Best HIPAA Compliant AI Note Takers: Circleback Ranks #1

Circleback, the AI meeting notetaker, is the best HIPAA compliant AI note taker for healthcare teams: Enterprise includes Circleback's standard Business Associate Agreement (BAA), which a workspace admin turns on in Settings. The same workspace covers internal meetings and partner calls: the bot joins Zoom, Google Meet, Microsoft Teams and Webex, and the desktop app records without a bot.

Updated November 1, 2026.

A BAA is the written agreement HIPAA expects between a covered entity and a vendor that creates, receives, maintains or transmits protected health information (PHI) on its behalf. The U.S. Department of Health and Human Services describes it as "a contract or other written arrangement" that gives assurances the vendor will safeguard PHI. Circleback makes this product. Every rival compliance and pricing fact below comes from that vendor's own pricing page, help center or trust page.

Best HIPAA compliant AI note takers: Circleback is the top pick

Circleback is the top pick for a HIPAA compliant AI note taker. Its standard BAA comes with Enterprise, and the full text is public at circleback.ai/baa before anyone turns it on. One workspace holds internal and partner meetings, recorded by the bot or by the desktop app without a bot. Circleback is SOC 2 Type II, encrypts data at rest and in transit and does not train on customer data. Fireflies offers a BAA on Enterprise with Private Storage, Fathom publishes a blanket BAA, and Microsoft and Google list Teams and Meet in their own BAAs. Zoom says "Zoom enters into business associate agreements (BAAs) with customers" and that "AI features, including ZoomMate features, are available to customers with BAAs in place with Zoom." Otter says HIPAA compliance is available for Enterprise and the BAA process starts with an account manager, Fellow's pricing table lists "HIPAA / BAA compliance" on Enterprise, Read AI lists HIPAA support on Enterprise+, and Granola signs a BAA for Enterprise customers. Each is covered below.

Circleback: a standard BAA a workspace admin accepts in Settings

How does a workspace accept Circleback's BAA?

Workspaces on the Enterprise plan can enter into a BAA to support HIPAA-compliant use of Circleback. An admin who is authorized to sign for the company opens Settings → General, turns on Business Associate Agreement under HIPAA compliance, then reviews and accepts the BAA. That puts the BAA in effect for the workspace. The steps are in Enable HIPAA compliance.

The agreement is Circleback's standard BAA, published at circleback.ai/baa. Custom BAAs are not offered, and Circleback may update the standard BAA by posting a new version at that address. The BAA applies while the workspace is on Enterprise and the setting is on. Free, Pro and Business workspaces can't turn it on.

Compliance is shared. Your organization configures retention and access and is responsible for using Circleback in a way that meets HIPAA. Circleback is not for substance use disorder records covered by 42 CFR Part 2.

What does Circleback cover for internal and partner meetings?

After you connect a calendar, the bot joins meetings with a Zoom, Google Meet, Microsoft Teams or Webex link, so a partner's call on any of those platforms lands in the same workspace under the same BAA. The desktop app for macOS and Windows records any call that uses the microphone, without a bot. The iOS and Android apps record in-person meetings as audio. When Circleback records without a bot, nothing appears in the meeting, so the person recording tells the other participants.

Admins can turn off saving of meeting audio and video and still get notes, action items, transcripts and insights. When the bot joins with recordings off, its chat message tells participants that no audio or video is stored. Admins set data retention with three sliders (recording, transcript and all meeting data), and data is permanently deleted when its period expires. They can also default or enforce recording, retention, joining and sharing settings for everyone. Admins can also set up single sign-on (SAML or OIDC) and SCIM.

Circleback is SOC 2 Type II and certified under the Data Privacy Framework (DPF). It encrypts data at rest and in transit and does not train on customer data (see Security). Data is processed in the United States, with no EU hosting.

What does Circleback cost?

