Otter.ai and HIPAA: which plan, the agreement it needs, and what Otter leaves to you
By Ryleigh Newman · Published
Otter's help center says Otter.ai is HIPAA compliant, and that HIPAA compliance is only available on the Enterprise plan. It also says Otter is not a HIPAA-covered entity by default: it becomes a Business Associate only when a signed Business Associate Agreement is in place. By that statement, the Basic, Pro and Business plans are not covered.
I built YapToText, a dictation app for the Mac, so read what I say about Otter with that in mind. Every fact about Otter here comes from its own help center, read on October 11, 2026.
I make no compliance claims about any app, mine included. This page reports Otter's statements. Whether they meet your obligations is for your organization and its counsel.
This app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.
What Otter states
From Otter's help article on HIPAA, read October 11, 2026.
| Point | Otter's statement |
|---|---|
| Plan | HIPAA compliance is only available for the Enterprise plan |
| Agreement | A BAA must be executed with Otter before any protected health information is handled |
| How to start | Through your account manager, or Otter's sales team |
| SOC 2 | Otter says it is SOC 2 Type II certified |
| Safeguards it lists | Encryption, tighter access controls, staff training and regular security audits |
What Otter says is your responsibility
Otter's article says healthcare organizations are responsible for controlling when and how protected health information enters Otter. It names the features to watch:
- Notetaker. It can join and record scheduled meetings automatically. A Workspace admin can turn off members' use of it under Workspace, Members, Notetaker.
- Calendars. Synced calendar events and connections should be reviewed so sensitive meetings are not recorded by accident.
- Policies. Otter says customers should have policies and technical controls so information is not captured unintentionally or without authorization.
The article calls its own list non-exhaustive and points you to your account executive.
What this means in practice
- If you are on a free or individual plan, Otter's statement does not cover you.
- If your organization has Enterprise, ask whether the BAA has been signed.
- Check the auto-join setting on your own account before a meeting that will include patient details.
- Remember that Otter is a cloud service: the audio and transcript are processed on its servers.
Stopping Otter joining meetings covers the auto-join controls, and the Otter safety page covers its general data statements.
How other tools answer
Wispr Flow, superwhisper, Aqua Voice and Willow Voice each have a page here from their makers' statements. Medical dictation on a Mac sets them side by side.
YapToText, the free app I built, does its speech recognition on the Mac, with no account and no server. That describes how it works. It is not a compliance statement, and I offer no BAA. It also does not record meetings, so it is not a substitute for what Otter does.
This app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.
The short version
- Plan. Enterprise only.
- Agreement. A signed BAA, before any protected health information.
- Other plans. Not covered by Otter's statement.
- Your part. Control Notetaker, calendars and who records what.
- Your call. Your organization decides.
If Otter changes its statements, open an issue on GitHub and I will update this page. Every one gets read.
This app is completely free. You don't have to make an account. There are no subscriptions, no difficult downloads, and nothing is locked. Made for Apple silicon Macs. Source on GitHub.
Related
Sources
- https://help.otter.ai/hc/en-us/articles/33975072019991-HIPAA-Otter-ai (checked 2026-10-11)
- https://help.otter.ai/hc/en-us/articles/360048258953-Data-security-and-privacy-policies (checked 2026-10-11)
- https://github.com/ryleighnewman/YapToText (checked 2026-10-11)
- https://apps.apple.com/us/app/yaptotext/id6786382289 (checked 2026-10-11)
Questions
Is Otter.ai HIPAA compliant?
Otter says it is, on the Enterprise plan only, once a Business Associate Agreement has been signed.
Does Otter sign a BAA?
Otter says a BAA must be executed before protected health information is handled, and to start through your account manager or its sales team.
Is Otter Pro HIPAA compliant?
Otter's help center says HIPAA compliance is only available for the Enterprise plan.
Can I use Otter for patient meetings?
By Otter's statement, only on Enterprise with a signed BAA, and your organization stays responsible for controlling what is recorded.