Is Otter.ai HIPAA Compliant? Only on Enterprise, Plus the Settings That Matter (2026)

TL;DR: Only on Otter Enterprise. As of November 2026, Otter's help center says "HIPAA compliance is only available for the Enterprise plan," and its pricing page lists HIPAA as a paid add-on to Enterprise. You need a signed Business Associate Agreement (BAA) before any patient information goes in. Basic, Pro ($8.33 a user a month) and Business ($19.99) can't get one, and Otter doesn't publish the Enterprise or add-on price. After the BAA, Otter's own guide hands you a list of settings to turn off, starting with the bot that auto-joins your meetings.

I've been a CTO at an AI startup and shipped 50+ products, and I set up AI tools for small businesses, including clinics and therapy practices. Otter is the note taker I most often find already running when I start. Usually someone signed up on Pro, connected their calendar, and the bot has been joining patient calls ever since. Several pages ranking for this question get the plan wrong, so here's what Otter itself says.

What Otter says about HIPAA

Otter announced HIPAA compliance on July 10, 2025, after what it called an independent assessment, adding to its SOC 2 Type II report. The help center spells out the terms. Otter "is not a HIPAA-covered entity by default. It becomes a Business Associate only when a signed BAA is in place." You start the BAA through your account manager or Otter's Sales team, and it has to be signed before Otter handles any patient information.

That's the same rule for every tool in this series. The software isn't compliant by itself. The vendor signs a BAA, and you run the tool in a way HIPAA allows. The longer version is in HIPAA compliant AI.

Otter plans vs HIPAA

Some ranking pages say Business includes a BAA, and one says Otter can't be HIPAA compliant at all. Both are wrong by Otter's own pages. Business is the plan most 5 to 20 person practices would pick, and it's the one that looks safe and isn't.

What Otter HIPAA costs

The honest answer: you won't know until you ask. Enterprise has no public price, and the HIPAA line is an add-on on top of it. Get the quote in writing, with the HIPAA add-on and the BAA named in it.

One more thing on the pricing page affects a small practice. Otter's HIPAA guide tells you to enforce two-factor authentication and single sign-on (SSO). Two-factor is a workspace setting. But the pricing page says SSO and SCIM need a "minimum 100-user license." A 10-person practice can turn on two-factor, but ask Otter in writing what it expects for sign-in if you're well under 100 seats.

If the Enterprise quote is more than a small office wants to pay, other tools sign a BAA on a cheaper published plan. Fathom, Fireflies, Zoom, Google Meet and the clinical scribes are compared in HIPAA compliant AI note takers.

The settings Otter tells you to change

Otter's HIPAA page has a "User controls" section, and it's mostly a list of things that are on by default and need to come off. In Otter's words, healthcare organizations "are responsible for controlling when and how PHI is introduced into the Otter environment." Here's the list with the menu paths Otter gives:

1. The Notetaker bot (what most people still call OtterPilot). It can join and record scheduled meetings on its own. Admins can turn it off for members in Workspace > Members > Notetaker.
2. Auto-join. Each user checks Account Settings > Meetings. Admins set the workspace rules in Workspace > Settings. Turn it off for anyone who sees patients.
3. Calendar sync. Review connected calendars in Account Settings > Apps. A synced calendar is how the bot ends up in a session nobody meant to record.
4. Sharing. Otter says public and link-based sharing "is not appropriate when PHI is involved." Disable external sharing in Workspace > Settings, then audit and revoke old shared links.
5. Sign-in and offboarding. Enforce two-factor in Workspace > Settings. Remove staff who leave "ideally within 24 hours," under Workspace > Members.
6. Retention. Set a custom retention period with your account executive, so conversations delete themselves after a set time instead of piling up forever.

Then keep an eye on it. Otter suggests regular reviews of Workspace > Analytics and the conversation list. In a small practice, that's a 10-minute check once a month.

The 2025 class action over recording without consent

This is the part people search for after "is Otter HIPAA compliant," and it's a different question. HIPAA is about how Otter protects patient information it holds for you. The lawsuit is about whether everyone on a call agreed to be recorded.

On August 15, 2025, NPR reported that Justin Brewer filed a proposed class action against Otter in federal court in Northern California. The case was later consolidated as In re Otter.ai Privacy Litigation (No. 5:25-cv-06911). According to the court's own summary of the complaint, the plaintiffs allege the Otter Notetaker joins meetings as a "silent participant" and records without consent from all participants, and that Otter kept recordings and voiceprints to train its models. One of the seven plaintiffs alleges using Zoom to talk with a medical professional about private medical information.

On August 13, 2026, Judge Eumi K. Lee granted Otter's motion to dismiss in part and denied it in part. Some claims were dismissed with permission to refile, the plaintiffs withdrew others, and the rest of the case continues. These are allegations, not findings. The court hasn't decided whether they are true.

What it means for a practice: a BAA doesn't settle consent. If you record a session with any AI tool, tell the patient, get their OK, and put it in your intake paperwork. Recording-consent laws vary by state, so ask your counsel which rule applies to you.

What I'd do this week

Open Otter and check the plan name on your account. If it says Basic, Pro or Business, no patient conversations go into it, starting today, and turn off auto-join for everyone who sees patients. Then decide: request an Enterprise quote with the HIPAA add-on, or move to a tool with a published BAA plan. If you're already on Microsoft 365, read is Copilot HIPAA compliant first, because your Teams meetings may already be covered. If you like Granola, the plan math is in Granola pricing.

If you'd rather have someone pick the tool, set it up and write the one-page staff policy, that's what AI consulting for healthcare practices is for, starting with a free call. This is a technology explainer, not legal advice.

Sources

• Otter Help, HIPAA: Enterprise only, BAA process, user controls and menu paths. Read November 8, 2026.
• Otter pricing: plan prices, member limits, HIPAA as an Enterprise add-on, 100-user minimum for SSO and SCIM. Read November 8, 2026.
• Otter, HIPAA compliance announcement, July 10, 2025. Read November 8, 2026.
• NPR, Class-action suit claims Otter AI secretly records private work conversations, August 15, 2025. Read November 8, 2026.
• In re Otter.ai Privacy Litigation, No. 5:25-cv-06911-EKL, Order Granting Motion to Dismiss in Part (N.D. Cal., August 13, 2026). Read November 8, 2026.