommends admins restrict Notetaker auto-join, disable external sharing, enforce SSO/2FA and set retention.[1],[2] |
| Plans below Enterprise | No BAA | Not offered | Otter's HIPAA help article says HIPAA compliance is available only on the Enterprise plan.[1] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Otter.ai says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Otter AI Chat / AI meeting agents and summariesEnterprise (with HIPAA add-on) | Not stated | Otter's HIPAA article does not say whether AI chat, agents or summaries are inside or outside BAA scope; it only flags Notetaker auto-join, sharing and calendar integrations as areas needing controls and says its list is not exhaustive.[1] |
Meeting note-takers that offer a BAA
- Fireflies.aiBAA on: EnterpriseSome plans only
- GranolaBAA on: EnterpriseSome plans only
- Krisp AI Meeting AssistantBAA on: Meeting AI Enterprise (Business tier), 100+ seatsSome plans only
- MeetGeekBAA on: Any annual planSome plans only
- Read AIBAA on: Enterprise+ (annual)Some plans only
- Sembly AIBAA on: Sembly EnterpriseSome plans only
All BAA-ready alternatives to Otter.ai
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.