# Fireflies.ai for Healthcare: HIPAA Rules, BAA and Clinic Setup > Fireflies.ai supports HIPAA only on Enterprise ($39 per seat per month, billed annually only), with Private Storage on and a signed BAA. Setup, EHR, consent. _Source: https://professionalstoolkit.com/articles/fireflies-ai-for-healthcare — The Professional's Toolkit · updated November 2026_ --- Fireflies.ai can hold patient conversations under HIPAA, but only on one plan and only after two more steps. You need **Enterprise, at $39 per seat per month billed annually only**, with Private Storage switched on and a signed Business Associate Agreement (BAA); Fireflies' setup guide says all three must be in place together[1]. Free, Pro and Business are never HIPAA-ready, even though several Fireflies product pages carry a HIPAA badge. The status is fragile, too. A plan downgrade or a storage change switches it off immediately. For a small practice the bill is real: five Enterprise seats come to $2,340 a year by our arithmetic. **$39** — Per seat per month, billed annually only: Enterprise, the only Fireflies.ai plan with a HIPAA path (Private Storage and a signed BAA required). - **3 conditions** — HIPAA needs Enterprise, Private Storage on and a signed BAA - **4 hours** — Recording limit per meeting on Enterprise - **None** — Native EHR integrations; notes go through Keragon, Zapier or the API ## Three conditions, and the switches that undo them The HIPAA path starts with a request, not a checkbox. Fireflies provisions it on request, and BAA questions go to security@fireflies.ai. Private Storage, also Enterprise only, moves new meeting data into dedicated storage: a bucket Fireflies manages in a region you choose, or your own AWS S3 or Google Cloud Storage bucket. The Security Checklist in Team Settings shows when both pieces are complete. Fireflies' Terms add a plain rule: no protected health information (PHI) goes into the service before a BAA is signed. So the 7-day trial, which runs on Business, is no place for patient data. Two details catch practices later. Private Storage applies to new meetings only, so anything recorded before you switch it on stays in Fireflies' default US storage. And while the bucket can sit in another region, processing always happens on Fireflies' servers in the United States. Coverage also depends on the admin's next click. Toggling Private Storage off or making any downgrade ends coverage on the spot. Give billing and storage settings to one named admin, and recheck the Security Checklist after every plan change. Video platforms need their own paperwork. Fireflies' private-storage post says running it on Zoom or Google Meet under HIPAA takes the platform's BAA as well as Fireflies' own, and that a Google Workspace BAA does not extend to third-party apps. FERPA follows the same pattern for school-based clinics and campus counseling centers: Enterprise, Private Storage and a signed Data Sharing Agreement (DSA), configured separately from HIPAA. > ⚠ **HIPAA badges are not a plan:** Some Fireflies product pages show a HIPAA badge, but HIPAA applies only on Enterprise with Private Storage on and a signed BAA. Free, Pro and Business do not qualify. > ⚠ **A downgrade ends HIPAA instantly:** Leaving Enterprise or changing storage disables HIPAA coverage immediately. Recheck the Security Checklist in Team Settings after any plan or storage change. ## Settings a clinic changes before the first patient call **Custom data retention** is an Enterprise feature, and Fireflies' private-storage post ties it to Private Storage as well. Auto-delete periods run from 1 week to 1 year, and the Rules Engine adds presets from 24 hours to 30 days. Retention applies to future meetings only. Enterprise recording modes go further. Transcript + Summary keeps the text and drops the audio and video, while Summary Only deletes the transcript and audio once the summary exists, with no way back. Admins can enforce one mode for the whole organization, so no clinician has to remember it. Three defaults matter more in a clinic than anywhere else. The visible bot, Fireflies.ai Notetaker, auto-joins every calendar meeting with a video link right after sign-up. The recap email goes to everyone on the calendar invite, which can include the patient or an outside provider. And recaps open for teammates and anyone with the link, so a forwarded link opens the visit. Set auto-join to meetings you own, switch recap emails to Only me, and tighten default meeting privacy. Our guide to [removing the Fireflies bot](/articles/how-to-remove-fireflies-ai) lists every auto-join switch. Two tools sit outside the fence. Fireflies Talk, the free dictation app, is not covered by any BAA, and its terms say not to use it while PHI, card numbers or passwords are on screen[2]. Admins can switch Talk off workspace-wide. The MCP server, which lets outside AI assistants search and fetch meetings, is the other gap: Fireflies' zero-retention arrangement with its AI vendors stops once data leaves through it, and the outside tool's own terms apply. > 💡 **Switch off Talk for the workspace:** Fireflies Talk dictation is not covered by any BAA. Admins can turn it off workspace-wide so nobody dictates while PHI is on screen. ## Note formats, healthcare AI apps and the EHR gap Fireflies for Healthcare launched in September 2025, and its clinical features sit inside Enterprise. Fireflies says it writes clinical summaries in SOAP, DAP, BIRP, GIRP and PIRP formats and offers 15 pre-built healthcare AI apps that draw on the visit transcript to draft differential diagnoses, referral letters, sick notes, follow-up appointments and patient surveys. Other listed apps pull out a medication list, social history or the primary complaint. Fireflies' Terms carry the caveat that counts: AI output may be inaccurate and is not medical advice, so the clinician checks every draft. Budget for AI credits too. AI apps run on credits, charged by complexity per meeting, and Enterprise includes a one-time pool of 50 credits shared by the whole team, not per seat and not per month. After that, Fireflies sells credits as an add-on from $5 a month for 50 credits, a team pool. When credits run out on a paid plan, an account with no credit subscription is subscribed to the lowest tier ($5 a month for 50 credits), and an account that already has one moves up to the next tier; Auto-Upgrade