Is Granola AI HIPAA Compliant?

Granola AI meets the Health Insurance Portability and Accountability Act (HIPAA) only on Enterprise, with a signed Business Associate Agreement (BAA).

At Layer3Labs, we build AI workflow automations for small and mid-sized businesses, and every rollout we do starts with the vendor's plan and contract terms.

The free Basic and $14 Business plans are not eligible for a BAA, so keep protected health information (PHI) out of them.

Enterprise Plan Requirements to Ensure Granola AI Is HIPAA Compliant

Granola supports HIPAA compliance exclusively on its Enterprise tier through an executed Business Associate Agreement (BAA).

As of October 2026, Granola pricing lists Enterprise at $35 per user per month, while Granola billing documentation notes Enterprise contracts start from $35 per user per month. You can upgrade to Enterprise yourself in workspace settings; talking to sales is optional.

A BAA is the contract a HIPAA-covered practice signs with a vendor that handles its patient data. Granola does not execute a BAA for accounts on the free Basic tier or the $14 Business tier, as outlined in the official Granola HIPAA policy.

Coverage Scope and Device Boundaries Under the Agreement

The Granola Business Associate Agreement covers meeting notes captured through Granola desktop and laptop applications running on macOS and Windows.

The Granola security FAQ limits the BAA to desktop and laptop apps, so the iOS and Android apps, the Apple Watch app and iOS phone calls fall outside it.

If a healthcare worker dictates patient notes into an iPhone, that data transmits without HIPAA protection. Keep Granola on managed clinic laptops and desktops only.

The Granola web application at notes.granola.ai allows viewing and editing existing notes, but it cannot capture live audio or create new transcripts. The BAA names only the desktop and laptop apps, so keep patient notes out of the web app too.

• Covered: Granola desktop and laptop applications running on macOS 14 or higher and Windows.
• Excluded: Granola mobile applications for iOS and Android devices.
• Excluded: Granola for Apple Watch audio capture.
• Excluded: Outbound telephone calls recorded through the iOS mobile application.

Security Architecture and Regulatory Certifications

Granola maintains an audited security architecture featuring System and Organization Controls 2 (SOC 2) Type II certification alongside encrypted data storage.

The Granola security page details that customer data is encrypted at rest and transmitted using Transport Layer Security (TLS) over HTTPS. Granola stores all workspace data on Amazon Web Services (AWS) servers located within the United States, backed by automated daily snapshots.

Granola complies with the General Data Protection Regulation (GDPR) and UK GDPR through its UK entity, Granola Labs Ltd. It offers a Data Processing Addendum (DPA) with standard contractual clauses. Granola says it runs penetration testing on a regular basis.

Granola is missing four items a compliance reviewer may ask about.

• ISO 27001: not yet available.
• Family Educational Rights and Privacy Act (FERPA): not currently compliant.
• NHS Data Security and Protection (DSP) Toolkit: not held.
• Two-factor authentication (2FA): none built in; sign-in security comes from Google, Microsoft or your single sign-on (SSO) provider (Enterprise, 50+ users).

Artificial Intelligence Model Training Defaults and Privacy

Enterprise workspaces in Granola have artificial intelligence model training disabled by default across all team members.

On the free Basic and $14 Business plans, model training is on by default. Granola may use anonymized meeting data to improve its own models unless you opt out.

Granola says it does not allow third parties such as OpenAI and Anthropic to train their models on your data. Clinical administrators can verify workspace-wide training opt-outs directly in Enterprise administrative settings.

Audio Deletion Architecture and Transcript Retention Controls

Granola does not record or store permanent meeting audio files during desktop transcription sessions.

Granola's security FAQ says audio is cached during the meeting for transcription only. Once transcription is complete, Granola deletes it from its systems and any third-party services.

Granola retains written transcripts and artificial intelligence summaries indefinitely on AWS servers unless an account holder configures an auto-deletion rule. Individual users can configure transcript auto-deletion schedules spanning 1 day to 1 year, subject to a seven-day cooldown period.

Enterprise administrators can establish mandatory workspace-wide retention rules by contacting Granola support. Enterprise policies have no cooldown.

• Audio caching: Audio is buffered temporarily during the call and deleted immediately upon transcript completion.
• Default storage: kept until deleted.
• Individual retention options: Users can select auto-deletion windows from 1 day to 1 year.
• Enterprise retention: Workspace administrators can enforce global auto-deletion policies across all accounts.

Clinical Setup Steps to Verify Granola AI Is HIPAA Compliant

Deploying Granola in a healthcare environment requires five technical and governance steps to maintain regulatory compliance.

• 1. Subscribe to the Enterprise tier and sign a formal BAA before handling protected health information.
• 2. Limit Granola installations strictly to approved desktop workstations, excluding mobile devices.
• 3. Verify that organization-wide model training toggles are disabled in workspace settings.
• 4. Set a transcript auto-deletion schedule that matches your records policy; it deletes transcripts only, so plan for notes separately.
• 5. Tell patients Granola is in use and get consent: turn on Granola Watermark or the automated chat message, and check state rules in our AI note-taker consent guide.

Operational Constraints and Practice Suitability

Granola Enterprise is unsuited for solo medical practitioners, mobile home-health clinicians, and practices requiring Electronic Health Record (EHR) integration.

Enterprise costs $35 per user per month, $21 more than Business, and that premium buys the BAA. Practitioners who see patients away from a desk cannot keep those sessions inside the BAA, because it covers only the desktop and laptop apps.

Granola's integrations list names no EHR system, so notes reach a chart only by copy and paste. Workspace jargon lets you add drug and procedure names to improve transcription. Teams seeking specialized medical scribing will find general productivity features insufficient for complex clinical charting.

Our verdict would change if Granola broadens its BAA coverage to include iOS and Android mobile applications. We would also revise our assessment if Granola introduces BAA eligibility on the $14 Business tier.

Compliant Alternatives for Non-Enterprise Healthcare Teams

Practitioners unable to purchase Granola Enterprise must transition to dedicated medical AI scribes or enterprise meeting platforms that provide accessible BAAs.

If you already use Granola on a free Basic or $14 Business subscription, stop capturing clinical conversations there, because those plans carry no BAA.

Healthcare administrative teams holding operational meetings can explore enterprise transcription platforms detailed in our guide to Otter.ai HIPAA compliance. Clinical practices requiring automated medical documentation should evaluate dedicated solutions analyzed in our review of HIPAA-compliant AI note-takers.

Before any patient conversation goes into Granola, move to Enterprise, sign the BAA and limit use to the desktop app.

This page is general information, not legal advice.