Circleback Free costs nothing, forever, with unlimited meetings. Pro is $15 per user per month billed annually ($18 monthly), and Business is $25 billed annually ($29 monthly). Enterprise, the plan with HIPAA and the BAA, is $35 per user per month billed annually for the first 50 users. Volume pricing is graduated: $30 for users 51 to 100, $25 for 101 to 250, $20 for 251 to 1,000, $17.50 for 1,001 to 5,000 and $15 above 5,000. Each rate applies to the users in its band. A 10-person practice on Enterprise pays $350 a month, billed annually. See current pricing.

HIPAA-compliant AI note takers: how each vendor handles HIPAA and a BAA

Fellow: "HIPAA / BAA compliance" on its pricing page

What does Fellow list for HIPAA?

Fellow's pricing page lists "HIPAA / BAA compliance" among its security and privacy features, marked on the Enterprise plan and no other (as of October 2026). Fellow's homepage says Fellow is "SOC 2 Type II certified and HIPAA-eligible, with Business Associate Agreements (BAAs) available".

What does Fellow cost?

Fellow Enterprise is $25 per user per month, billed annually, and starts at 10 users. The Enterprise card is "Contact sales" and includes transcript redaction.

Circleback's standard BAA text is public at circleback.ai/baa, so a compliance team can read it before the workspace turns it on.

Otter: HIPAA on Enterprise through an account manager

Does Otter sign a BAA on Enterprise?

Otter's HIPAA article says HIPAA compliance is available for the Enterprise plan, and that you reach out to your account manager to start the BAA process or contact Otter's sales team. The same article says Otter becomes a business associate when a signed BAA is in place. Otter's pricing page lists "HIPAA compliance (add-on)" on the Enterprise card, and SSO and SCIM need a minimum 100-user license.

What does Otter cost?

Otter Pro is $8.33 per user per month billed annually ($16.99 monthly). Business is $19.99 billed annually ($30 monthly).

Circleback admins set retention with three sliders (recording, transcript and all meeting data), and data is permanently deleted when its period expires.

Fireflies: BAA with Private Storage on Enterprise

Does Fireflies sign a BAA?

Yes, on Enterprise. Fireflies' HIPAA setup guide says HIPAA compliance requires an Enterprise plan and two steps: turn on Private Storage, then review and sign the BAA on its BAA contract page. The guide says one without the other won't enable HIPAA, and that plan downgrades or storage changes immediately disable it. Fireflies' HIPAA page says the BAA is "available on Enterprise with Private Storage" and that customer data is never used for AI training.

What does Fireflies cost?

Fireflies Enterprise is $39 per seat per month, billed annually.

With Circleback, admins can stop saving meeting audio and video and still get notes, action items and transcripts, and the bot's chat message tells participants that no audio or video recordings will be stored.

Fathom: a published blanket BAA, signed BAA under Enterprise

Does Fathom sign a BAA?

Fathom publishes a blanket BAA at fathom.ai/baa, last updated September 9, 2026. It is supplemental to Fathom's standard terms, and a customer agrees to it by entering the Service Agreement. Fathom's HIPAA article says customers who prefer a signed BAA can reach out to Fathom support, and Fathom's pricing page lists "HIPAA: signed BAA" under Enterprise.

Fathom says its AI sub-processors may not train on user data, and that Fathom uses de-identified customer data to improve the accuracy of its own AI models unless you opt out. Bot-free capture is a beta feature for Mac.

What does Fathom cost?

Fathom Free is $0. Premium is $16 per user per month billed annually ($20 monthly). Team is $15 billed annually ($19 monthly) and Business is $25 billed annually ($34 monthly), both with a two-user minimum. Enterprise is "Talk to sales".

Circleback does not train on customer data, and its iOS and Android apps record in-person meetings as audio in the same workspace.

Read AI: HIPAA support on Enterprise+

Does Read AI support HIPAA?

Read AI's pricing page lists "Support for enabling HIPAA compliance in your Read workspace" on Enterprise+, and shows a dash for that row on every other plan (as of November 2026). The pricing page does not mention a BAA, so ask Read AI's sales team how the agreement is put in place.

What does Read AI cost?

