Fireflies.ai sits in on meetings, records them, and produces a searchable transcript with a summary and action items. It is widely used, it integrates with the video platforms most organizations already run, and it is good at what it does.
It also ends up in healthcare settings for predictable reasons. A practice adopts it for administrative meetings, someone notices how much writing it removes, and the question arises of whether it could handle a patient encounter instead.
Protected Health Information carries some of the strictest regulatory protections in the United States, and the answer to that question depends on details most product pages do not put front and center.
Is Fireflies.ai HIPAA compliant?
The short answer: yes, on Enterprise with Private Storage and a signed BAA
Fireflies offers a HIPAA Business Associate Agreement that you can sign yourself online. What you cannot do is put it into effect on a plan below Enterprise.
Fireflies' knowledge base states the requirement directly: "HIPAA compliance is only available on Enterprise plans." Enabling it takes two steps, both mandatory. Private Storage has to be switched on in Team Settings, because "HIPAA requires your data to be stored in a dedicated, private infrastructure." Then the BAA has to be signed at fireflies.ai/baa, where the page notes that "Private Storage is a requirement for the BAA to take effect."
Fireflies is also explicit that the arrangement can lapse: compliance "disables" if you downgrade your plan, turn off Private Storage, or remove the BAA.
So the split is:
- Free, Pro, and Business plans: Fireflies does not offer its HIPAA configuration on these tiers, so they fall outside the company’s published pathway for handling PHI.
- Enterprise with Private Storage enabled and a signed BAA: Fireflies' supported path for healthcare organizations.
One thing worth flagging for anyone doing their own research. Fireflies' security page states "HIPAA Compliant - Complete protection for healthcare and educational organizations" and lists the company as "Certified for GDPR, SOC 2 Type II, and HIPAA compliance," with no plan qualifier next to either statement. Read on its own, that page suggests HIPAA coverage comes with the product. The tier requirement appears on the pricing page and in the knowledge base. That gap is easy to miss, and it is the kind of thing worth checking on any vendor's site rather than taking a marketing page at face value.
Fireflies is one case of a general framework. For the requirements any AI tool must meet before it touches patient data, including the BAA, technical safeguards, and data-use restrictions, see our guide to what makes an AI HIPAA compliant.
What Fireflies.ai Publishes, and What It Means
1. The BAA is self-serve on the Enterprise plan
Credit where it is due: Fireflies has made the agreement easy to access online. A customer enters a legal entity name and effective date, then signs on screen. That reduces procurement friction for an eligible Enterprise workspace.
The constraint sits upstream of the signature. Fireflies publishes its Enterprise price at $39 per seat per month, billed annually, and the plan is annual only — there is no monthly option. Private Storage, which the BAA requires to take effect, is an Enterprise feature.
For a three-person practice, that is roughly $1,400 committed for a year before Fireflies’ HIPAA pathway is in place. Fireflies now markets SOAP, DAP, and BIRP note formats for healthcare, while BastionGPT pairs clinical note formats with a BAA on every plan and broader healthcare workflows.
2. The data training posture is a genuine strength
Fireflies states that its vendors and partners follow a 0-day data-retention policy. The same security page says meeting data is never used for AI-model training and that customer data is not used for training by default.
That is a strong vendor-processing and training posture. Fireflies also lets meeting owners delete their meetings, while Enterprise provides custom data-retention controls.
Those safeguards address data processing. A signed BAA and covered plan remain separate requirements for PHI.
3. SOC 2 Type II and GDPR address different requirements from HIPAA
Fireflies cites SOC 2 Type II certification, describing it as following "industry standards for data security, privacy, and confidentiality," and GDPR alignment for European data protection.
Both are meaningful. SOC 2 addresses controls and assurance. A BAA assigns contractual responsibilities for PHI, including safeguards, breach reporting, and subcontractor terms. Healthcare organizations need to verify that the applicable BAA covers their account and intended use.
4. Recording length is capped by plan
Fireflies limits how long a single recording can run, and the cap moves with the tier: 2 hours on Free, 2 hours on Pro, 3 hours on Business, and 4 hours on Enterprise.
