Is Otter.ai HIPAA compliant?

Only Enterprise. Otter's help center says: "HIPAA compliance is only available for the Enterprise plan. Reach out to your account manager to start the Business Associate Agreement (BAA) process." Its pricing page lists "HIPAA compliance (add-on)" under Enterprise. Otter announced HIPAA compliance in July 2025.

Otter also makes the key point itself: it becomes a business associate only when a signed BAA is in place. On the Basic, Pro and Business plans there is no BAA, so those plans should not be used for client information.

Otter says plainly that it is "entirely cloud-based," and its security page says data is stored on Amazon Web Services in the US. It can keep recording without a connection, but transcription waits until you are back online.

Its privacy policy (effective June 2026) says Otter trains its own AI on de-identified audio recordings and on transcriptions, "which may contain Personal Information," and that it shares data with data-labeling providers. Otter says it de-identifies data before training and that its third-party AI providers don't train on customer data. Whether that is acceptable for therapy content is a judgment for your practice, but you should know it before you upload a session.

Otter is built around recording conversations and meetings and producing transcripts and summaries. Using it for therapy notes usually means recording the session, which brings in client consent, state recording laws and the question of who holds the recording. We compare that approach with dictating your own note in push-to-talk dictation vs AI scribes.

In August 2025 a class action was filed against Otter in federal court in Northern California, alleging that its meeting assistant recorded conversations without the consent of all participants and used them to train its AI. The cases were consolidated as In re Otter.AI Privacy Litigation(No. 5:25-cv-06911). In August 2026 the court granted Otter's motion to dismiss only in part: according to UC Today, the federal wiretap, California privacy and Illinois biometric claims survived, while the computer-fraud claims were dismissed. Otter filed its answer in September 2026.

These are allegations, not findings, and the case is still pending as of October 2026. It is a reminder that recording tools raise consent questions that typing or dictating your own note does not.

Some group practices and hospitals already pay for Otter Enterprise for meetings. Before anyone uses it with client information, ask your administrator four questions. Has the organization actually signed Otter's BAA, or only bought Enterprise? Does the BAA cover the specific features you plan to use? What retention period is set for recordings and transcripts? And how is consent collected from every person who is recorded?

If any of those answers is unclear, keep clinical conversations out of it until they are settled. A meeting tool that is fine for a staff meeting can still be the wrong place for a session.

If you want an AI to draft notes from recorded sessions, choose a scribe built for clinical work that signs a BAA on the plan you can afford, and get each client's consent. If you would rather not record clients at all, dictate your own note after the session.

Sapience Med is built for the second approach. It is push-to-talk dictation that runs entirely on your Mac or Windows PC, so no vendor receives your audio or text and there is no BAA to sign. It never records the client. For a broader look at the legal side, see do I need a BAA for dictation software? and how to write therapy notes faster without recording sessions.