Read AI Enterprise+ is $29.75 per user per month billed annually ($39.75 monthly), with "Talk to sales" on the card. Enterprise is $22.50 billed annually ($29.75 monthly) and requires 5 or more licenses.

Circleback's standard BAA text is public before anyone signs up, and the same Enterprise workspace covers the bot, the desktop app and the mobile apps.

Granola: a BAA for Enterprise customers

Does Granola sign a BAA?

Granola's security and privacy FAQ says "Granola is HIPAA compliant for Enterprise customers and can sign a Business Associate Agreement (BAA)" and that "HIPAA support is not available on Free or Business plans" (as of November 2026). It adds that the BAA currently covers the Granola desktop and laptop apps. Granola holds SOC 2 Type II, stores data on AWS in the United States and does not retain audio recordings. On Free and Business, anonymised data may be used for Granola's own model improvements unless each user opts out.

What does Granola cost?

Granola Enterprise is $35 per user per month on its pricing page, and Granola's help center says annual billing is limited to Enterprise contracts. Business is $14 per user per month.

Circleback's BAA covers the workspace, so meetings captured by the bot, the desktop app or the iOS and Android apps sit under the same agreement, and Circleback does not train on customer data.

Zoom AI Companion: AI features under Zoom's BAA

Is Zoom AI Companion covered by Zoom's BAA?

Zoom's BAA article says "Zoom enters into business associate agreements (BAAs) with customers, including those in the higher education and healthcare industries" and that "AI features, including ZoomMate features, are available to customers with BAAs in place with Zoom." It adds: "Certain AI features may not be available at this time for healthcare and higher education customers with BAAs in place." The article does not list which.

Editions and licensing

AI Companion is included with paid Zoom Workplace plans at no extra charge, per Zoom's pricing page. Workplace Pro is $14.16 per user per month billed annually ($16.99 monthly), and Business is $18.33 billed annually ($21.99 monthly). ZoomMate is a separate license at $16.67 per user per month billed annually or $20 monthly, per Zoom's AI pricing page.

Zoom also works outside Zoom meetings. My Notes takes notes across Zoom, Teams, Google Meet and other platforms with no bot, on a Pro, Business, Enterprise or My Notes standalone account with desktop app 6.7.5 or later (macOS 14.2 or later). Licensed users can also invite Zoom AI to Google Meet and Microsoft Teams meetings, where it joins as a participant. That needs Workplace Pro or higher and a connected calendar.

Zoom's pages also note these limits:

• Free Basic includes meeting summaries for 3 hosted meetings a month.
• My Notes with third-party platforms is not supported in the Zoom Workplace mobile app.
• My Notes captures system and microphone audio, so muting in the other app doesn't stop it, and Zoom tells users to follow applicable laws, which may include giving notice.

Circleback's bot joins Zoom, Google Meet, Microsoft Teams and Webex, and the desktop app records without a bot on macOS and Windows, all under one standard BAA.

Microsoft Teams Premium and Microsoft 365 Copilot: Microsoft's BAA

Does Microsoft's BAA cover Teams meeting recaps and Copilot?

Microsoft's HIPAA page says its HIPAA BAA is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates. The in-scope list for Office 365 names Microsoft Teams, Microsoft Copilot and Microsoft Copilot Chat. Microsoft says it can't use a customer's own BAA, and that using its services doesn't on its own achieve HIPAA compliance.

Editions and licensing

Teams intelligent recap (AI notes, tasks and chapters) needs a Microsoft 365 subscription with Teams plus a Teams Premium license or a Microsoft Copilot license. Audio recap needs a Copilot license, and transcription must be on. Microsoft 365 Copilot is $30.00 per user per month, paid yearly, and a separate qualifying Microsoft 365 plan is required.

Microsoft's pages also note these limits:

• For Teams events, recap is limited to organizers, co-organizers and presenters.
• In-person capture is a separate Copilot mobile app feature, Record. It needs a Microsoft 365 Copilot license and allows up to 120 minutes per recording.
• Microsoft says "Copilot does not notify other parties for you" when Record is used.

