Last verified: September 16, 2026. Vendor plans in this category move fast, so this post is checked and dated on a standing schedule. Updates are logged at the bottom.
A client calls about a new diagnosis. She wants to know whether her plan covers the specialist, and to get there she walks through the whole thing: the condition, the medications she's on, the two doctors she's already seen, what her husband's plan does differently. It's a good call. The producer handles it well.
In the corner of the screen, a small icon has been recording since before either of them said hello.
Nobody decided that. It joined because the meeting was on the calendar. By the time the call ends it has produced a recording, a transcript, and a summary, and depending on the settings it may already have emailed all three to everyone who was on the invite.
That's protected health information, sitting with a software vendor, under whatever terms that vendor's free or personal plan happens to carry.
Why this is harder than the question about Gemini
We looked at what Google's HIPAA coverage for Gemini actually means recently, and the mechanism there is the same one here: a BAA is the contract that lets a vendor handle protected health information on your behalf, and a tool is either inside one or it isn't.
What's different is everything around it.
Nobody chooses. Pasting a client's information into an AI tool is a decision, and a decision can be governed. A calendar-integrated notetaker joins because a meeting exists. There's no moment where a producer weighs whether AI belongs on this call, which means there's no moment where a rule can catch it.
It takes everything. Minimum necessary is a standard you can hold yourself to in a prompt. You can't hold yourself to it across forty minutes of conversation. Whatever your client said is in the transcript, including the parts that had nothing to do with the plan.
It spreads. The default on most of these tools is to send the recap to the meeting attendees. If a carrier rep was on that invite, or an assistant from another agency, or a family member who joined for ten minutes, the transcript went to them too. That's a disclosure, and it happened automatically.
What we actually found
I had a working assumption going in, and checking it turned out to be the interesting part.
The assumption was that the recorder built into your meeting platform is probably covered, and the standalone tool someone expensed on a personal card probably isn't. That's roughly true, and it's not the useful finding.
The useful finding is what happens when you do get covered.
The AI mostly turns off.
Otter offers a BAA on its Enterprise plan, and Otter's own HIPAA documentation tells administrators to disable the Notetaker feature so PHI doesn't get captured unintentionally in the first place. Read AI requires an annual Enterprise+ plan with at least five licenses, and switching HIPAA mode on disables recap distribution, pre-reads, topic summaries, live dashboard links, and every push integration it has, while auto-join drops back to hosts only. Zoom will sign a BAA on Zoom for Healthcare or an eligible Business or Enterprise plan with HIPAA mode enabled, and notes that certain AI Companion features aren't available to customers operating under one. Fireflies puts HIPAA on Enterprise and won't activate it until the workspace has been moved onto isolated private storage, with a signed BAA on top. Granola offers a BAA to Enterprise customers and states plainly that it isn't available on Free, Personal, or Business.
Read that list again as an agency owner rather than a compliance officer. The configuration that makes your notetaker covered is largely the configuration that removes the reason anyone installed it. An agency that flips on HIPAA mode expecting to keep the automatic recap landing in everyone's inbox hasn't fixed the problem. It has just stopped getting the thing it wanted.
That trade is the real decision, and it's worth making on purpose rather than discovering it three months in.
The exception worth knowing about
Google Meet is the clean case.
Meet is named on Google's HIPAA Included Functionality list, and so is Gemini in Workspace, which is the part that does the note-taking. On a paid Workspace edition where an administrator has accepted the BAA, the notes sit inside the same agreement as the email they're about. No second vendor, no second contract, no features amputated to qualify.
For an agency already on Workspace, that changes what the work is. The covered option is probably already bundled into what you pay for, and the job isn't to buy something. It's to remove the standalone tool that's been joining calls alongside it.
Microsoft Teams is close behind. Teams is named on Microsoft's own list of services in scope for its HIPAA BAA, and that BAA lives inside the Online Services Data Protection Addendum, available by default to commercial customers who are covered entities or business associates. One caution, because plenty of guides get this wrong: Microsoft's in-scope list does not name Microsoft 365 Copilot. The Copilot it names is Copilot for Security, which is a different product. Confirm Copilot's status against your own agreement rather than taking anyone's summary for it.
