A HIPAA-compliant meeting transcription tool is one that can handle protected health information (PHI) under the rules of the Health Insurance Portability and Accountability Act, codified at 45 CFR Parts 160 and 164.
PHI is any health information that can be linked to a specific patient. In practice, the tool needs technical safeguards, the right contract and clear operating rules so it can be used legally by a covered entity (a healthcare provider, health plan or clearinghouse) or by one of its business associates.
The HHS Office for Civil Rights (OCR) enforces HIPAA. NIST Special Publication 800-66 offers implementation guidance for the Security Rule.
Not every AI notetaker is set up for HIPAA. The contract that decides it is the Business Associate Agreement (BAA): a written agreement in which the vendor commits to protect PHI and to use it only for the purposes HIPAA allows.
Without one, a vendor cannot legally process PHI, no matter how strong its encryption or audit logs look. Review the contract alongside the vendor's safeguards and configuration options.
⚠️ This article is general guidance, not legal advice. Your compliance officer or counsel should approve any tool you bring into a clinical workflow.
What does HIPAA actually require of a transcription tool?
HIPAA doesn't list approved tools. It sets standards a tool must meet when it handles PHI. Those standards sit in two rules, which the HITECH Act later strengthened:
The Privacy Rule
The Privacy Rule governs how PHI can be used and disclosed. For a transcription tool, this means PHI can only be processed for permitted purposes (treatment, payment and healthcare operations) and only by an authorized business associate.
The Office of the National Coordinator for Health IT (ONC) sets interoperability rules that may come up in the same vendor review.
The Security Rule
The Security Rule sets the technical, physical and administrative safeguards that protect electronic PHI (ePHI).
For a transcription tool, that means encryption in transit and at rest, access controls, audit logs, automatic logoff, integrity controls and a documented incident response process.
The rule doesn't name a specific algorithm: AES-256 at rest and TLS 1.2 or TLS 1.3 in transit are common benchmarks.
The three questions that matter
Three questions matter most when you apply these rules to a transcription product: who has access to the data, where the data is stored and what happens to it over time. Look for clear, documented answers to all three questions before proceeding.
The HITRUST Common Security Framework (CSF) can help organize the security requirements you assess.
Why isn't every AI notetaker HIPAA-compliant by default?
Many AI notetakers were built for general business uses (sales calls, internal meetings and customer success), where the data is sensitive but not regulated under HIPAA. Three gaps can rule them out for clinical use:
Training on customer data
Some AI tools can use customer recordings to improve their models. If PHI is used this way, the BAA has to allow it. In a clinical setting it usually shouldn't happen at all.
Before you go further, check that training can be switched off, as covered in our guide to the security and privacy risks of AI notetakers.
No BAA on offer
A Business Associate Agreement is the contract that makes a vendor a legal business associate of the covered entity. Without it, the vendor is not allowed to handle PHI. Some vendors don't offer one or only offer it on certain plans.
Zoom for Healthcare, Microsoft Teams and Google Workspace offer BAAs on specific paid plans, so check the specific plan and services covered by the agreement.
Subprocessors with unclear data handling
A transcription tool often relies on other vendors: a speech-to-text API, a Large Language Model (LLM) provider and a cloud host (typically AWS, Microsoft Azure or Google Cloud Platform).
These subprocessors also handle PHI, so each one must be covered by its own BAA with the vendor. If your vendor can't list its subprocessors and confirm that coverage, treat it as a gap.
A SOC 2 Type II report is not the same as HIPAA compliance. SOC 2 is a security framework from the American Institute of CPAs (AICPA); HIPAA is a federal regulation. A SOC 2 report helps the security review but does not replace a BAA. The same goes for HITRUST or ISO 27001 certification.
Start by reviewing the BAA
A Business Associate Agreement is the contract under HIPAA that binds a vendor (the business associate) to protect PHI on behalf of a covered entity. It defines:
- What PHI the vendor will access
- The permitted uses and disclosures
- The safeguards the vendor will maintain
- The breach notification timeline
- The vendor's obligations for subprocessors
- What happens to the PHI when the contract ends
Who should review the BAA?
On the covered-entity side, the Chief Information Security Officer (CISO), the Chief Compliance Officer and the Privacy Officer usually share the BAA review, with final approval from the General Counsel (the head of legal).