Circleback's bot joins Microsoft Teams as well as Zoom, Google Meet and Webex, and admins can set up single sign-on with Microsoft Entra ID.

Google Meet and Gemini in Google Workspace: Google's BAA

Is Google Meet covered by Google's BAA?

Google's HIPAA compliance page lists Google Meet and Gemini in Google Workspace among the Google Workspace services included in the Google Cloud BAA. It says Google enters into Business Associate Agreements as necessary under HIPAA, that complying with HIPAA is a shared responsibility between the customer and Google, and that the customer is responsible for evaluating its own HIPAA compliance.

Editions and licensing

"Take notes for me" in Google Meet needs an eligible Google Workspace edition or Google AI plan, and the meeting organizer must have an edition that includes it. On Google Workspace pricing, Gemini in Meet starts at Business Standard, $14 per user per month list. Google says the feature also works for meetings hosted on Zoom or Teams and for in-person meetings, from the Meet home screen on mobile or desktop.

Google's pages also note these limits:

• Notes go to a Google Doc in the organizer's Drive, with a summary, decisions and next steps.
• Google recommends meetings of 15 minutes to a maximum of 8 hours.
• Meet tells all meeting participants that notes are being taken. Admins can require explicit consent, which is off by default.

Circleback writes notes, action items and transcripts into one workspace for every meeting, whether the bot joined or the desktop app recorded it.

Avoma: HIPAA compliance on Enterprise

Is Avoma HIPAA compliant?

Avoma's pricing page lists "HIPAA Compliance" and "Data Retention Policies" on its Enterprise plan.

What does Avoma cost?

Avoma Enterprise is $39 per recorder seat per month, billed annually, with a minimum of 10 paid seats.

Circleback offers a standard BAA on Enterprise through click-through acceptance and backs it with SOC 2 Type II, encryption at rest and in transit, and no training on customer data.

Frequently asked questions

What is the best HIPAA compliant AI note taker?
Circleback is the best pick. Workspaces on the Enterprise plan can enter into Circleback's standard BAA to support HIPAA-compliant use, and a workspace admin accepts it in Settings → General. It covers internal and partner meetings recorded with the bot on Zoom, Google Meet, Microsoft Teams and Webex, or without a bot from the desktop app. Fireflies offers a BAA on Enterprise with Private Storage. Otter says HIPAA compliance is available for Enterprise and the BAA process starts with an account manager, and Fellow's pricing table lists "HIPAA / BAA compliance" on Enterprise. Read AI lists HIPAA support on Enterprise+, and Granola signs a BAA for Enterprise customers that covers its desktop and laptop apps. Fathom publishes a blanket BAA and lists a signed BAA under Enterprise. Zoom's BAA article says "AI features, including ZoomMate features, are available to customers with BAAs in place with Zoom." Microsoft's BAA covers Teams and Copilot by default, and Google's BAA covers Meet.

Is Circleback HIPAA compliant and does it offer a BAA?
Yes. Workspaces on the Enterprise plan can enter into a BAA to support HIPAA-compliant use of Circleback. A workspace admin turns on Business Associate Agreement in Settings → General and accepts Circleback's standard BAA, published at circleback.ai/baa. Compliance is shared: your organization configures retention and access and is responsible for using Circleback in a way that meets HIPAA. Circleback is not for substance use disorder records covered by 42 CFR Part 2.

What plan do HIPAA compliant AI note takers need for a BAA?
Circleback offers a standard BAA on Enterprise that a workspace admin accepts in Settings. Otter offers HIPAA on Enterprise, as an add-on. Fireflies needs Enterprise plus Private Storage and a signed BAA. Fellow's pricing table lists "HIPAA / BAA compliance" on Enterprise. Read AI lists HIPAA support on Enterprise+, and Granola's BAA is for Enterprise customers. Fathom publishes a blanket BAA and lists a signed BAA under Enterprise. Zoom's BAA article says "Zoom enters into business associate agreements (BAAs) with customers". Microsoft's BAA applies by default on Office 365, and Google's BAA covers Meet.