For most meetings that is irrelevant. For a long intake, a multidisciplinary case conference, or a neuropsychological assessment session, it starts to matter, and the plan that lifts the cap is the same one that carries the annual commitment.
5. Fireflies now offers healthcare note formats
Fireflies has moved beyond general meeting summaries for healthcare users. Its current healthcare page says it can generate SOAP notes plus DAP and BIRP formats, and its healthcare launch materials also list GIRP and PIRP. These features narrow the output gap. BastionGPT’s differentiation is broader clinical workflow coverage, a BAA on every plan, and healthcare-specific tools in one workspace.
6. AI assistant access uses a separate credit system
Fireflies covers standard transcription, note-taking, and recap emails within its plans. Its advanced AI features use a separate credit system. Fireflies lists AI Skills, Daily Digest, Meeting Prep, custom summary sections, Voice Agents, Sales Assist, Slack Assistant, CRM autofill, and AskFred on Live Assist among the features that consume AI credits.
Credits are charged per query using dynamic pricing, with usage based on the complexity and effort required for the output. Each plan includes a one-time team credit allocation, from 20 credits on Free and Pro to 50 on Enterprise. Purchased credit packages renew monthly or annually, unused purchased credits do not carry over, and paid accounts can automatically move to the next credit tier when the balance runs out.
BastionGPT includes unlimited AI assistant chat on Professional, Professional Plus, and Ultra. Normal human use receives full access to the core healthcare AI assistant without per-query assistant charges. Safeguards monitor for bots and account sharing. Plan differences focus on capabilities such as document capacity, image and chart analysis, manual model selection, and enterprise controls. This gives practices predictable access for everyday work such as drafting notes, summarizing records, writing letters, and preparing appeals.
7. How it records is configurable, and that cuts both ways
Fireflies can record with a notetaker that joins the call as a participant, and it can record without one — its Chrome extension captures Google Meet, in the company's own words, "without a bot joining the meeting."
That flexibility is a real feature. Extension-based capture makes the practice’s consent workflow especially important. Healthcare organizations should disclose recording and follow the consent requirements that apply in each jurisdiction and care setting.
Practical Challenges of Using Fireflies.ai in Healthcare
The tier and contract gap is the whole problem for most practices
Organizations already using Enterprise with Private Storage and an executed BAA can focus on workflow fit and output quality. Other practices need to move to the annual Enterprise tier and complete both compliance steps before placing PHI in Fireflies.
Consent obligations apply on top of HIPAA
Recording a patient encounter raises consent requirements separate from HIPAA. State recording laws vary by jurisdiction, medium, circumstances, and the parties’ expectations of privacy. Some situations require every participant’s consent. Healthcare organizations should use a documented consent process that reflects applicable law, including any state rules governing AI in healthcare or behavioral health.
Mixed-use accounts are the realistic failure mode
The risk is rarely deliberate. A practice adopts Fireflies for administrative meetings that contain no PHI on a Business plan. Someone then enables it for an intake because the tool is already there. That intake falls outside Fireflies’ published HIPAA pathway, and the practice has an incident to assess.
Example. A behavioral health group uses Fireflies on a Business plan for weekly operations meetings. A therapist joining the practice sees it in the shared workspace and turns it on during a telehealth intake to save time on the note. The Business plan carries no BAA, and Private Storage is not available on it, so even a signed agreement would not have taken effect. The recording, transcript, and summary now sit with a vendor the practice has no HIPAA agreement with, even though Fireflies itself offers a BAA on a tier the practice does not hold.
Accuracy still requires review
Any AI-generated healthcare content requires review by a qualified professional before it enters the record. That applies to every tool in this category, including purpose-built ones.
BastionGPT: A Healthcare-First Alternative
For practices that want HIPAA-compliant transcription with a BAA on every plan, BastionGPT is built for healthcare from the ground up. It is used by 10,000+ healthcare organizations, has been reviewed by the American Psychological Association across adaptation to practice, safety, bias, security, and expertise, and publishes Microsoft Partner, Qualys Secured, and A+ SecurityScorecard trust signals. Its security program includes recurring third-party assessments and independent penetration testing.