The American Health Information Management Association (AHIMA) publishes practitioner guidance that compliance teams can use as a reference for the review.
What to read carefully
If a vendor will not sign a BAA, it cannot legally handle PHI and the evaluation stops there. If it will, read the agreement carefully, especially the breach notification timeline, the data retention terms and the subprocessor clause.
A signed BAA is necessary but not sufficient. Covered entities are still responsible for how the tool is configured and used. A configuration mistake on the covered entity's side is still the covered entity's violation, BAA or not.
Data residency, retention and PHI handling
Check these three areas before choosing a tool.
Residency
Data residency is where the recordings, transcripts and derived data are physically stored. HIPAA does not require PHI to be stored in the United States, but storage location affects the risk analysis the Security Rule asks for.
Many US healthcare organizations also require US storage in their own policies or contracts. Some tools store data in several regions by default, some let you choose a region per workspace and some can't tell you where the data is.
Research hospitals with EU patients often need EU storage under GDPR as well.
Retention
Retention is how long the tool keeps PHI and what triggers deletion. HIPAA does not set a general retention period for medical records; state laws usually do, together with each organization's own policies.
What HIPAA does require is that PHI stays protected for as long as it is kept, through to its disposal.
Electronic Health Record (EHR) systems like Epic, Cerner (Oracle Health), Meditech and Allscripts remain the primary clinical record; the transcription tool is a tool that supports documentation. It needs configurable retention policies and verifiable deletion.
PHI handling controls
Who can see what. Look for Role-Based Access Control (RBAC), audit logs of every PHI access, automatic logoff after inactivity, the option to redact (hide or remove) PHI in shared summaries and a clear separation between user accounts and patient data.
Integrations with EHR, Picture Archiving and Communication Systems (PACS) and Radiology Information Systems (RIS) should be covered by the BAA chain, not bypass it.
A 10-item vetting checklist
Use this when evaluating any meeting transcription tool or AI notetaker for clinical use:
- Will the vendor sign a BAA? If yes, get a copy of its standard BAA before going further.
- Are all subprocessors (speech-to-text, LLM and hosting) listed and covered by a BAA? Get the list in writing.
- Is customer data used to train AI models? It must be possible to turn this off; ideally it is off by default.
- Where is data stored? Can you choose the storage region per workspace?
- What encryption is used at rest and in transit? AES-256 at rest and TLS 1.2 or later in transit are common benchmarks.
- Can retention be configured and is deletion verifiable? Look for documented retention policies and audit logs that show when data was deleted.
- Are role-based access controls and audit logs available? Can you see who accessed which transcript and when?
- Is there a documented breach notification process and what is the timeline? HIPAA requires notification without unreasonable delay.
- Does the vendor have a SOC 2 Type II report in addition to a BAA? It supports the security review but does not replace a BAA.
- What happens to your data when the contract ends? You should be able to export everything and verify deletion.
If a tool fails items 1, 2 or 3, don't take it to a pilot. A tool that fails any of items 4 to 10 may still work, but only if your compliance team explicitly accepts the risk.
Configuration decisions that keep a compliant tool compliant
Signing a BAA doesn't make daily use compliant. Check these five settings before using the tool.
Disable training on customer data explicitly
Even if the default is off, confirm the setting in the admin panel, take a screenshot and add it to your configuration record.
Restrict workspace access to named users
Give each person an individual account so access can be traced to a specific user. Single Sign-On (SSO) via SAML or OpenID Connect (OIDC) with Okta, Microsoft Entra ID or Google Workspace adds another layer of control.
Set retention to the minimum your clinical workflow needs
The longer data is kept, the higher the risk. If the primary clinical record is the EHR (Epic, Cerner, Meditech), the transcription tool should hold a working copy, not an archive.
Turn off integrations that aren't HIPAA-covered
If Slack, Notion or a generic CRM isn't covered by your BAAs, don't send PHI to it. An integration doesn't inherit the main product's coverage, so check each one, including whether the covered plan (Slack Enterprise Grid with a BAA, for example) is the one in use.
Review access logs monthly
Make access-log reviews part of your routine. Unusual patterns (after-hours access or access to records of patients outside someone's caseload) should lead to a conversation.
