Is Fireflies.ai HIPAA compliant? Does it sign a BAA?
The answer
Signs a BAA on specific plans
Yes, on its Enterprise plan with Private Storage. Fireflies.ai says its healthcare BAA is available there, and its HIPAA compliant version is on request.
Using Fireflies.ai on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call
On this page
What Fireflies.ai says
“BAA for healthcare and DSA for education, available on Enterprise with Private Storage.”
“The Fireflies HIPAA Compliant version is available on request.”
“We have signed BAAs with our vendors, prohibiting them from using patients’ Electronic Protected Health Information (ePHI) for AI training and storing it on their servers.”
What this means for ad tracking
Fireflies.ai records, transcribes and summarizes meetings, and its HIPAA page says it “helps doctors and healthcare organizations transcribe, summarize, search, and analyze clinical conversations” (Fireflies.ai), so a transcript can put a patient's name next to their condition.
A BAA with Fireflies.ai covers those transcripts on the Enterprise plan with Private Storage. It does not cover an ad platform, so a booked consult you count as a conversion should reach Meta or Google without any transcript content. Our guide to HIPAA compliant note taking apps and AI scribes compares other note takers, and our guide to HIPAA compliant AI tools covers other AI tools.
Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.
A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.
How Curve helps
- Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep Fireflies.ai for what it does well.
- Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
- Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
- Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
- Event Logs show what Curve sent to each platform and what the platform accepted.
- Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.
Book a call with Curve and Curve's team will walk through your tracking setup with you.
Frequently asked questions
Does Fireflies.ai sign a BAA?
Yes, on its Enterprise plan with Private Storage. Fireflies.ai's security page says: “BAA for healthcare and DSA for education, available on Enterprise with Private Storage” (Fireflies.ai). We checked Fireflies.ai's own pages on November 9, 2026.
Is Fireflies.ai HIPAA compliant?
Fireflies.ai says it is “Certified for GDPR, SOC 2 Type II, and HIPAA compliance” (Fireflies.ai), and that “The Fireflies HIPAA Compliant version is available on request” (Fireflies.ai). Use it with patient information only on the plan its BAA covers, and talk to your counsel about your own setup.
Which Fireflies.ai plan includes a BAA?
The Enterprise plan with Private Storage, which Fireflies.ai describes as “Dedicated cloud storage for your organization’s data” (Fireflies.ai). Ask Fireflies.ai to confirm the BAA for your account before clinicians record visits.
Does a BAA with Fireflies.ai cover my ad pixels?
No. A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing a BAA, so a booked consult you count as a conversion needs to reach them without any transcript content.
What does Curve Compliance do for ad tracking?
Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.
Does Curve Compliance sign a BAA?
Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.
Sources
Last checked . Vendors change their plans and terms, so confirm the current terms with Fireflies.ai before you send it patient data.
Related tools
- Does Otter.ai sign a BAA?Signs a BAA on specific plans. Enterprise plan.
- Does Plaud sign a BAA?Signs a BAA. On request, through Plaud's privacy team.
- Does Freed sign a BAA?Signs a BAA. Included in the platform Terms of Use; signed copy on request.
- Does Heidi sign a BAA?Signs a BAA. Every covered entity Heidi works with.
- Does Abridge sign a BAA?Signs a BAA. Healthcare customers such as hospitals and health systems, under their customer agreements.
- Does Zoom sign a BAA?Signs a BAA on specific plans. Paid plans such as Pro, Business, Business Plus and Enterprise.
- Does ChatGPT sign a BAA?Signs a BAA on specific plans. ChatGPT for Healthcare, Enterprise with Regulated Workspace, FedRAMP or Clinicians; API with Modified Retention.
- Does Meta sign a BAA?Does not sign a BAA. Business Tools Terms bar health information.
- Does Google Ads sign a BAA?Does not sign a BAA. Google Ads call terms disclaim HIPAA.
- Does Curve Compliance sign a BAA?Signs a BAA. Every plan: Compliance, Growth and Enterprise.
Track ad conversions under a BAA
Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.
Book a call