AI Meeting Notetakers That Are HIPAA Compliant and Sign a BAA (2026)

TL;DR: Circleback is HIPAA compliant on Enterprise, with a BAA included, and it's SOC 2 Type II. Otter signs a BAA only on its Enterprise plan. No notetaker is HIPAA compliant without a signed BAA.

"HIPAA compliant" is easy to put on a pricing page. For a healthcare team, the real question is narrower: will the vendor sign a Business Associate Agreement, and on which plan?

A BAA is the contract HIPAA requires between a covered entity and any vendor that creates, receives, maintains, or transmits protected health information (PHI) on its behalf. Every fact below comes from each vendor's own pricing page, help center, or trust page. We make Circleback, one of the tools on this list.

The short version

Circleback — best for a self-serve BAA with retention controls

Circleback includes HIPAA compliance, with its standard Business Associate Agreement, on the Enterprise plan. There's no paperwork cycle. A workspace admin who is authorized to sign for the company goes to Settings → General, turns on Business Associate Agreement, and accepts it. The BAA is then in effect for that workspace. The text is published at circleback.ai/baa, and the steps are in Enable HIPAA compliance.

Compliance is shared. You configure retention and access, and you're responsible for using Circleback in a way that meets HIPAA. Custom BAAs aren't offered, and Circleback isn't for 42 CFR Part 2 records (substance use disorder records). Circleback is SOC 2 Type II and EU-U.S. Data Privacy Framework certified, and it encrypts data at rest and in transit. It doesn't use customer data to train models, and it processes data in the United States (see Security).

Strengths: The BAA is self-serve, so PHI can be covered the day you turn it on. The desktop app records without a bot on macOS (Sonoma 14.2 or later) and Windows (11 or later) on every plan. The iOS and Android apps record in-person meetings (audio only). You can turn recording storage off and still get notes, action items, transcripts, and insights. When the bot joins with recordings off, it says in the meeting chat that no audio or video is being stored. On Business and up, admins set data retention with three sliders (recording, transcript, and all meeting data). They can also default or enforce recording, retention, joining, and sharing settings for everyone. Enterprise adds single sign-on (SAML or OIDC) and SCIM.

Limitations: The BAA is Enterprise only. Free, Pro, and Business don't include it, and it applies only while the workspace stays on Enterprise with the setting on. The BAA is standard and can't be changed. Data is processed in the United States only, with no EU hosting.

Who should pick Circleback: Healthcare and health-tech teams that want a BAA an admin can put in effect themselves. It also fits teams that record partner-hosted calls without a bot and want retention and recording settings enforced across the workspace.

Pricing: Free, Pro, Business, and Enterprise plans. HIPAA with the BAA is on Enterprise. See current pricing.

Fellow — best for transcript redaction alongside the BAA

Fellow lists "HIPAA / BAA compliance" only on its Enterprise plan. That plan costs $25 per user per month, billed annually, and starts at 10 users, according to Fellow's pricing page. There's no self-serve signature. Fellow's security and compliance article says it provides BAAs for organizations that require HIPAA compliance, and that you request one by contacting its support team.

Fellow has been through SOC 2 audits since 2020. Its latest SOC 2 Type II report covers the Security and Confidentiality criteria.

Strengths: Transcript and meeting note redaction on Business and Enterprise. Botless recording from the Mac and Windows desktop app works on any meeting platform (Slack huddles, Microsoft Teams, dialers, Google Meet, and Zoom). It still produces an audio recording, a transcript, and AI notes.

Limitations: The BAA requires Enterprise with a 10-user minimum, so the smallest contract that includes it is $250 a month, billed annually. You request the BAA through support. Fellow's security article doesn't say whether customer data is used to train AI models, so ask for that commitment in writing.

Who should pick Fellow: Teams of 10 or more that want transcript and note redaction together with the BAA.

Pricing: Free, Team ($7-11/user/mo), Business ($15-23/user/mo), and Enterprise ($25/user/mo, billed annually, starting at 10 users).

Otter — best for live transcription under an Enterprise agreement

Otter offers HIPAA compliance only on its Enterprise plan. Otter's pricing page lists it as "HIPAA compliance (add-on)". You start the BAA by contacting your account manager or Otter's sales team, according to its HIPAA article. The same article says Otter becomes a business associate only when a signed BAA is in place, so the BAA must be executed before any PHI is handled.

