Your weekly care-coordination call on Zoom has an extra participant, and it isn’t a person. A payer’s case manager brought it, or someone on staff connected a free account. Either way, an AI notetaker nobody vetted for HIPAA is capturing every word of a patient’s discharge plan.
An AI notetaker is an app that joins or listens to a call, transcribes it and keeps the notes on its vendor’s servers. The question is who it’s really working for.
What’s actually happening in 2026
An AI notetaker should hear patient information only if its vendor has signed a business associate agreement (BAA) with your practice. As of October 2026, Otter.ai and Fireflies.ai offer HIPAA coverage only on Enterprise plans, according to Otter’s pricing page and Fireflies’ help center; on other plans, the vendor’s standard terms govern your recordings.
On August 13, 2026, a federal judge in California let wiretap and biometric-privacy claims against Otter.ai proceed. The court found it plausible that Otter is a third-party eavesdropper because it allegedly “retains their conversational data and uses it to improve its machine-learning models and services.” That’s a pleading-stage ruling, not a verdict. Otter’s privacy policy, effective June 16, 2026, lists training its AI on de-identified audio and on transcripts that “may contain Personal Information.”
Some tools never join as a bot. A class action filed July 30, 2026 alleges Granola transcribes meetings through the user’s own computer audio, with participant notices off by default. As of early October, Granola had not responded on the merits.
Even Zoom, which signs BAAs, says on its HIPAA support page that certain AI features may not be available to healthcare customers with a BAA.
Why this is a HIPAA problem, not just a wiretap problem
A vendor that receives, transcribes or stores PHI for your practice is a business associate (45 CFR 160.103), and you need a signed BAA before sharing PHI with it (45 CFR 164.502(e)). The BAA must define what the vendor may do with your data, so any no-training commitment belongs there. If PHI already went into a tool with no BAA, the Breach Notification Rule presumes a breach unless a documented risk assessment shows a low probability of compromise (45 CFR 164.402).
An outside participant’s notetaker is harder: it works for whoever brought it, and you have no say over its vendor’s retention or training. Your only safeguard is keeping PHI out of its hearing.
California and Massachusetts are also all-party consent states: recording a confidential conversation in California, or secretly recording one in Massachusetts, without everyone’s permission is illegal.
What to actually do about it
You don’t have to ban AI notes, but you do have to decide which notetaker hears PHI.
- Inventory every notetaker: a staff member’s free account is still a vendor holding your data, so your HIPAA risk assessment should cover Zoom and Teams apps, calendar connections and desktop apps.
- Approve one tool on a BAA-covered plan: the plan tier decides HIPAA coverage, so get the BAA and training terms in writing; our HIPAA compliance services include that review.
- Hold outside bots at the door: Microsoft Teams now holds detected external bots in the lobby by default, though Microsoft says some go undetected, and Zoom’s waiting room lets hosts remove uninvited tools; healthcare managed IT can enforce both.
- Keep PHI away from outside bots: you can’t vet their vendors, so ask for the bot to be removed or move patient details to a separate call.
- Announce every recording: all-party consent states require everyone’s permission, and some tools ship with participant notices off, so say it up front and turn them on.
Where ACS fits in
An unvetted notetaker trips no alarms; it just keeps a copy. ACS’s free 30-minute IT & HIPAA assessment checks which AI notetakers are connected to your Zoom, Teams, calendars and staff computers, whether each has a BAA on the right plan, and whether your meeting settings keep outside bots away from patient conversations.
