Resource
No — and unusually for this category, there’s no ambiguity to untangle: Granola says so itself, plainly, in its own documentation. That candor deserves respect. What needs correcting is the handful of third-party articles implying otherwise. Here is the record, and what clinicians who like Granola’s botless design can use instead.
Quick answer
No, on every plan.From Granola’s own help center: “Granola is not currently HIPAA compliant and should not be used to store or process Protected Health Information (PHI) at this time.” Its docs add that Granola “cannot sign Business Associate Agreements (BAAs)” and give no timeline for compliance. The $35/user Enterprise tier does not change this — no plan lists HIPAA, BAA, or PHI support.
Ignore third-party posts claiming otherwise. A few SEO articles imply Granola suits medical transcription. They contradict Granola’s own documentation, which is the only source that matters here.
For non-PHI work, Granola’s cloud posture is genuinely decent: SOC 2 Type 2 (achieved July 2025), GDPR with a standard DPA, botless capture, audio deleted after transcription, and contractual bans on OpenAI and Anthropic training on customer data. The structural facts remain: transcription happens in the cloud (Deepgram and AssemblyAI), note enhancement through OpenAI and Anthropic, and transcripts live on US-based AWS servers. That architecture is why the HIPAA answer is what it is — a cloud notepad would need a BAA chain across every one of those vendors to touch PHI lawfully, and Granola has chosen not to build one yet.
The appeal of Granola is real: no bot in the call, capture on your own device, notes that feel like yours. If that’s what drew you in, note that the part you like — device-side capture — is exactly the part that can be taken all the way. Minuteskeeps capture on your device like Granola does, then keeps transcription and storage there too: whisper.cpp locally, markdown on your own disk, owner-only permissions, open source. No vendor receives the conversation, so there is no business associate and no BAA question at all — for a solo practice, that’s the entire compliance conversation about the vendor, finished. (Your own duties — device encryption, access control, patient consent to recording — remain, as they do with any tool.)
If you need a cloud product with team features and a BAA, the documented options are Otter (Enterprise + BAA), Fireflies (Enterprise + Private Storage + BAA), and Fathom (published blanket BAA) — see our sourced write-ups linked below before relying on any of them.
Next step
This page is informational, not legal advice. Vendor policies change — verify against Granola’s current documentation and your compliance counsel before recording any patient conversation.