Otter also spells out what the customer must configure. Disable public and link-based sharing, control when the Otter Notetaker auto-joins, enforce two-factor authentication or SSO, and remove departing users promptly.

Strengths: Live transcription, which the pricing page lists on every plan, and SOC 2 Type II. Enterprise workspaces are opted out of AI model training by default, and Enterprise admins can request a custom data retention policy. The desktop app for Mac and Windows adds botless and automatic recording for Zoom, Microsoft Teams, and Google Meet calls.

Limitations: On plans below Enterprise, Otter de-identifies user data and uses it to train its models. That rules those plans out for PHI. HIPAA is listed as an add-on, so ask what it costs on top of Enterprise. SSO and SCIM need a minimum 100-user license. Custom retention is set by Otter through your account manager.

Who should pick Otter: Larger healthcare organizations that want live transcription, have an Enterprise agreement, and can apply the controls Otter's HIPAA article requires.

Pricing: Free (Basic), Pro ($8.33/user/mo annual or $16.99 monthly), Business ($19.99/user/mo annual or $30 monthly, as of October 2026), and Enterprise (custom, with HIPAA as an add-on).

Fireflies — best for choosing where PHI is stored

Fireflies offers HIPAA compliance only on its Enterprise plan, at $39 per seat per month, billed annually. Two things have to be in place: Private Storage turned on, and a BAA signed on Fireflies' BAA page. Its HIPAA setup guide says both are required, and one without the other won't enable HIPAA. A plan downgrade or storage change disables it immediately.

The BAA is signed online. You enter your legal counterparty name and effective date, then sign, and the page notes that Private Storage must be on for the BAA to take effect. Private Storage lets your organization choose where recordings, transcripts, and related files are stored.

Strengths: Fireflies says meeting content is never used to train any AI models, internally or externally, and that third-party vendors don't store your data after processing. Enterprise adds custom data retention, SSO, and SCIM. The desktop app can record without a bot from system audio on Google Meet, Zoom, Microsoft Teams, and phone calls.

Limitations: Bot-free mode saves no separate audio or video files and labels speakers Speaker 1 and Speaker 2. HIPAA depends on three conditions staying true at once: Enterprise, Private Storage, and a signed BAA. A billing or storage change can end coverage quietly. Fireflies' Enterprise plan page says HIPAA is available upon request, and nothing below Enterprise includes a BAA.

Who should pick Fireflies: Teams on Enterprise that want to choose the storage location for PHI and sign the BAA online.

Pricing: Free, Pro ($10-18/user/mo), Business ($19-29/user/mo), and Enterprise ($39/user/mo, billed annually), per Fireflies' pricing guide.

Fathom — best for a published blanket BAA on a low-cost plan

Fathom publishes a blanket BAA at fathom.ai/baa that is supplemental to its standard terms. Its HIPAA article says customers who prefer a signed BAA between their organization and Fathom can email help@fathom.video. That article calls Fathom "fully HIPAA compliant" and names no plan. Fathom's pricing page, though, lists "HIPAA: signed BAA" as an Enterprise feature. Ask Fathom in writing which plan your BAA covers before any PHI goes in.

Fathom is SOC 2 Type II and stores all data in the United States. It says its AI sub-processors (Anthropic, OpenAI, and Google) are contractually not permitted to train on user data, per its security article.

Strengths: The free plan includes unlimited recordings and transcripts, and the BAA path doesn't start with a sales call. Bot-free video capture is available for Zoom on Mac, and Fathom's pricing page labels bot-free capture as in beta. Enterprise adds SSO, SCIM, and custom retention.

Limitations: Fathom uses de-identified customer data to improve its own AI models unless each user opts out in My Settings. Team Edition admins can opt out all users, so set that before the first recording. Bot-free capture for Google Meet is still "coming" through the Chrome extension, and Microsoft Teams support is in development, per the Fathom 3.0 rollout article. Most partner calls still use the bot. Custom retention is Enterprise only.

Who should pick Fathom: Solo clinicians, small practices, and health-tech startups that want a published blanket BAA on a low-cost plan. A signed BAA is listed under Enterprise.

Pricing: Free, Premium ($16-20/user/mo), Team ($15-19/user/mo), Business ($25-34/user/mo), and Enterprise (custom). Team, Business, and Enterprise have a two-user minimum.

