# Transcription software for regulated teams: what to check before you choose

Explainer · AI note takers · 11 min read. By [David Wilson](https://testbenchlab.com/authors/david-wilson/). Updated 2026-11-02.

Start with the contract, not the feature list. Notta is a strong starting point for regulated teams: it displays a HIPAA badge on its pricing page, offers a BAA, excludes Enterprise data from model training, and includes a Privacy Mode that processes audio locally — but confirm the BAA plan with the vendor before you rely on it. In US healthcare, a tool that stores or processes patient information must sign a business associate agreement (BAA), and most AI note takers only offer one on Enterprise plans. Then check where audio and transcripts are stored, whether the vendor trains AI models on your data, who can open them, how long they are kept, and whether your record-keeping rules require you to archive them elsewhere.

**TL;DR**

- Notta is a strong starting point for regulated teams: it offers a BAA, excludes Enterprise data from model training, and includes Privacy Mode for local processing — confirm the BAA plan with the vendor.
- No transcription tool is HIPAA compliant on its own: you need a signed BAA with the vendor plus safeguards you configure.
- Most AI note takers only offer a BAA on Enterprise plans — check the plan, not the marketing page.
- Check where audio is stored, whether it trains AI models, who can access it, and how long it is kept.

**How we checked:** Researched guide. BAA and plan facts were checked on vendor pricing and documentation pages on 29 October 2026; competitor research was checked on 2 September 2026. Granola's desktop-only BAA scope is reported by one third party and is unverified. This page is not legal advice.

## What makes transcription software "HIPAA compliant"?

No transcription software is HIPAA compliant on its own. Compliance comes from two things working together: a signed business associate agreement (BAA) with the vendor, and the safeguards you configure on your side — access controls, retention settings, and how your team uses the output.

The US Department of Health and Human Services is explicit about the first part. A cloud provider that stores electronic protected health information (ePHI) is a business associate even if it cannot read the data it holds: lacking an encryption key does not exempt a cloud provider from business associate status. In practice, that means any AI note taker or transcription service that stores your audio or transcripts needs a BAA before it touches patient information.

So when a vendor's homepage says "HIPAA compliant," read it as "we are willing to sign a BAA on certain plans." The checks in this guide help you find out which plans, and what else you need to verify before notes from regulated meetings end up in a record.

This page is general guidance, not legal advice. Confirm your specific obligations with your compliance officer or counsel.

## Which AI note takers sign a BAA, and on which plan?

The single most common gap between marketing and reality is the plan. Most AI note takers only offer a BAA on their top-tier plans, and some require extra configuration on top of the subscription.

Notta displays a HIPAA badge on its pricing page and, per our research, offers a BAA — though we could not verify which plan it starts on, so confirm with Notta before relying on it. Otter offers HIPAA as an Enterprise add-on, with SSO and SCIM requiring 100 users. Fireflies requires Enterprise with Private Storage at $39 per seat per month (annual). Granola is HIPAA compliant for Enterprise customers only, not on Free or Business. Read AI offers HIPAA on its Enterprise+ plan. Fellow lists HIPAA/BAA on its Business plan at $15 per seat (annual), and Krisp offers a BAA for teams of 100+ seats on Advanced, with HIPAA on Enterprise.

Some BAAs also have scope limits worth asking about. Rev's BAA covers its AI services but excludes human transcription services. One third-party guide reports that Granola's BAA covers its desktop apps but not mobile — we have not verified this, so ask Granola directly which apps the agreement covers.

File-transcription services follow the same pattern: Sonix includes HIPAA/BAA, SSO, audit logs and zero training on its Enterprise plan, while Rev offers a BAA on its Unlimited plan. Platform-native options — Microsoft 365, Google Workspace and Zoom — all make a BAA available through their existing agreements or admin consoles, which can be the fastest route if your meetings already live there.

