HIPAA Compliant AI Note Taker: Which Tools Sign a BAA, on Which Plan, at What Price (2026)

TL;DR: An AI note taker is HIPAA compliant for you only if its vendor signs a Business Associate Agreement (BAA) on the plan you're paying for. As of November 2026, most meeting tools sign one only on a team or enterprise plan: Otter on Enterprise, Fireflies on Enterprise ($39 a seat), Granola on Enterprise ($35), Read on Enterprise+ ($29.75, 5 seats minimum). The cheapest published options are Google Workspace Business Standard ($14), Zoom Pro ($14.16) and Fathom Team ($15). Clinical scribes like Freed and Mentalyc include a BAA on their entry plans.

I've been a CTO at an AI startup and shipped 50+ products, and I set up AI tools for small businesses, including practices. The question I get from a 10-person therapy group or clinic is never "which note taker is best." It's "which one can we use with patients without a lawyer finding out later that we shouldn't have." This page answers that from what each vendor publishes, read on November 8, 2026. It isn't a ranking, and it isn't a security audit of anyone.

What "HIPAA compliant" means for a note taker

Same rule as the rest of this series: software isn't HIPAA compliant by itself. The vendor signs a BAA, a contract promising to protect the patient information it handles for you. Then you run the tool in a way HIPAA allows. The full version for AI tools is in HIPAA compliant AI.

Note takers add three traps the chat tools don't have:

• The BAA is tied to a plan. Otter, Granola, Fireflies and Read all run the same app on every plan, but sign a BAA only on the top one. A clinician on Pro has the app and no contract.
• The bot joins on its own. Most meeting tools auto-join anything on your calendar, so patient calls get recorded even when nobody meant to.
• The notes travel. Summaries get emailed to attendees, shared by link, and synced to other apps.

The comparison table: BAA plan and published price

Prices are per user (or per clinician) per month, as published on each vendor's own pricing page on November 8, 2026. "Not published" means I couldn't find it on the vendor's site, not that it doesn't exist.

Two I checked and left as "not published": tl;dv shows no HIPAA or BAA line on its pricing page, and Microsoft's Dragon Copilot FAQ says it's built to support HIPAA but I didn't find a BAA statement on it. Ask either one in writing.

General meeting tools, one by one

Otter.ai. Otter's help center says "HIPAA compliance is only available for the Enterprise plan," and you start the BAA through an account manager or Sales. Its pricing page lists HIPAA as an Enterprise add-on with no price. Pro ($8.33) and Business ($19.99) get no BAA. The full breakdown, the settings Otter tells you to change and the 2025 class action are in is Otter.ai HIPAA compliant.

Fathom. Fathom says it's "fully HIPAA compliant" and publishes a blanket BAA, last updated September 9, 2026, that applies when a covered entity signs up under its service agreement. The pricing page ties "HIPAA compliance with a standard BAA" to Team ($15 a user a month annual, 2-user minimum) and Business. Want a signed copy? Fathom says to email help@fathom.video. For a two-person practice, that's the lowest published entry point among the general meeting note apps.

Fireflies.ai. Fireflies' pricing page: "BAA for healthcare and DSA for education, available on Enterprise with Private Storage." Enterprise is $39 a seat a month, annual only. It also lists custom data retention and a "transcript and summary only" mode on Enterprise. Free, Pro ($10) and Business ($19) don't list HIPAA.

Zoom. Zoom signs a BAA from Pro up. Pro buyers pick the US BAA at checkout on Zoom's healthcare pricing page ($14.16 a user a month annual); Business and higher go through Sales. Zoom says AI features are available to BAA customers but also that "certain AI features may not be available at this time" for healthcare accounts. Zoom says it doesn't use your audio, video or chat to train AI models. Check which AI Companion features are switched on after the BAA, not before.

Microsoft Teams and Copilot. Microsoft's BAA comes by default through the Data Protection Addendum for commercial customers. Microsoft Teams, Microsoft Copilot and Copilot Chat are all on its in-scope list. If your practice already runs on Microsoft 365, you probably already have this BAA. What's outside it, and the permissions problem it creates, is in is Copilot HIPAA compliant.

Google Meet and Gemini. A super admin accepts Google's BAA in the Admin console. Google Meet and "Gemini in Google Workspace" are on Google's covered list, and Meet's AI note-taking needs Business Standard ($14 a user a month annual) or higher. Google's list doesn't name "take notes for me" by that name, and Google warns some features may be blocked once the BAA is signed, so check it's still on afterward. By default, the notes go to invited guests inside your organization. The full Workspace setup is in is Google Workspace HIPAA compliant.