Zoom AI Companion — best for organizations already on Zoom Workplace

Zoom has a standard BAA. Pro customers add it at checkout or later under Plans and Billing → Plan Management, and Business, Business Plus, and Enterprise customers sign it through Sales. Zoom's BAA article says AI features, including ZoomMate features, are available to customers with BAAs in place. It adds that certain AI features may not be available at this time for healthcare and higher education customers with BAAs, without listing which.

Zoom's compliance FAQ notes there's no regulatory-backed HIPAA certification. Zoom aligns its controls to the HITRUST CSF and offers a SOC 2 + HITRUST report. In June 2026, Zoom retired the AI Companion name. Meeting summaries and transcription stay built into Zoom Workplace with eligible paid plans, and ZoomMate is the separately licensed agent product.

Strengths: Summaries are native, so nothing joins a Zoom meeting. Pro, Business, and Enterprise include unlimited meeting summaries, per Zoom's pricing page. Zoom says it doesn't use customers' audio, video, chat, screen sharing, attachments, or other communications-like content to train its own or third-party AI models. My Notes transcribes third-party apps such as Microsoft Teams on the desktop, from system and microphone audio, on Pro, Business, and Enterprise accounts.

Limitations: For Google Meet and Microsoft Teams meetings, Zoom AI joins as a participant, which needs a Workplace Pro or higher account and a connected calendar. The free Basic plan has summaries for 3 hosted meetings a month and no BAA. Zoom's BAA article doesn't list which AI features are restricted for BAA accounts. ZoomMate is a separate license at $16.67 per user per month, billed annually ($20 monthly), per Zoom's AI pricing page.

Who should pick Zoom AI Companion: Healthcare organizations that host most meetings in Zoom and already hold, or can add, Zoom's BAA on a paid Workplace plan.

Pricing: Free (Basic), Pro ($14.16-16.99/user/mo), Business ($18.33-21.99/user/mo), and Enterprise (custom). ZoomMate is $16.67-20/user/mo.

Microsoft Teams Premium and Microsoft 365 Copilot — best for Microsoft 365 organizations

Microsoft's HIPAA Business Associate Agreement comes through its Online Services Data Protection Addendum, by default, for all customers that are covered entities or business associates. The in-scope list for commercial Office 365 on Microsoft's HIPAA page names Microsoft Teams, Microsoft Copilot, and Microsoft Copilot Chat. There's nothing extra to sign, and Microsoft says it can't use a customer's own BAA.

Microsoft 365 Copilot is now named Microsoft Copilot, with no changes to security, compliance, and privacy, per its privacy page. AI meeting notes need one of two licenses on top of Microsoft 365. One is Teams Premium, a per-user add-on with AI-generated notes and tasks from meetings. The other is the Copilot license, which the intelligent recap article says also includes recap. Either way, the meeting must be transcribed.

Strengths: Recap works from the Teams transcript, so nothing joins the call. Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, and admins can set retention policies for Copilot interactions in Microsoft Purview. Teams Premium lets organizers control who can record and transcribe. It can also block copying and forwarding of captions, transcripts, and recaps.

Limitations: Only Teams meetings get recap, so a partner's Zoom or Google Meet call isn't covered. AI notes mean a second license on top of the Microsoft 365 plan. Microsoft's own FAQ says having a BAA doesn't, on its own, achieve HIPAA compliance. Microsoft also changed which features Teams Premium includes on April 1, 2026, so check the current feature table.

Who should pick Microsoft Teams Premium or Copilot: Organizations whose internal and partner meetings happen in Teams and that already have a commercial Microsoft 365 agreement.

Pricing: Teams Premium is a per-user add-on to Microsoft 365, priced on Microsoft's site. Microsoft 365 Copilot is $30.00 per user per month, paid yearly, and requires a qualifying Microsoft 365 plan.

Avoma — best for capturing calls through cloud recording

Avoma lists HIPAA compliance only on its Enterprise plan, which costs $39 per user per month and requires 10 paid seats, per Avoma's pricing page. Its security checklist says HIPAA compliance is supported via a BAA on enterprise plans. Avoma's help center says it is compliant with HIPAA, SOC 2 Type II, and GDPR.

Enterprise also adds custom data retention policies, single sign-on (SAML or OIDC), SCIM provisioning, and mutually signed DPAs. Avoma says customer meeting data is never used to train AI models.