can be switched off in billing settings. Transcription and standard summaries use no credits. Size the add-on from a two-week pilot. There is **no native EHR integration**. Notes stay in the Fireflies workspace until something carries them out. Fireflies' integration page describes Keragon as a healthcare automation platform that routes transcripts, summaries and action items to 100+ EHRs, including Athenahealth, eClinicalWorks and DrChrono[3]. Setup uses your Fireflies API key, and a Keragon workflow fires when a meeting is transcribed. Fireflies' HIPAA page also points to Zapier or the GraphQL API. Every link in that chain touches PHI, so confirm a BAA with each tool before the first note flows through it. ## Therapists: consent stays with you, and so does the note Fireflies' own guide for therapists is clear about scope. The tool returns a transcript and a summary, but it builds no CPT code, risk flag or supervision note; the clinical note is still the therapist's to write, and Fireflies positions itself as a complement to a therapy-specific note tool. Consent sits with you as well. Fireflies' Terms make the customer responsible for every participant's consent, with the bot or without it, and the therapists guide names state recording law and the codes of the APA, NASW, ACA and AMHCA as the sources of that duty. Fireflies does offer consent aids. An optional compliance email goes out an hour before a meeting with an opt-out link; it is off by default, and if a client opts out the bot stays away. In bot-free mode, the desktop app plays an audio consent message about 10 seconds in and can add an AI Taking Notes watermark to the camera feed. None of these replace a signed consent form in the client file. Get it in writing first. > 💡 **Collect written consent first:** Fireflies' Terms make recording consent your responsibility. Add recording and AI notes to the intake consent form before the first session. ## A clinic day with the right setup Picture a five-clinician outpatient practice on Enterprise with Private Storage and a signed BAA. Before the first appointment, the admin confirms that the Security Checklist shows HIPAA as active. In-person visits are captured with the mobile app, which can record offline and upload later, or with the browser Web Recorder, which Fireflies names for in-person and telehealth consultations. Telehealth on Zoom or Google Meet uses the visible bot under the platform's own BAA, with auto-join limited to meetings the clinician owns. A visit can run 4 hours before the bot leaves. Transcripts usually arrive 5 to 10 minutes after a meeting. Between patients, the clinician opens the SOAP or DAP summary, corrects it, and runs the referral-letter app only where a letter is needed, since each run spends credits. Recap emails go to the clinician alone. The workspace runs in Transcript + Summary mode, so audio is deleted after processing. At day's end, notes move to the EHR through Keragon. The clinician still signs the chart. Fireflies drafts; the clinician decides. ## What a small practice pays Enterprise is the only Fireflies plan with a HIPAA path, so the real question is what that step costs over the plan below it. One Enterprise seat comes to $468 a year by our arithmetic, and every active member (admin, member or editor) is a billable seat. By our arithmetic, five seats total $2,340 a year against $1,140 a year for five seats billed annually on the plan below, a gap of $1,200 a year, or $240 per seat a year. That gap buys Private Storage, the BAA route, custom retention, recording modes, the Rules Engine, SSO and the healthcare note features. Credits come on top, and they are non-refundable. There is no monthly Enterprise price, so the commitment is a full year from day one; practices with more than 50 members can ask Fireflies about volume pricing. Fireflies says its healthcare offer costs 90% less than competing medical documentation solutions, a vendor claim worth testing against your current scribe or note tool. Plan changes and billing rules are covered in our [Fireflies.ai pricing guide](/articles/fireflies-ai-pricing). ## FAQ **Does Fireflies.ai train AI models on patient recordings?** Fireflies' Terms say it will not use customer content to train generative AI models, and its AI vendors work under zero data retention on every plan. Its data processing addendum still allows deidentified data to be used to improve its products. **Where does patient data live with Private Storage?** Managed Private Storage keeps new meeting data in a region you choose, or you can bring your own AWS S3 or Google Cloud Storage bucket (Azure is not offered). Processing still happens in the United States, and with your own bucket you are responsible for its configuration and backups. **Is the SOC 2 report available to a clinic's compliance officer?** Yes. Fireflies holds SOC 2 Type II on every plan, and the report is available after signing an NDA. **Does Fireflies.ai cover FERPA for a school-based clinic?** Only on Enterprise with Private Storage on and a signed Data Sharing Agreement. FERPA is configured separately from HIPAA, and removing either piece or downgrading disables it. ## The bottom line Fireflies.ai works for healthcare only as an Enterprise workspace with Private Storage on and a signed BAA, and it stays covered only while nobody downgrades or changes storage. Inside that setup, a practice gets SOAP-style summaries, healthcare AI apps on credits, retention and recording modes that delete audio, and an EHR route through Keragon, Zapier or the API. It does not write the clinical note, assign CPT codes or replace a consent form. Buy it if those limits fit your workflow and the annual seat cost fits your budget. ## Sources [1] Set up HIPAA compliance for your workspace — https://guide.fireflies.ai/articles/3704059205-set-up-hipaa-compliance-for-your-workspace (2026-11) [2] Fireflies Talk Supplemental Terms — https://fireflies.ai/terms/talk (2026-11) [3] Fireflies.ai Keragon Integration — https://fireflies.ai/integrations/custom/keragon (2026-11) [4] Fireflies.ai pricing page — https://fireflies.ai/pricing [5] Fireflies help center — https://guide.fireflies.ai/articles/4027724828-learn-about-the-fireflies-free-plan [6] Fireflies.ai Terms of Service — https://fireflies.ai/terms-of-service [7] Fireflies.ai Privacy Policy — https://fireflies.ai/privacy-policy