Where HIPAA-compliant transcription is used
Common uses include:
- Telehealth visits where the clinician needs the encounter documented without typing during the conversation
- Multidisciplinary care team meetings where tasks must be recorded and assigned
- Clinical research interviews where verbatim transcripts are part of the study record
- Clinic and practice management meetings that touch on patient cases
- Compliance and risk reviews that refer to specific encounters
Outside the consultation room, the same tool often supports administrative meetings (billing, operations and vendor management) where PHI may come up incidentally.
How MeetGeek handles HIPAA
MeetGeek offers a Business Associate Agreement for eligible plans, SOC 2 Type II, configurable EU and US data residency, encryption at rest and in transit, role-based access controls, audit logs and a documented breach notification process.
Customer data is not used to train AI models. Subprocessors are listed in the security and compliance documentation. The details are on the MeetGeek HIPAA page.
MeetGeek's Meeting Agent joins meetings, creates structured summaries and organizes follow-up tasks. Healthcare teams should confirm which features and settings are covered by their agreement before using it with PHI.
With AI Chat inside MeetGeek, you can ask questions about your meetings and find what was said or decided.
You can also connect MeetGeek to Claude through the MeetGeek connector to search and summarize across many meetings, for example for quarterly compliance reviews or case summaries.
Before using any connected service with PHI, confirm that it is covered by your agreements.
The bottom line for clinical operations
A transcription tool is HIPAA-compliant when three things line up: a signed BAA, technical safeguards that meet the Privacy and Security Rules and a configuration on the covered-entity side that keeps both in place.
Even a tool that meets the first two needs ongoing discipline (training disabled, individual accounts, minimum retention and audit-log reviews) to stay compliant in daily use.
The 10-item checklist above gives your team a clear basis for deciding whether to proceed with a pilot.
If your meetings never touch PHI, a general-purpose AI notetaker is often enough. If they do, look for a HIPAA-ready platform like MeetGeek and run the checklist with your compliance team.
Try MeetGeek with your team
Start free with non-sensitive sample data and confirm BAA eligibility before using it with PHI.
Frequently Asked Questions
Is any AI notetaker HIPAA-compliant out of the box?
No tool is "HIPAA-compliant" as a label. Compliance comes from the vendor's safeguards, a signed BAA and how your team configures and uses the tool.
A vendor that offers a BAA, a choice of data storage location, no model training on customer data and a SOC 2 Type II report meets several important evaluation criteria, but the configuration and use on your side complete the picture.
What is a Business Associate Agreement (BAA)?
A BAA is a contract required by HIPAA between a covered entity (or another business associate) and a vendor that handles PHI on its behalf. It defines the permitted uses, the safeguards, breach notification and the obligations for subprocessors. Without a BAA, the vendor can't handle PHI.
Is SOC 2 Type II the same as HIPAA-compliant?
No. SOC 2 Type II is an independent audit of a vendor's security controls over a period of time. It supports a HIPAA review but does not satisfy HIPAA on its own. The BAA and the specific HIPAA safeguards still need to be in place.
Can I use a free or consumer AI notetaker for a clinical meeting?
Only if the vendor signs a BAA that covers the plan you use and the tool passes the checklist above. Free and consumer plans may not include a BAA, may use customer data for training or may not list their subprocessors.
Using a tool with PHI without a BAA is a HIPAA violation by the covered entity, whatever the vendor's marketing says.
What about meetings that don't involve patients, like billing or ops calls?
What matters is whether PHI can come up, not whether a patient is in the meeting. If patient information may be discussed, even incidentally, treat the tool as if it handles PHI. If the meeting can't involve patient information under any circumstance, the standard is lower.
What happens if a vendor has a breach?
Under HIPAA, a business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovering a breach. Some BAAs set a shorter deadline. Once notified, the covered entity has its own breach notification obligations. A vendor that's vague about breach timing is a red flag.
Does HIPAA apply to telehealth calls in the same way?
Yes. HIPAA applies to PHI regardless of channel. A telehealth call is subject to the same Privacy and Security Rule requirements as an in-person visit. The transcription tool handling the recording is a business associate like any other.
.avif)