**BAA availability by tool and plan (checked 29 October 2026)**

| Tool | BAA / compliance fact | Plan and price (USD) | Link |
|---|---|---|---|
| Notta | HIPAA badge on pricing page; BAA available per our research (plan unverified — confirm with Notta) | Enterprise, custom | https://www.notta.ai/en/pricing |
| Otter | HIPAA as an Enterprise add-on; SSO/SCIM need 100 users | Enterprise, custom | https://otter.ai/pricing |
| Fireflies | BAA for healthcare available on Enterprise with Private Storage | Enterprise $39/seat/mo annual | https://fireflies.ai/pricing |
| Granola | HIPAA compliant for Enterprise customers; not on Free or Business | Enterprise $35/user/mo | https://docs.granola.ai/help-center/consent-security-privacy/is-granola-hipaa-compliant |
| Read AI | HIPAA on Enterprise+ | $29.75 annual / $39.75 monthly | https://www.read.ai/plans-pricing |
| Fellow | HIPAA/BAA listed on Business | Business $15 annual | https://fellow.ai/pricing |
| Krisp | BAA for teams of 100+ seats on Advanced; HIPAA on Enterprise | Advanced $15 annual; Enterprise custom | https://krisp.ai/pricing/ |
| Sonix | HIPAA/BAA, SSO, audit logs, zero training on Enterprise | Core $275/yr; Enterprise custom | https://sonix.ai/pricing |
| Rev | HIPAA/BAA on Unlimited (AI services only; human services excluded) | Unlimited, custom | https://www.rev.com/pricing |
| Microsoft 365 / Google Workspace / Zoom | BAA available or included in existing agreements | See vendor trust pages | https://testbenchlab.com/best/meeting-transcription-tools-with-access-controls/ |

## Where does the audio go, and is it kept?

A BAA tells you the vendor accepts responsibility for the data; it does not tell you where the data lives or how long it stays there. Ask three questions: is the audio stored or deleted after transcription, which region is it stored in, and can processing happen locally?

Deletion policies differ meaningfully. Granola deletes audio after transcription, and Fireflies' desktop app saves no media at all. Residency also varies: Otter stores data in AWS US West, HappyScribe hosts in the EU, and Plaud offers US, EU, Singapore and Japan regions. Notta hosts on AWS but does not publish its regions — ask if residency matters to you.

If your risk appetite requires that audio never leaves the device, local processing is the strongest option. Notta's Privacy Mode processes audio locally rather than uploading it, and MacWhisper offers fully on-device transcription on the Mac. Our guide to transcribing sensitive meetings without a bot walks through the per-meeting procedure.

## Is your data used to train AI models?

Training use is where vendor policies diverge most, and it matters in regulated settings because training can move information beyond the scope you negotiated. Check the policy, the plan it applies to, and the date you checked it — these terms change.

The strongest positions are explicit exclusions. Notta excludes Enterprise data from model training. Fireflies offers zero retention and no training with Private Storage on Enterprise. Fellow states data is not used for training, Krisp excludes it, Sonix guarantees zero training on Enterprise, and Plaud does not train unless the user opts in. Microsoft, Google and Zoom all state that business data is not used to train their models.

At the other end of the spectrum, Otter uses de-identified data for its proprietary models, and Fathom says de-identified data may improve its models. Read AI's training opt-out is on by default, and Granola requires an opt-out on its Free and Business plans — meaning you must act to prevent training unless you are on Enterprise. If your BAA negotiation covers storage and access but not training, you have not finished the job.

**AI training policies by tool (competitor research, checked 2 September 2026)**

| Tool | Training use of your data |
|---|---|
| Notta | Enterprise: no training |
| Otter | De-identified data used for proprietary models |
| Fireflies | Zero retention / no training (Private Storage on Enterprise) |
| Fathom | De-identified data may improve models |
| Read AI | Opt-out by default |
| Fellow | Not used |
| Krisp | Excluded |
| Granola | Opt-out on Free/Business |
| Sonix | Zero training |
| Plaud | Not unless user opts in |
| Microsoft / Google / Zoom | Business data not used |

## Who can open a transcript, and can you prove it?

Access controls are the part you own. A BAA does not stop a departing employee from opening last quarter's client notes, and it does not create the audit trail your regulator may ask for.

