Transcription software for regulated teams: what to check before you choose

What makes transcription software "HIPAA compliant"?

No transcription software is HIPAA compliant on its own. Compliance comes from two things working together: a signed business associate agreement (BAA) with the vendor, and the safeguards you configure on your side — access controls, retention settings, and how your team uses the output.

The US Department of Health and Human Services is explicit about the first part. A cloud provider that stores electronic protected health information (ePHI) is a business associate even if it cannot read the data it holds: lacking an encryption key does not exempt a cloud provider from business associate status. In practice, that means any AI note taker or transcription service that stores your audio or transcripts needs a BAA before it touches patient information.

So when a vendor's homepage says "HIPAA compliant," read it as "we are willing to sign a BAA on certain plans." The checks in this guide help you find out which plans, and what else you need to verify before notes from regulated meetings end up in a record.

This page is general guidance, not legal advice. Confirm your specific obligations with your compliance officer or counsel.

Which AI note takers sign a BAA, and on which plan?

The single most common gap between marketing and reality is the plan. Most AI note takers only offer a BAA on their top-tier plans, and some require extra configuration on top of the subscription.

Notta displays a HIPAA badge on its pricing page and, per our research, offers a BAA — though we could not verify which plan it starts on, so confirm with Notta before relying on it. Otter offers HIPAA as an Enterprise add-on, with SSO and SCIM requiring 100 users. Fireflies requires Enterprise with Private Storage at $39 per seat per month (annual). Granola is HIPAA compliant for Enterprise customers only, not on Free or Business. Read AI offers HIPAA on its Enterprise+ plan. Fellow lists HIPAA/BAA on its Business plan at $15 per seat (annual), and Krisp offers a BAA for teams of 100+ seats on Advanced, with HIPAA on Enterprise.

Some BAAs also have scope limits worth asking about. Rev's BAA covers its AI services but excludes human transcription services. One third-party guide reports that Granola's BAA covers its desktop apps but not mobile — we have not verified this, so ask Granola directly which apps the agreement covers.

File-transcription services follow the same pattern: Sonix includes HIPAA/BAA, SSO, audit logs and zero training on its Enterprise plan, while Rev offers a BAA on its Unlimited plan. Platform-native options — Microsoft 365, Google Workspace and Zoom — all make a BAA available through their existing agreements or admin consoles, which can be the fastest route if your meetings already live there.

BAA availability by tool and plan (checked 29 October 2026)

Where does the audio go, and is it kept?

A BAA tells you the vendor accepts responsibility for the data; it does not tell you where the data lives or how long it stays there. Ask three questions: is the audio stored or deleted after transcription, which region is it stored in, and can processing happen locally?

Deletion policies differ meaningfully. Granola deletes audio after transcription, and Fireflies' desktop app saves no media at all. Residency also varies: Otter stores data in AWS US West, HappyScribe hosts in the EU, and Plaud offers US, EU, Singapore and Japan regions. Notta hosts on AWS but does not publish its regions — ask if residency matters to you.

If your risk appetite requires that audio never leaves the device, local processing is the strongest option. Notta's Privacy Mode processes audio locally rather than uploading it, and MacWhisper offers fully on-device transcription on the Mac. Our guide to transcribing sensitive meetings without a bot walks through the per-meeting procedure.

Is your data used to train AI models?

Training use is where vendor policies diverge most, and it matters in regulated settings because training can move information beyond the scope you negotiated. Check the policy, the plan it applies to, and the date you checked it — these terms change.

The strongest positions are explicit exclusions. Notta excludes Enterprise data from model training. Fireflies offers zero retention and no training with Private Storage on Enterprise. Fellow states data is not used for training, Krisp excludes it, Sonix guarantees zero training on Enterprise, and Plaud does not train unless the user opts in. Microsoft, Google and Zoom all state that business data is not used to train their models.