Does a BAA make an AI note taker HIPAA compliant?
No. A BAA sets the vendor's obligations as a business associate. The organization still runs its own compliance program, decides which meetings may include PHI and configures the tool. Circleback's HIPAA documentation, Microsoft's HIPAA page and Google's HIPAA page all say so.

Is a free AI note taker HIPAA compliant?
Circleback Free, Pro and Business can't turn on the BAA, so PHI belongs in an Enterprise workspace with the setting on. Fireflies, Otter, Fellow and Granola tie HIPAA to Enterprise, and Read AI to Enterprise+. Granola says Free and Business accounts should not be used to store or process PHI. Fathom's help article names no plan for its blanket BAA, and its pricing page lists the signed BAA under Enterprise, so ask Fathom first.

Does Fireflies sign a BAA?
Circleback's standard BAA is accepted by a workspace admin in Settings and stays in effect while the workspace is on Enterprise with the setting on. Fireflies signs one on Enterprise. Fireflies requires Private Storage and a BAA signed on its BAA contract page, and a downgrade or storage change disables HIPAA immediately.

Does Otter sign a BAA on Enterprise?
Circleback's standard BAA is accepted by a workspace admin in Settings. Otter's HIPAA article says HIPAA compliance is available for the Enterprise plan and that the BAA process starts with your account manager or Otter's sales team.

Does Fathom sign a BAA?
Circleback's standard BAA is public at circleback.ai/baa and is accepted in Settings by a workspace admin. Fathom publishes a blanket BAA at fathom.ai/baa that customers agree to through the Service Agreement, and offers a signed BAA on request through Fathom support. Its pricing page lists "HIPAA: signed BAA" under Enterprise.

Is Zoom AI Companion covered by Zoom's BAA?
Circleback covers Zoom, Google Meet, Microsoft Teams and Webex calls under one standard BAA. Zoom's BAA article says "AI features, including ZoomMate features, are available to customers with BAAs in place with Zoom", and also that "Certain AI features may not be available at this time for healthcare and higher education customers with BAAs in place."

Does Microsoft's BAA cover Teams meeting recaps and Microsoft 365 Copilot?
Circleback's bot joins Teams as well as Zoom, Google Meet and Webex. Microsoft's in-scope list for Office 365 names Microsoft Teams, Microsoft Copilot and Microsoft Copilot Chat, and the BAA is part of the Online Services Data Protection Addendum by default. AI meeting notes need a Teams Premium or Microsoft Copilot license, and the meeting must be transcribed.

Do these notetakers train AI models on meeting data?
Circleback does not train on customer data. Fireflies says customer data is never used for AI training. Fathom uses de-identified customer data to improve its own models unless you opt out. Otter's privacy policy describes training its AI technology on de-identified recordings and transcriptions. Granola says anonymised data may be used for its own model improvements on Free and Business unless each user opts out, and that third parties like OpenAI and Anthropic are never allowed to train on your data.

How these tools were compared

Each vendor's docs, BAA and compliance and security pages were checked, with no test lab and no test scores. Circleback's BAA at circleback.ai/baa, the Enable HIPAA compliance doc, fellow.ai/pricing, Otter's HIPAA help article, the Fireflies HIPAA page and HIPAA setup guide, fathom.ai/baa, Fathom's pricing page and HIPAA help article, Microsoft's HIPAA page, Google's HIPAA compliance page, Zoom's HIPAA Business Associate Agreement (BAA) article, zoom.us/pricing/aic and avoma.com/pricing were checked on October 27, 2026. Read AI's pricing page, Granola's security and privacy FAQ and Fellow's pricing page were checked on November 1, 2026, and Granola prices come from granola.ai/pricing as checked on October 16. Otter prices come from otter.ai/pricing as checked on October 15, 2026, Fireflies prices from fireflies.ai/pricing on October 16, and Zoom Workplace, Microsoft 365 Copilot and Google Workspace prices from their pricing pages on October 26. Circleback claims come from Circleback's product facts and docs. A signed BAA makes a notetaker eligible for PHI; it doesn't make your use of it compliant.