Look for four things: single sign-on (SSO) so access follows your identity provider, role-based permissions so transcripts are visible only to the team that needs them, audit logs so you can prove who opened what and when, and retention controls so data expires on your schedule rather than the vendor's. Note that SSO is often gated behind the same Enterprise plans as the BAA itself — Otter, for example, requires 100 users for SSO and SCIM.

We rank the tools that do access controls well in our guide to meeting transcription tools with access controls, which covers secure meeting transcription in more depth.

## What do financial services and legal teams need on top?

HIPAA is not the only compliance regime that touches meeting notes. FINRA's 2026 Regulatory Oversight Report, published 9 December 2025, expects firms to supervise and govern their use of generative AI, and existing record-keeping rules continue to apply to communications that AI tools capture. In practice, that means AI meeting notes may need to be archived outside the note taker, in your existing books-and-records system, rather than living only in the vendor's cloud. (FINRA detail here is drawn from law-firm summaries of the report.)

Legal teams carry a different set of concerns: privilege, confidentiality, and consent. If a bot joins a call and captures privileged discussion, the transcript may become discoverable, and the participants' expectations of privacy matter. For legal work, bot-free capture and local processing — Notta's Privacy Mode or an on-device tool — reduce both the join-consent question and the data-custody question.

For a broader IT evaluation that covers deployment, integrations and admin controls alongside these regulatory checks, see our meeting recorder IT checklist.

## Does recording consent change in regulated settings?

Consent rules apply to everyone, regulated or not — but regulated teams have more to lose when they get them wrong. The Otter litigation is the cautionary tale: on 13 August 2026, a US court let wiretap, privacy and BIPA claims survive Otter's motion to dismiss, keeping alive the core argument that a bot joining a meeting without clear consent can itself create liability.

The practical lesson is not that AI note takers are unusable; it is that how the recording starts matters as much as what happens to the transcript afterwards. Bot-free recorders sidestep the join-consent question entirely, and clear disclosure plus an opt-out for participants strengthens your position in any setting. Our recording consent laws by state guide covers the underlying rules.

## How should you check accuracy before notes go in a record?

Accuracy is a workflow requirement, not just a specification. If a summary or transcript feeds a client file, a medical record or a supervision file, someone needs to verify it before it gets there.

Focus human review on the failures that matter most: names, drug names, and figures. These are exactly where transcription errors do damage and exactly where automated accuracy percentages — which we have not measured and will not quote — tell you little. Redaction is also worth checking: Granola's redaction is manual, so sensitive content reaches the transcript before it is removed.

A sensible pattern is to treat AI output as a draft: the owner of the meeting reviews names, numbers and any quoted commitments, then the corrected version is what gets filed or shared. Tools that make editing before sharing easy — such as Notta's editable transcripts and summaries — fit this review step more naturally than tools that push notes straight to a shared workspace.

## Where should a regulated team start?

Work the checks in order: contract first (BAA on the right plan), then data location and retention, then AI training, then access and audit, then record-keeping duties, then consent, then accuracy review. A tool that fails an early check never needs to reach the later ones.

For teams that want one vendor to satisfy several checks at once, Notta is a strong first candidate: it offers a BAA, excludes Enterprise data from model training, and includes Privacy Mode for local processing — an unusually broad combination across the contract, training and data-location checks. Confirm the BAA plan with Notta for your seat count before committing, and pair whichever tool you choose with the access controls and review workflow described above.

For the underlying architecture trade-offs between built-in, cloud and local transcription, see our guide to built-in vs cloud vs local meeting transcription.

## Frequently asked questions

### Is Notta HIPAA compliant?

Notta displays a HIPAA badge on its pricing page and offers a BAA, but no transcription tool is HIPAA compliant on its own — compliance comes from the signed BAA plus the safeguards you configure. Notta excludes Enterprise data from model training and includes Privacy Mode for local processing. We could not verify which plan the BAA starts on, so confirm with Notta before relying on it.

