# Otter.ai HIPAA for Healthcare: Enterprise, BAA and Admin Controls

> Is Otter.ai HIPAA compliant? Only on Enterprise, as an add-on with a signed BAA. What Otter tells healthcare admins to lock down, and which plans fit.

_Source: https://professionalstoolkit.com/articles/otter-ai-for-healthcare — The Professional's Toolkit · updated November 2026_

---

Otter.ai can hold protected health information only on its Enterprise plan, through a HIPAA add-on, and only after a Business Associate Agreement (BAA) is signed. Without that BAA, Otter is not a business associate. Basic, Pro and Business are not for PHI, whatever the team size. Otter announced HIPAA compliance in July 2025, and the BAA process starts through an account manager or Sales [1]. Otter publishes no price for Enterprise or for the HIPAA add-on. Even with a BAA, keeping PHI out of the wrong places stays the customer's job. That job is what this guide covers.


**Enterprise + BAA** — The only Otter setup meant for protected health information (HIPAA add-on, signed BAA).



- **July 2025** — Otter announced HIPAA compliance; today it is an Enterprise add-on with a BAA
- **100 users** — Minimum Enterprise licence for SSO and SCIM
- **24 hours** — Shortest custom retention period (Enterprise)


## What the BAA covers, and what stays with you

Otter's HIPAA help page describes its Enterprise configuration, combined with a BAA, as meant for covered entities and business associates. It says that setup limits access to PHI and limits the use of customer data for AI training. Customers must still assess whether their own use involves PHI at all. The pricing page lists HIPAA as an add-on on Enterprise [2], so a quote is a two-part question: the Enterprise seats and the add-on. Neither has a published figure. Budget for a sales cycle, not a checkout page.

| Otter plan | Can it hold PHI? | What applies |
|---|---|---|
| Basic | No | Free; 5 workspace members max; no BAA |
| Pro | No | 5 billed users max; no BAA |
| Business | No | 25 billed users max; no BAA |
| Enterprise | Only with the HIPAA add-on and a signed BAA | Admin controls; SSO and SCIM with a 100-user minimum licence |

Size shapes the decision too. Business stops at 25 billed users, so a 40-person clinic that wants PHI in Otter is buying Enterprise either way. Single sign-on and SCIM directory sync then need a 100-user minimum licence, which means a small practice pays for seats it does not fill to get them. Directory Sync deactivates deprovisioned users within minutes, which matters when staff leave. Two-factor authentication by authenticator app exists on every plan, and Enterprise admins can require it for all members. Otter says it holds SOC 2 Type II.

## The controls Otter tells healthcare admins to set

### Keep the Notetaker out of patient conversations

The Otter Notetaker (formerly OtterPilot) auto-joins every calendar meeting with a Zoom, Google Meet or Microsoft Teams link once someone connects a calendar. Otter's HIPAA guidance makes controlling when PHI enters Otter the customer's responsibility, including that auto-joining Notetaker, and notes that workspace admins can switch it off for members. Enterprise goes further. With Manage Notetaker for Workspace, the Notetaker stays off for everyone until an admin turns it on, and admins can block auto-join by meeting-title keywords. Admins can also disable manual recording, or require users to confirm they have permission before one starts.


> ⚠ **Outside Notetakers can still join:** Notetakers from other Otter workspaces can join a meeting with outside participants, one per workspace, and Enterprise title-keyword blocking covers only your own workspace's Notetakers.


One gap stays open. Notetakers from other Otter workspaces can still join a meeting that includes outside participants, one per workspace, and keyword blocking covers only your own workspace. A referring practice's or a vendor's Notetaker can therefore arrive in a call your settings would have kept clean. Any participant, including someone without an Otter account, can remove it, and the meeting continues unrecorded by Otter. Our guide to [removing Otter from a meeting](/articles/how-to-remove-otter-ai) walks through each route.

