Is Quo AI HIPAA compliant?
Only on the right plan. Quo (formerly OpenPhone) signs a Business Associate Agreement for Quo AI on Business and Scale. Other plans aren't covered, so keep patient data out of them.
Does Quo AI (formerly OpenPhone) sign a BAA?
Only on some plans or setups
Quo offers a BAA on its Business and Scale plans. Texting and third-party integrations are not covered. Quo says AI-powered features can be used with PHI only if the practice meets several conditions, including patient notice and authorization, and that the practice bears full responsibility for PHI processed through AI.
Not fully covered by the BAA: AI-powered features (call summaries, transcripts, Sona AI agent); SMS/MMS texting.
- Business associate
- Quo (formerly OpenPhone)
- Tool
- Quo AI (formerly OpenPhone)
- Plans with a BAA
- Business and Scale
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Business and Scale | Signs a BAA | Request by emailRequest page | Existing customers request the BAA through a form linked from the HIPAA article; prospective customers contact sales. SMS/MMS and third-party integrations are not Covered Services. Recorded calls require patient notice. Sessions time out after 15 days of inactivity by default.[1],[2] |
| Starter (and other plans) | Not confirmed | Not stated | Quo names only Business and Scale as BAA-eligible. It does not explicitly say other plans are refused.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Quo (formerly OpenPhone) says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| AI-powered features (call summaries, transcripts, Sona AI agent)Business and Scale | Partly covered | Quo does not say whether AI features are Covered Services. It says they may be used compliantly only if the practice notifies patients, obtains authorization, limits PHI to the minimum necessary, documents the decision, and adds safeguards, and that the practice assumes full responsibility for PHI processed through AI. Call summaries, transcripts and Sona are not named individually.[1] |
| SMS/MMS textingBusiness and Scale | Excluded | Not a Covered Service under the Quo BAA; the customer bears liability for PHI sent by text.[1] |
Meeting note-takers that offer a BAA
- Fireflies.aiBAA on: EnterpriseSome plans only
- GranolaBAA on: EnterpriseSome plans only
- Krisp AI Meeting AssistantBAA on: Meeting AI Enterprise (Business tier), 100+ seatsSome plans only
- MeetGeekBAA on: Any annual planSome plans only
- Otter.aiBAA on: Enterprise (with HIPAA add-on)Some plans only
- Read AIBAA on: Enterprise+ (annual)Some plans only
All BAA-ready alternatives to Quo AI (formerly OpenPhone)
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.