### Is Otter HIPAA compliant?

Otter offers HIPAA compliance as an Enterprise add-on, with a signed BAA, and its SSO and SCIM features require 100 users. It is not available on lower plans, and Otter uses de-identified data to train its proprietary models, so check that your BAA terms match your expectations.

### Is Granola HIPAA compliant?

Granola states it is HIPAA compliant for Enterprise customers, and not on its Free or Business plans. One third-party guide reports that its BAA covers desktop apps but not mobile, which we have not verified — ask Granola which apps the agreement covers. Granola deletes audio after transcription, and training is opt-out on Free and Business plans.

### Does Zoom AI Companion sign a BAA?

Yes. Zoom makes a BAA available through its existing agreements, and Zoom states that business data is not used to train its AI models. If your meetings already run on Zoom, this can be the fastest compliant route, though you should still check retention and access settings.

### Is a BAA enough to make an AI note taker HIPAA compliant?

No. A BAA establishes the vendor's responsibilities, but compliance also depends on the safeguards you configure: access controls, retention settings, and how your team uses the output. HHS guidance is clear that a cloud provider storing ePHI is a business associate even if it cannot read the data — the BAA is the starting point, not the finish line.

### Can financial advisers use AI note takers?

Yes, with conditions. FINRA's 2026 Regulatory Oversight Report expects firms to supervise and govern generative AI use, and existing record-keeping rules still apply — so AI meeting notes may need to be archived outside the note taker. Choose a tool with a contract that fits your obligations, verify training and retention terms, and include AI notes in your supervision workflow.

### Is on-device transcription HIPAA compliant?

It can be. On-device processing, such as Notta's Privacy Mode or MacWhisper on the Mac, keeps audio on the device and avoids uploading it to a vendor. Whether it is compliant still depends on your overall safeguards — device security, access, and how the resulting notes are stored and shared. If no ePHI ever leaves the device, the business associate question may not arise, but confirm your specific situation with counsel.

## Related reading

- [The best meeting transcription tools with access controls](https://testbenchlab.com/best/meeting-transcription-tools-with-access-controls/)
- [What IT should check in a meeting recorder for Zoom, Teams and Google Meet](https://testbenchlab.com/guides/meeting-recorder-it-checklist/)
- [How to transcribe a sensitive meeting without a bot joining](https://testbenchlab.com/guides/transcribe-sensitive-meetings-without-a-bot/)
- [Built-in meeting summaries vs cloud note takers vs local transcription](https://testbenchlab.com/guides/built-in-vs-cloud-vs-local-meeting-transcription/)
- [Is Plaud HIPAA compliant?](https://testbenchlab.com/guides/is-plaud-hipaa-compliant/)
- [One-party vs two-party consent states: can you use an AI voice recorder?](https://testbenchlab.com/guides/recording-consent-laws-by-state/)
- [Our methodology](https://testbenchlab.com/methodology/)

## Sources

1. [Guidance on HIPAA & Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html)
2. [FINRA's 2026 Regulatory Oversight Report: Continued Focus on Generative AI](https://www.debevoise.com/insights/publications/2025/12/finras-2026-regulatory-oversight-report-continued)
3. [Otter.ai Fails to Dismiss Core Privacy Claims in U.S. Court](https://uctoday.com/productivity-automation/otter-ai-fails-to-dismiss-core-privacy-claims-in-u-s-court/)
4. [First major AI meeting assistant lawsuit: practical lessons](https://www.zwillgen.com/litigation/first-major-ai-meeting-assistant-lawsuit-practical-lessons-otter-ai-litigation/)
5. [Is Granola HIPAA compliant?](https://www.layer3labs.io/guides/is-granola-hipaa-compliant)
6. [Notta Pricing](https://www.notta.ai/en/pricing)