At the other end of the spectrum, Otter uses de-identified data for its proprietary models, and Fathom says de-identified data may improve its models. Read AI's training opt-out is on by default, and Granola requires an opt-out on its Free and Business plans — meaning you must act to prevent training unless you are on Enterprise. If your BAA negotiation covers storage and access but not training, you have not finished the job.

AI training policies by tool (competitor research, checked 2 September 2026)

Who can open a transcript, and can you prove it?

Access controls are the part you own. A BAA does not stop a departing employee from opening last quarter's client notes, and it does not create the audit trail your regulator may ask for.

Look for four things: single sign-on (SSO) so access follows your identity provider, role-based permissions so transcripts are visible only to the team that needs them, audit logs so you can prove who opened what and when, and retention controls so data expires on your schedule rather than the vendor's. Note that SSO is often gated behind the same Enterprise plans as the BAA itself — Otter, for example, requires 100 users for SSO and SCIM.

We rank the tools that do access controls well in our guide to meeting transcription tools with access controls, which covers secure meeting transcription in more depth.

What do financial services and legal teams need on top?

HIPAA is not the only compliance regime that touches meeting notes. FINRA's 2026 Regulatory Oversight Report, published 9 December 2025, expects firms to supervise and govern their use of generative AI, and existing record-keeping rules continue to apply to communications that AI tools capture. In practice, that means AI meeting notes may need to be archived outside the note taker, in your existing books-and-records system, rather than living only in the vendor's cloud. (FINRA detail here is drawn from law-firm summaries of the report.)

Legal teams carry a different set of concerns: privilege, confidentiality, and consent. If a bot joins a call and captures privileged discussion, the transcript may become discoverable, and the participants' expectations of privacy matter. For legal work, bot-free capture and local processing — Notta's Privacy Mode or an on-device tool — reduce both the join-consent question and the data-custody question.

For a broader IT evaluation that covers deployment, integrations and admin controls alongside these regulatory checks, see our meeting recorder IT checklist.

Does recording consent change in regulated settings?

Consent rules apply to everyone, regulated or not — but regulated teams have more to lose when they get them wrong. The Otter litigation is the cautionary tale: on 13 August 2026, a US court let wiretap, privacy and BIPA claims survive Otter's motion to dismiss, keeping alive the core argument that a bot joining a meeting without clear consent can itself create liability.

The practical lesson is not that AI note takers are unusable; it is that how the recording starts matters as much as what happens to the transcript afterwards. Bot-free recorders sidestep the join-consent question entirely, and clear disclosure plus an opt-out for participants strengthens your position in any setting. Our recording consent laws by state guide covers the underlying rules.

How should you check accuracy before notes go in a record?

Accuracy is a workflow requirement, not just a specification. If a summary or transcript feeds a client file, a medical record or a supervision file, someone needs to verify it before it gets there.

Focus human review on the failures that matter most: names, drug names, and figures. These are exactly where transcription errors do damage and exactly where automated accuracy percentages — which we have not measured and will not quote — tell you little. Redaction is also worth checking: Granola's redaction is manual, so sensitive content reaches the transcript before it is removed.

A sensible pattern is to treat AI output as a draft: the owner of the meeting reviews names, numbers and any quoted commitments, then the corrected version is what gets filed or shared. Tools that make editing before sharing easy — such as Notta's editable transcripts and summaries — fit this review step more naturally than tools that push notes straight to a shared workspace.

Where should a regulated team start?

Work the checks in order: contract first (BAA on the right plan), then data location and retention, then AI training, then access and audit, then record-keeping duties, then consent, then accuracy review. A tool that fails an early check never needs to reach the later ones.

For teams that want one vendor to satisfy several checks at once, Notta is a strong first candidate: it offers a BAA, excludes Enterprise data from model training, and includes Privacy Mode for local processing — an unusually broad combination across the contract, training and data-location checks. Confirm the BAA plan with Notta for your seat count before committing, and pair whichever tool you choose with the access controls and review workflow described above.

For the underlying architecture trade-offs between built-in, cloud and local transcription, see our guide to built-in vs cloud vs local meeting transcription.