Strengths: Viewers and collaborators are free on every plan. Avoma can record without its bot through each platform's cloud recording: Google Meet on supported Google Workspace editions, Zoom with a paid Zoom license, and Microsoft Teams with a Teams cloud recording license. Its recording page lists these alongside the bot.

Limitations: The 10-seat minimum puts the entry point for a BAA at $390 a month, and Enterprise is $39 whether billed monthly or annually. Conversation Intelligence and Revenue Intelligence are paid add-ons, at $29 per user per month, billed annually, each.

Who should pick Avoma: Provider groups, payers, and health-tech teams with at least 10 people recording customer or partner calls. Free viewer seats let the rest of the organization read the notes.

Pricing: Startup ($19-29/user/mo), Organization ($29-39/user/mo), and Enterprise ($39/user/mo, 10-seat minimum). Intelligence add-ons cost extra.

A BAA is where compliance starts

A signed BAA makes a notetaker eligible for PHI. It doesn't make your use of it compliant. Your own program still decides which meetings may include PHI, who can see the notes, and how long anything is kept.

So the practical questions are short. Is the BAA on a plan you'll actually buy? Can an admin keep recordings off and set retention for everyone? Does the vendor train on your meetings? The sections above answer all three for each tool, with a link to the vendor's own page behind every answer.

If two tools fit, run both on the same internal meeting before any PHI is involved, and compare the notes side by side. That will tell you more than any comparison post can, including this one.

Frequently asked questions

Does signing a BAA make our use of an AI notetaker HIPAA compliant?
No. A BAA sets the vendor's obligations as a business associate. Your organization still runs its own compliance program, decides which meetings may contain PHI, and configures the tool. Circleback's HIPAA documentation and Microsoft's HIPAA FAQ both say this. Otter's HIPAA article lists the settings it expects customers to apply, such as disabling public and link-based sharing.

Which AI notetakers sign a BAA without an Enterprise plan?
Zoom adds its standard BAA at checkout on the Pro plan. Microsoft's BAA applies by default through its Data Protection Addendum on commercial Microsoft 365. Fathom publishes a blanket BAA and signs one on request, though its pricing page lists the signed BAA under Enterprise. MeetGeek says it offers BAAs with any annual plan. Circleback, Fellow, Otter, Fireflies, and Avoma sign only on Enterprise, and Read AI lists HIPAA compliance on Enterprise+ ($29.75 per user per month, billed annually, with a five-license minimum).

Can we use a free AI notetaker plan for meetings that include PHI?
Not under a BAA from most vendors. Circleback Free, Fellow Free, Otter Basic, and Fireflies Free don't include one, and Zoom's BAA is for paid Workplace plans. Fathom's blanket BAA is supplemental to its standard terms and names no plan, so ask Fathom first. Training policy matters too: Otter trains on de-identified data outside Enterprise, and Fathom does unless you opt out.

Is Zoom AI Companion covered by Zoom's BAA?
Yes. Zoom's BAA article says AI features, including ZoomMate features, are available to customers with BAAs in place. The caveat is that certain AI features may not be available for healthcare and higher education customers with BAAs. Zoom retired the AI Companion name in June 2026. The built-in summaries are part of Zoom Workplace, and ZoomMate is a separate license.

Does Microsoft's BAA cover Teams meeting recaps and Microsoft 365 Copilot?
Yes. Microsoft's in-scope list for commercial Office 365 names Microsoft Teams, Microsoft Copilot, and Microsoft Copilot Chat, and the BAA is part of the Online Services Data Protection Addendum by default. Teams Premium isn't named separately on that list, because it's an add-on license to Teams. AI-generated meeting notes require a Teams Premium or Microsoft Copilot license, and the meeting must be transcribed.

Do these notetakers train AI models on our meetings?
Circleback, Fireflies, Avoma, and Zoom say they don't use customer meeting content to train models. Microsoft says prompts, responses, and Graph data aren't used to train foundation LLMs. Otter trains its models on de-identified data on ordinary plans and opts Enterprise workspaces out by default. Fathom uses de-identified customer data to improve its proprietary models unless users, or Team Edition admins, opt out.

Circleback includes HIPAA compliance with a BAA on Enterprise, and a workspace admin can turn it on in Settings. See current plans.

Last updated October 2026. Pricing and features change frequently — check each tool's website for current information.