Where each tool stands
| Tool | BAA offered | On which plan | What that actually means |
|---|---|---|---|
| Google Meet | Yes | Paid Google Workspace, BAA accepted by an admin | Meet and Gemini in Workspace are both named on Google's covered list. The note-taking is inside the agreement. |
| Microsoft Teams | Yes | Commercial tenants, via the Online Services Data Protection Addendum | Teams is named on Microsoft's in-scope list. Microsoft 365 Copilot is not; confirm it separately. |
| Zoom | Yes, with limits | Zoom for Healthcare, or an eligible Business or Enterprise plan with HIPAA mode. Free accounts cannot be used for PHI | Certain AI Companion features are unavailable under a BAA. Covered entities are directed to disable auto-transcription and smart summaries. |
| Otter.ai | Yes, with limits | Enterprise only, arranged through an account manager | Otter's guidance is to disable the Notetaker feature, turn off public and link sharing, enforce SSO and 2FA, and set custom retention. |
| Fireflies.ai | Yes, with limits | Enterprise only | Needs all three: Enterprise plan, Private Storage on isolated infrastructure, signed BAA. Drop any one and HIPAA compliance switches off. |
| Read AI | Yes, with limits | Enterprise+ annual, five licenses minimum | HIPAA mode disables report downloads and distribution, public links, recap and pre-read sharing, and all push integrations. |
| Granola | Yes | Enterprise only | Explicitly unavailable on Free, Personal, and Business plans. |
| Fathom | Yes | Not stated in its published documentation | Publishes a blanket BAA and will sign individual ones on request. Ask which plans it reaches before you rely on it. |
The second thing that can bite you
Recording consent isn't HIPAA. It's state law, it varies, and a number of states require every party on the call to consent rather than just one.
This is its own axis, and an agency can clear the HIPAA question completely and still be on the wrong side of it. A producer in one state on a call with a client in another can be subject to the client's state rule. What counts as consent, and whether an announcement at the top of the call is enough, are questions with real answers that depend on where both people are sitting.
I'm not going to tell you what your state requires, and you should be wary of any article that does. Bring it to your own counsel. What this post gives you is the knowledge that it's a separate question from the BAA, so you ask about both.
Carrier and FMO contracts are a third layer, and for Medicare specifically CMS has its own rules about recording calls. Any one of them can be stricter than HIPAA.
What to do this week
- Find out what's actually joining your calls. Check the calendar integrations on every producer's account, not just your own. This is usually the step that turns something up.
- For each tool you find, answer the same three questions: is a BAA offered, on which plan, and what does it disable when you turn coverage on.
- Turn off auto-send of recaps and transcripts to attendees, at the admin level rather than per meeting. Do this today regardless of what else you decide.
- If you're on Workspace or a commercial Microsoft tenant, look hard at whether the covered option you already pay for can replace the standalone tool.
- Write down the rule. No AI joins a client call unless it's on the approved list, and the list lives somewhere your team can see it.
Questions agents ask
Is my AI notetaker HIPAA compliant?
Not by default. Every major notetaker offers a BAA on some plan, but almost always the top tier, and coverage only exists once that agreement is signed. A tool on a free or personal plan has no BAA regardless of how good its security is.
Is Otter HIPAA compliant?
Otter offers a BAA on its Enterprise plan through an account manager. Its own guidance also directs administrators to disable the Notetaker feature to avoid capturing PHI unintentionally.
Is Zoom HIPAA compliant, and is AI Companion covered?
Zoom is HIPAA compliant in the sense that matters: it will sign a BAA, on Zoom for Healthcare or an eligible Business or Enterprise plan with HIPAA mode enabled. Free accounts cannot be used for PHI at all. The AI is a separate question from the platform. Certain AI Companion features are not available to customers operating under a BAA, and covered entities are directed to disable auto-transcription and smart summaries, so a covered Zoom account does not mean covered Zoom AI.
Is Google Meet HIPAA compliant?
Meet is named on Google's HIPAA Included Functionality list, and so is Gemini in Workspace. On a paid Workspace edition with the BAA accepted, both the meeting and its notes are inside the agreement.
Do I need consent to record a client call?
Recording consent is state law rather than HIPAA, and requirements differ by state, including which parties have to consent. Ask your own counsel about the states you and your clients are in.
We've been recording client calls with an uncovered tool. What now?
Stop the ongoing recording first, before investigating. Don't delete anything, because whether records must be preserved is a question for counsel. Then bring your compliance officer specifics: which tool, which plan, what was captured, roughly when it started, and what your carrier contracts require you to report.
The rule underneath all of this
A tool that joins a client call on its own authority is making a decision nobody assigned it.
That's the part to fix, and it's the same fix whether the tool turns out to be covered or not. A Digital Crew works because every seat has a named role, a defined job, a human who owns it, and a decision it never makes. A notetaker with calendar access and default sharing has three of those and is missing the fourth, which is how it ends up holding a recording of your client's medications without anyone having chosen that.
Decide what's allowed on a client call. Write it down before the next one. Then let your producers get back to the conversation, which is the part only they can have.
Updates
- September 16, 2026 - First published. All vendor rows verified against vendor documentation on this date.
