{"article":{"id":33975072019991,"url":"https://otterai.zendesk.com/api/v2/help_center/en-us/articles/33975072019991.json","html_url":"https://help.otter.ai/hc/en-us/articles/33975072019991-HIPAA-Otter-ai","author_id":1902597107005,"comments_disabled":true,"draft":false,"promoted":true,"position":0,"vote_sum":13,"vote_count":23,"upvote_count":18,"downvote_count":5,"section_id":13352400186391,"created_at":"2025-08-06T00:00:36Z","updated_at":"2026-09-29T16:52:32Z","name":"HIPAA | Otter.ai","title":"HIPAA | Otter.ai","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2025-08-27T16:28:59Z","user_segment_id":null,"permission_group_id":3069674,"content_tag_ids":["01GWAVSYKF4EPH4182MXAV6G6G","01K1YAWACRFVZ7WTVQ9M8NPWBR"],"label_names":["compliance","admin control","HIPAA","hipaa compliant","healthcare","health care field","patient privacy","protected health information","business associate agreement","identity control","administrative","medical","medical compliant","health industry","Health Insurance Portability and Accountability Act","phi","security audit","soc 2 type II","baa","disable link"],"body":"

Otter.ai is now HIPAA compliant, which means you can confidently use our AI meeting agent for clinical documentation, team communication, and patient coordination. Healthcare teams can now use Otter for meetings involving Protected Health Information (PHI) without worry. Learn more about Otter’s commitment to Privacy & Security. 

\nGetting Started: HIPAA compliance is only available for the Enterprise plan. Reach out to your account manager to start the Business Associate Agreement (BAA) process or contact our Sales team to learn more.

HIPAA’s benefits for all Otter users

We follow HIPAA requirements in how we collect, store, and process health-related information, implementing both administrative and technical safeguards to help protect against unauthorized access or misuse. Otter has implemented many new security measures and processes, providing benefits across the board:

\nTip: Otter is SOC 2 Type II certified. Reach out to your account executive or contact our Sales team to learn more!

User controls

To ensure HIPAA-compliant use of Otter, review the information below. The info listed below is non-exhaustive. Speak with your account executive for any questions regarding your organization’s specific needs.

\nTip: We provide many controls for Workspace admins. Learn more about the various admin controls we offer.

Sign a Business Associate Agreement

Otter.ai is not a HIPAA-covered entity by default. It becomes a Business Associate only when a signed BAA is in place. Customers must assess whether their intended use of Otter.ai will involve the creation, receipt, transmission, or maintenance of PHI. If so, a BAA must be executed with Otter.ai before any such data is handled. Contact your account executive to start the process.

Control PHI capture in meetings

\n

Healthcare organizations are responsible for controlling when and how PHI is introduced into the Otter environment. This includes managing features like Otter Notetaker, which can automatically join and record scheduled meetings.

\n

Customers should implement policies and technical controls to ensure PHI is not captured unintentionally or without proper authorization.

\n

Manage Notetaker for your Workspace

\n

Workspace admins can disable the option for members to use Notetaker in Workspace > Members > Notetaker.

\n
Learn more about managing Notetaker for your Workspace.\n
\n

\n

Review synced calendar events and connection

\n

Calendar integrations and user behavior should be carefully reviewed to prevent unintentional exposure of sensitive health information. Enforce policies with employees to ensure compliance.

\n

Users can review their calendar integration in Account Settings > Apps and the events synced over on the homepage calendar.

\n

Users should review their individual meeting settings for auto-join in Account Settings > Meetings to meet compliance. Admins can manage auto-join and share settings for the Workspace in Workspace > Settings.

\n
Learn more about managing Workspace auto-join and auto-share settings.
\n
\n

Disable Public and Link-Based Sharing

\n

Otter supports public and link-based transcript sharing, which is not appropriate when PHI is involved. Customers must explicitly disable these features to avoid unauthorized disclosures. Team administrators should enforce sharing restrictions within Otter’s settings and implement oversight to regularly audit and revoke any externally shared content that could contain PHI.

\n

Disable External sharing

\n

Workspace admins can disable external sharing in Workspace > Settings.

\n
Learn more about disabling external sharing.
\n
\n

Enforce Role-Based Access and Identity Controls

\n

Otter provides access controls at the user and team levels, including two-factor authentication (2FA) and Single Sign-On (SSO) for enterprise customers. Customers must implement these controls to enforce least-privilege access and reduce the risk of unauthorized PHI access. Account provisioning and de-provisioning should be tightly managed. Access for terminated employees or users changing roles must be removed promptly, ideally within 24 hours.

\n

Enforce 2FA for the Workspace

\n

Admins can enforce 2FA and set up SSO for the Workspace in Workspace > Settings.

\n
Learn more about setting up 2FA and Single Sign-On (SSO).
\n

Manage Workspace members

\n

Admins can deactivate, remove, or delete members from the Workspace in Workspace > Members.

\n
Learn more about managing members in your Workspace.
\n

User Awareness and Monitoring

\n

Administrators should routinely review Otter usage logs and dashboard activity. Any policy violations or abnormal behavior should be investigated in accordance with internal incident response procedures.

\n

View Workspace usage analytics

\n

Admins have a quick overview of all member usage in Workspace > Analytics.

\n
Learn more about Workspace analytics.
\n

\n

Review and manage conversations created in the Workspace

\n

Admins can see a quick overview of all conversations created in the Workspace, including filtering by title, owner, shared with, and start/end times.

\n

Learn more about Otter’s centralized conversation management.

\n
\n

Define and Apply Retention and Deletion Policies

\n

Otter supports customer-defined data retention policies and secure deletion of content. Healthcare organizations must configure transcript and recording retention in accordance with their HIPAA-compliant data lifecycle policies. Additionally, upon account termination or contract expiration, Otter will delete residual data per customer request. Customers should ensure data deletion actions are documented and verified.

\n

Set a custom data retention policy

\n

Customers have full control over how long a conversation remains in the Workspace. Once an admin sets a custom duration, all conversations created by users in the Workspace will be automatically deleted once the duration has been met. Deleted conversations will not be accessible by any user in the Workspace.

\n

Reach out to your account executive to get started. Learn more about setting a custom data retention policy.

\n
\nNote: For all questions regarding HIPAA compliance, speak with your account executive.
","user_segment_ids":[]}}