Granola. Granola is "HIPAA compliant for Enterprise customers" ($35 a user a month), with the BAA arranged through sales. Two limits in its privacy policy matter: the BAA "only covers the Granola desktop and laptop applications," so the phone app is out, and Granola doesn't strip patient information from meeting titles or calendar invites.

Read AI. Read's HIPAA guide requires an annual Enterprise+ plan with a 5-license minimum ($29.75 a user a month annual) and a signed BAA. Once HIPAA is on, Read only auto-joins meetings where you're the host, turns off public links and report downloads, and turns off push integrations like Notion and HubSpot by default. Its guide says to keep patient information out of meeting titles and calendar events.

Clinical AI scribes

These are built for visit and session notes, and most include the BAA on the plan a solo clinician buys.

Freed. Freed's BAA is Schedule A of its platform terms, so you accept it when you sign up, including during the free trial. A signed copy is available on request. Plans: Starter $39 a month (40 notes), Core $79, Premier $104. Groups get an organization-wide BAA and medical assistant seats at a custom price.

Mentalyc. Built for therapy notes. Its pricing table marks "Consent forms and BAA (HIPAA)" on every plan, from Mini at $14.99 a month annual up to Super at $99.99, with team seats at $49.99 annual.

Heidi Health. Heidi's HIPAA page says, "We make a BAA available to every covered entity we work with." It has a free tier, but its US pricing page doesn't show prices for paid plans.

Abridge and Suki. Both publish BAA terms tied to a customer agreement and price by contract. They sell mostly to health systems, so a 10-person practice will usually end up with Freed, Heidi or a therapy tool instead.

What a 10-person practice would pay

My arithmetic, using only published prices, for 10 people on annual billing:

Two things this table hides. If you already pay for Google Workspace or Microsoft 365, the note taker may already be in the bill, and the BAA may be one click away. And if only your 4 clinicians need visit notes, a clinical scribe for 4 seats can cost less than a meeting tool for 10.

The settings that matter after the BAA

The BAA covers the vendor's side. These are on you, and the vendors' own HIPAA guides list most of them:

1. Auto-join. Turn off auto-join, or limit it to meetings you host. Otter's guide says you're responsible for controlling when its bot joins. Read enforces host-only auto-join once HIPAA is on.
2. Link sharing. Turn off public and link-based sharing. Otter and Read both tell you to.
3. Who gets the summary. Default recipients should be your own staff, not every attendee.
4. Meeting titles. No patient names in calendar titles. Granola and Read both say they don't scrub those fields.
5. Phones. Granola's BAA doesn't cover its mobile app. Check every vendor's answer for mobile before staff install it.
6. Retention. Set how long recordings and transcripts live. Otter, Fireflies and Read all offer custom retention.
7. Consent. Tell patients you're using an AI note taker and get their OK. A BAA doesn't answer recording-consent laws.

Which one I'd start with

If you're on Google Workspace or Microsoft 365, start there: sign or confirm the BAA, then turn on the note-taking you already pay for. If you're a solo or small therapy practice, look at a clinical scribe that includes the BAA on the plan you'd buy anyway. If you want a dedicated meeting tool for a small team, Fathom Team is the lowest published entry point with a BAA named on the plan.

Whichever you pick, get the BAA before the first patient conversation, not after. If you'd like help choosing, setting it up and writing the one-page policy your staff will follow, that's what my AI consulting for healthcare practices covers, starting with a free call. This page is a technology explainer, not legal advice. Take the table to your compliance counsel.

Sources

• Otter Help, HIPAA and Otter pricing: Enterprise only, HIPAA add-on, plan prices. Read November 8, 2026.
• Fathom pricing, Is Fathom HIPAA-compliant? and Fathom BAA (updated September 9, 2026). Read November 8, 2026.
• Fireflies pricing and Fireflies HIPAA: BAA on Enterprise with Private Storage. Read November 8, 2026.
• Zoom healthcare pricing and Zoom, HIPAA Business Associate Agreement. Read November 8, 2026.
• Microsoft, HIPAA and HITECH (updated September 11, 2026): BAA by default, Teams and Copilot in scope. Read November 8, 2026.
• Google Workspace, HIPAA compliance, Google covered services, Meet AI note-taking and Workspace pricing. Read November 8, 2026.
• Granola pricing, Is Granola HIPAA compliant? and Granola privacy policy. Read November 8, 2026.
• Read AI pricing and Enabling HIPAA compliance in Read AI. Read November 8, 2026.
• tl;dv pricing: no HIPAA or BAA listed. Read November 8, 2026.
• Freed pricing and Freed, how to get a BAA. Read November 8, 2026.
• Mentalyc pricing, Heidi HIPAA, Abridge BAA, Suki terms. Read November 8, 2026.