### Shut the sharing doors

The HIPAA page says the customer must explicitly disable public and link-based sharing before using Otter with PHI. Admins can also limit external sharing to the workspace domain. Auto-share deserves the same attention: recordings from calendar events can go to all guests, same-domain guests, workspace members or nobody, and guests receive a summary email within 2 hours. Under deduplication, a Notetaker with broader sharing can be picked, so a conversation may reach the workspace even when the host chose not to share. Pick the narrowest default.

### Retention, audio removal and hidden transcripts

Custom retention is an Enterprise feature, requested by a workspace admin through the account manager, with a minimum period of 24 hours [3]. Activation is blunt. Every existing conversation older than the period is deleted at once, data is removed within 48 hours of its period ending, and nothing lands in Trash. Retention can target the full conversation, only audio or video, only the transcript, or separate periods for each. Decide the period before the first clinical meeting, not after a year of recordings.

Two further switches suit teams that need text but not recordings. Remove audio, Enterprise only, permanently strips audio from all existing and future workspace conversations and keeps the transcripts. Block Transcript Display hides the Transcript tab, audio playback, export and public live transcript links [4]. Otter enables it through the account manager; hidden data is not deleted, and Otter Chat cannot read the transcripts. Enterprise admins can also disable AI features while recording continues, block file imports, and turn off speaker learning so no voice profiles are built.


> 💡 **Switch the Notetaker off first:** Before anyone connects a calendar, have an admin turn the Notetaker off for members; on Enterprise, Manage Notetaker for Workspace keeps it off for everyone until an admin enables it.


## Consent, model training and where the data lives

Consent stays with you. Otter's Terms leave the user solely responsible for telling people they are recorded and getting their consent, and the enterprise agreement puts that duty on the customer. Otter's recording-permissions guide lists California, Illinois and Florida among places that require all-party permission, and advises applying all-party practices everywhere. Enterprise can send pre-recording emails to calendar guests, though the disclaimer text cannot be customized. The bot-free desktop app shows nothing to other participants, so consent there rests entirely on the person recording.

For Teams calls, Enterprise offers recording-permission capture through the Otter for Outlook extension: each participant who joins through the Otter meeting link sees a permissions page and must accept before entering. It needs a Microsoft Enterprise licence, the account manager switches it on, and it works in Outlook web and desktop but not the Outlook mobile app. People who use the direct Teams link skip that page, so it narrows the gap rather than closing it.

Training is the question compliance officers ask next. Otter's privacy policy says it trains its own AI on de-identified audio recordings and on transcriptions, which may contain personal information. Its privacy pages name no opt-out from that training for non-Enterprise accounts. A separate Help improve Otter setting decides whether Otter and third-party providers may access conversations for training, including human review. Enterprise workspaces are opted out of model training by default. Otter staff reach a transcript or audio only with explicit customer consent.

Data sits on AWS in the United States, in the US West region, with AES-256 encryption at rest and TLS in transit. Otter does not publish a choice of data region. Anthropic powers AI features and OpenAI evaluates Otter's models; Otter says neither trains on or stores customer data through the API. When an account ends, Otter deletes residual data on request, and enterprise content stays retrievable for 30 days after termination. Ask Sales to confirm both points in the contract.

## Which parts of a healthcare team's week fit which plan

Start with Otter's own test: does this meeting involve PHI? Administrative work often does not. Vendor calls, budget reviews, IT planning and scheduling huddles that use no patient identifiers are ordinary business meetings. For those, Business costs $19.99 per user a month billed annually, or $30 per user a month billed monthly, for up to 25 billed users. Pro and Basic carry monthly minute caps covered in our [pricing guide](/articles/otter-ai-pricing). The risk is drift. A huddle that starts on rosters and ends on a named patient has just put PHI into a plan without a BAA.

