On this page
The HIPAA compliant note taking apps and AI scribes are the ones whose vendor signs a business associate agreement (BAA) for the plan you use: Heidi, Freed, Abridge (in its customer agreements), Otter.ai (Enterprise plan), Plaud (on request), Notion (Enterprise Plan), Google Keep and Google Docs (under Google's Workspace BAA) and Doximity's AI tools each say so on their own pages. Apple's iCloud terms bar covered entities from using iCloud for PHI, which rules out notes synced to iCloud. Curve Compliance, which signs a BAA on every plan for its own service, keeps vendor statements like these in its BAA Directory.
Book a call. Checking every vendor that touches patient data? Curve Compliance signs a BAA on every plan and keeps PHI out of what your ad platforms receive: it replaces browser ad pixels with one script and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What makes a note taking app HIPAA compliant
A note app or scribe that stores patient details is a business associate, so it needs a BAA. HHS says that if a covered entity “uses a CSP to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP, the covered entity (or business associate) is in violation of the HIPAA Rules,” and that this holds “even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data” (HHS). End-to-end encryption alone does not remove the need for a BAA.
Three more things decide whether a given setup is safe. The BAA has to cover the plan and the features you use: Notion says “Any Beta Services are not covered by the BAA” (Notion). The account has to be set up the way the vendor's HIPAA guide says: Otter says public and link-based transcript sharing is “not appropriate when PHI is involved” and “Customers must explicitly disable these features to avoid unauthorized disclosures” (Otter.ai). And your own safeguards still apply: Microsoft says “using Microsoft services doesn't on its own achieve HIPAA compliance” (Microsoft).
AI scribes vs note taking apps
A note taking app stores what a clinician types. An AI scribe listens to a visit, transcribes it and drafts the note, so it hears PHI by design and often keeps audio for a while. That makes two questions matter more for scribes: what happens to the recording, and whether identifiers spoken aloud reach the AI model.
Vendors answer differently. Freed says “Patient recordings are saved only until the note has been completed, then automatically deleted” (Freed). Plaud says it “does not automatically redact patient-identifiable information (such as names, date of birth, or medical record numbers) that is spoken in a recording before it is processed by an AI model” (Plaud). Heidi says “all our data is locally hosted within the United States” (Heidi). Read each vendor's own page for the plan you are buying.
Which note taking apps and AI scribes sign a BAA
Each row quotes the vendor's own page, opened November 2, 2026. Linked names open the tool's BAA Directory entry where one exists.
| Tool | Type | Signs a BAA? | What the vendor says | Source |
|---|---|---|---|---|
| Heidi | AI scribe | Yes | “Heidi is a Business Associate under HIPAA. We make a BAA available to every covered entity we work with” | Heidi HIPAA page |
| Freed | AI scribe | Yes | “We also sign Business Associate Agreements (BAAs) with healthcare organizations” | Freed Security page |
| Abridge | AI scribe | Yes, in its customer agreements | Abridge says its processing of customer data is “governed exclusively by the terms of our agreements with those customers, including our Business Associate Agreements (BAAs).” | Abridge Privacy Policy |
| Doximity | Clinician network with AI tools | Yes, for tools it identifies as secure | PHI sent through “our communication tools, AI tools, member messaging, or electronic fax service” is handled under the Doximity Business Associate Agreement | Doximity Privacy Policy |
| Otter.ai | AI meeting notes | Enterprise plan only | “HIPAA compliance is only available for the Enterprise plan.” | Otter.ai Help Center |
| Plaud | AI recorder and notes | On request | To get a signed BAA, contact its privacy team: “The team will walk you through obtaining and signing the BAA.” | Plaud Support |
| Notion | Notes and docs | Enterprise Plan only | “To be eligible to sign Notion's BAA, you must subscribe to our Enterprise Plan.” | Notion Help |
| Google Docs and Google Keep | Notes and docs | Yes, under the Google Workspace BAA | Google lists “Google Keep” and “Google Drive (including Google Docs” among the Workspace services in its BAA | Google Cloud HIPAA page |
| Microsoft OneNote | Notes | Not named | Microsoft's in-scope list for Office 365 names OneDrive for Business, SharePoint Online, Office Online and Office Pro Plus, but not OneNote by name (Microsoft 365 entry) | Microsoft Learn |
| Apple Notes (iCloud) | Notes | No | Covered entities agree not to use iCloud for PHI “or use the Service in any manner that would make Apple (or any Apple Subsidiary) your or any third party's business associate” | iCloud Terms |
For general AI assistants such as ChatGPT, Claude, Gemini and Copilot, see HIPAA compliant AI tools that sign a BAA. A scribe or note app belongs in your security risk analysis like any other system that holds ePHI (45 CFR 164.308); see how to run a HIPAA risk assessment and the three kinds of HIPAA safeguards.
