Resource
Short answer: yes, since July 2025 — but only on the Enterprise plan, and only with a signed Business Associate Agreement. Most answers you’ll find online are out of date in one direction or the other. Here is the current state, sourced from Otter’s own documentation, and the architectural question worth asking before you buy your way out of the problem.
Quick answer
Otter.ai is HIPAA compliant only for Enterprise customers with a signed BAA. Otter announced HIPAA compliance in July 2025 following an independent assessment. Per its help center, the BAA is available exclusively on the Enterprise plan, arranged through sales.
On Basic, Pro, and Business plans, the answer is no. No BAA is available on those tiers, so recording conversations that contain protected health information on them is an impermissible disclosure to a vendor — regardless of how good Otter’s general security is.
A Business Associate Agreement makes it lawful for a vendor to receive and process PHI on your behalf, and binds the vendor to HIPAA’s safeguards. It is a legal instrument, not an architectural one. With a signed BAA, your patient conversations still travel to Otter’s cloud, are still transcribed on Otter’s servers, and still live in Otter’s storage — the disclosure is permitted and governed, not eliminated.
That distinction matters when you think about breach surface. A BAA obligates the vendor to report breaches; it does not make the vendor unbreachable. Every cloud notetaker with a BAA is still a third party holding your patients’ conversations.
Using Otter with PHI in a compliant way requires all of the following:
The reason a BAA is needed at all is that the audio leaves your machine. There is a second way to resolve the HIPAA question: use transcription that runs entirely on your own device, so no vendor ever receives the conversation. No third party, no business associate, no BAA to negotiate — the legal question dissolves because the disclosure never happens.
That’s the architecture Minutes is built on: audio is captured and transcribed on your device with whisper.cpp, and the record is markdown on your own disk with owner-only file permissions. It’s open source, so this claim is verifiable in code rather than asserted on a trust page. To be precise about the framing: no local tool is “HIPAA certified” — HIPAA governs covered entities and their vendors. On-device processing removes the vendor from the equation; securing the device (disk encryption, access control) remains your responsibility, as it already is for your EHR workstation.
If your compliance team’s core question is “where does the audio go?”, the on-device answer is one sentence long.
| Your situation | Reasonable path |
|---|---|
| Large org, already on Otter Enterprise, wants team features | Sign the BAA, lock recording to the covered workspace, audit regularly |
| Solo practitioner or small practice on a consumer/Pro plan | Stop recording PHI with it today — no BAA is available at your tier. Consider on-device transcription instead |
| Any practice whose bar is “patient audio never touches a third party” | On-device tools are the only architecture that meets it — a BAA governs disclosure, it doesn’t prevent it |
Next step
This page is informational, not legal advice. Verify plan details and BAA terms with Otter and your compliance counsel before recording PHI with any tool.
How the vendors compare on the same question.
The same question about the other common choice.
What the rule requires of transcription generally.
If the answer sent you looking for the off switch.