Staff education is the second fit. In-service training, recorded webinars and onboarding sessions usually discuss procedures rather than patients, and per-conversation caps matter more there than HIPAA: 30 minutes on Basic, 90 on Pro, 4 hours on Business and Enterprise. Case discussions with identifiable details move a session back into BAA territory. Otter's healthcare customer story follows this pattern. Woven Health Collective, a medical communications agency for pharma, biotech and device companies, uses Otter for internal and client meetings, AI Chat and action items, according to Otter's case study, which names no HIPAA or BAA feature.

Research interviews sit on the line. Otter records in-person conversations, imports files up to 5 GB each, and AI Chat searches across a whole interview set. If participants discuss their health in recordings tied to who they are, that is the PHI case Otter's guidance flags. Such projects belong on Enterprise with a signed BAA and retention set before the first interview. Clinical encounters, patient intake and telehealth visits need the BAA from day one; Otter's own guide says HIPAA requires a signed BAA for any vendor handling PHI.


> 💡 **Settle retention before recording:** Activating a custom retention policy on Enterprise deletes every existing conversation older than the period at once, with nothing sent to Trash, so set it before the first clinical meeting.


## How other AI notetakers package HIPAA

Rivals place HIPAA at different points, which matters most for a small practice. Fathom's pricing page says its Team plan includes HIPAA compliance with a standard BAA. Granola offers HIPAA support and a BAA only on Enterprise, and that BAA covers its desktop and laptop apps only. Granola lists Enterprise at $35 per user a month and up. Granola also says it is not currently FERPA compliant, which matters to teaching hospitals that handle student records.

Fireflies puts HIPAA on Enterprise, with a BAA for healthcare available together with Private Storage. Fireflies Enterprise costs $39 per seat a month, billed annually only. Read AI places HIPAA, SAML and SCIM on its Enterprise+ plan. Read AI Enterprise+ costs $29.75 per user a month billed annually, or $39.75 per user a month billed monthly. Otter prints no figure for Enterprise or its HIPAA add-on, so any side-by-side cost needs a quote first. Units also differ across these vendors.


## FAQ

**How do we stop an Otter Notetaker during a patient call?**

Any participant, even without an Otter account, can remove the Notetaker, and typing stop otter in the Zoom, Google Meet or Teams chat removes all Notetakers immediately. The meeting continues without Otter recording it.

**Can Otter record patient phone calls?**

Otter cannot record phone calls directly because of Apple and Google restrictions. You record with the phone's own recorder and import the file, and you remain responsible for legal consent to record.

**Does Otter hold ISO 27001 certification?**

Otter claims no ISO certification; it says its security policies are based on the ISO 27001/2 framework. Otter says it holds SOC 2 Type II.

**Can a healthcare team trial Enterprise before signing?**

Otter's self-serve free trial is for the Business plan, which is not for PHI. Enterprise trials are arranged through Otter's sales team.


## The bottom line

Otter can serve a healthcare team, but the line is sharp. Protected health information belongs only on Enterprise with the HIPAA add-on and a signed BAA, and even then the customer configures the Notetaker, sharing, retention and consent. Basic, Pro and Business suit administrative meetings, staff training and other sessions that keep patients out of the room. Before signing, ask Sales for the add-on price, the retention setup and each control in this guide. Then pilot with the Notetaker off by default.



## Sources

[1] Otter help: HIPAA - Otter.ai — https://help.otter.ai/hc/en-us/articles/33975072019991-HIPAA-Otter-ai (2026-11)
[2] Pricing — https://otter.ai/pricing (2026-11)
[3] Otter help: Set a custom Data Retention policy — https://help.otter.ai/hc/en-us/articles/19500988656279-Set-a-custom-Data-Retention-policy (2026-11)
[4] Otter help: Block Transcript Display — https://help.otter.ai/hc/en-us/articles/38309485949079-Block-Transcript-Display (2026-11)
[5] Otter.ai help center — https://help.otter.ai/hc/en-us
[6] Otter.ai Terms of Service — https://otter.ai/terms-of-service
[7] Otter.ai Privacy Policy — https://otter.ai/privacy-policy