Recording visits: consent
HIPAA's BAA rules cover the vendor. Recording a conversation raises a separate question. Federal wiretap law allows a recording “where one of the parties to the communication has given prior consent to such interception” (18 U.S.C. 2511(2)(d)), and state laws can add their own rules. Telling the patient that an AI scribe is in use, and asking before you start it, avoids surprises. What your practice needs depends on your state, so talk to your counsel.
Keeping notes out of marketing tools
Clinical notes and marketing systems should not meet. A summary pasted into a CRM, an email tool or a general chatbot moves PHI into a tool that may not have signed a BAA, and using PHI for marketing needs the patient's authorization (45 CFR 164.508, paragraph (a)(3)). Keep scribe and note integrations pointed at your EHR, not your marketing stack.
The same goes for the website. Ad platforms such as Meta do not sign a BAA (Meta), so nothing from a visit should reach them. Curve's free website scan lists the pixels and trackers on your pages. For the wider program, see the HIPAA compliance checklist for marketing teams.
How Curve Compliance helps
Curve's BAA Directory answers one question per tool: does the vendor sign a BAA, and on which plans? Each entry quotes the vendor's own page, links to it and shows the date it was checked, with entries for Otter.ai, Plaud, Notion, Google Docs, Microsoft 365, Doximity and Apple iCloud among many others. A BAA covers the company that signs it, so check each vendor in your stack on its own.
For marketing, Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, with a fixed list of fields per platform and neutral event names. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve Analyst answers questions about your traffic, funnels and ad spend from your own account data. Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry), and Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: Heidi, HIPAA; Freed, Security and Privacy; Abridge Privacy Policy; Doximity Privacy Policy; Otter.ai, HIPAA; Plaud Support, patient-identifiable information and BAAs; Notion Help, HIPAA; Google Cloud, HIPAA compliance; Microsoft Learn, HIPAA and HITECH; Apple, iCloud Terms and Conditions; OpenAI Help Center, BAA; HHS, Guidance on HIPAA and Cloud Computing; 45 CFR 164.308; 45 CFR 164.312; 45 CFR 164.508; 18 U.S.C. 2511.
Frequently Asked Questions
Which note taking app is HIPAA compliant?
One whose vendor signs a BAA for your plan: Heidi (Heidi) and Freed (Freed) say they sign BAAs, Otter.ai offers one on its Enterprise plan (Otter.ai), Notion on its Enterprise Plan (Notion), and Google Keep and Google Docs are covered by Google's Workspace BAA (Google).
Is OneNote HIPAA compliant?
Microsoft offers a BAA by default for in-scope Office 365 services, but its in-scope list names OneDrive for Business, SharePoint Online, Office Online and Office Pro Plus, not OneNote by name (Microsoft). Ask Microsoft whether your OneNote setup falls under those services before notes hold PHI.
Is Otter.ai HIPAA compliant?
On the Enterprise plan with a signed BAA. Otter says “HIPAA compliance is only available for the Enterprise plan” and that it “becomes a Business Associate only when a signed BAA is in place” (Otter.ai; Directory entry).
Is Notion HIPAA compliant?
On the Enterprise Plan. Notion says you must subscribe to it to sign its BAA, and that Beta Services are not covered (Notion; Directory entry).
Does an AI scribe need a BAA?
Yes. A scribe creates and stores PHI for the practice, and HHS says a service that stores ePHI is a business associate even if it lacks the encryption key (HHS). Heidi (Heidi), Freed (Freed) and Abridge (Abridge) say they sign one.
How do you make an app HIPAA compliant?
Run a risk analysis of the risks to ePHI (45 CFR 164.308), build the technical safeguards: access control, audit controls, integrity, authentication and transmission security (45 CFR 164.312), and sign a BAA with every vendor that stores or processes ePHI for you (HHS).
Can I paste patient notes into ChatGPT?
Not into a plan without a BAA. OpenAI says “We do not offer a BAA for ChatGPT Business,” and handles BAAs for sales-managed Enterprise or Edu accounts and the API through its own process (OpenAI; Directory entry). See HIPAA compliant AI tools.
Talk to Curve Compliance
Book a call. Want marketing tools that keep PHI out of your ad platforms? Curve Compliance sends conversions server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.