A BAA is included with all plans. Every subscription includes a HIPAA Business Associate Agreement in the terms of use, including the free trial. No seat minimum, no tier gate, no separate storage product to enable first, and no annual commitment required. A solo practitioner on the $20 per month Professional plan receives the same standard BAA as every other plan, and signed copies are available via DocuSign on request. Custom redline BAAs are available on Ultra and as an add-on for Professional Plus practices with 50 or more users.
Customer Data is not used to train, fine-tune, evaluate, enhance, or improve any AI model, and Customer Data is not sold. Chats and uploaded documents remain available until users delete them or the account has been inactive for 30 days. Transcripts follow a user-controlled retention window with a 30-day default. Deletion removes content from the account immediately, and underlying data is purged within a maximum of 30 days.
An AI Scribe built for patient encounters. Unlimited transcription on all plans, with multi-speaker recognition for up to 10 speakers and recordings up to 240 minutes on every plan, including the $20 tier. Record live or upload audio from in-person visits, telehealth, or phone consults. It works alongside Zoom, Microsoft Teams, and Google Meet without placing a visible bot in the room.
Output in the formats documentation actually requires. Every recording produces Transcription, Summary, SOAP Note, Detailed SOAP Note, DAP Note, and Custom Note tabs. The scribe also generates BIRP, H&P, and progress notes, plus custom templates that match your own formatting and writing style.
Healthcare-appropriate content handling. BastionGPT supports discussion of sensitive topics including trauma, abuse, sexuality, and substance use, which general-purpose platforms sometimes block.
More than a scribe. Beyond transcription, BastionGPT drafts referral letters, discharge summaries, and intake reports, analyzes uploaded documents and, on Professional Plus and Ultra, clinical images, and supports prior authorizations and insurance appeals. It runs multiple leading AI models in one interface, configured for healthcare use, and the model lineup is kept current as new versions are released.
Works with what you already use. BastionGPT works alongside 50+ EMR and EHR systems, including Epic, Cerner, athenahealth, eClinicalWorks, SimplePractice, and TherapyNotes, through a copy or upload workflow with nothing for IT to install.
Security built for regulated data. BastionGPT reports an A+ SecurityScorecard rating, encrypts data at rest with AES-256 and in transit with TLS 1.2 or higher, undergoes independent third-party penetration testing at least annually, and uses infrastructure providers with current HITRUST CSF certifications and SOC 2 Type II attestations. Data residency is available in the USA, Canada, and Australia.
David Lopis, Director, Psychology Squared: "BastionGPT has a lot more capabilities [than ChatGPT] with data protection, so clinicians can more freely use AI."
Catherine Maxted, RN, Nurse Coordinator: "People compliment the quality and clarity of my documentation all the time now. I can't imagine working without Bastion!"
Comparison: BastionGPT vs. Fireflies.ai
| Feature | BastionGPT | Fireflies.ai |
|---|---|---|
| HIPAA compliance | BAA included automatically on all plans, including the free trial. No seat minimum, no prerequisite feature to enable. | Self-serve BAA at fireflies.ai/baa, but only effective on Enterprise with Private Storage enabled. Free, Pro, and Business plans are not covered. |
| Cost of the compliant plan | From $20 per user per month. | $39 per seat per month, billed annually. Annual only; no monthly option. |
| Healthcare specialization | Purpose-built for healthcare documentation, with note formats and workflows designed for clinical work. | Healthcare use case with SOAP, DAP, and BIRP formats, built on a broader meeting-assistant platform. |
| Recording length | Up to 240 minutes per recording on every plan, including the $20 tier. Unlimited transcription. | 2 hours on Free and Pro, 3 hours on Business, 4 hours on Enterprise. Unlimited transcription on paid plans. |
| Data and AI training | Customer Data is not used to train, fine-tune, evaluate, enhance, or improve any AI model, and Customer Data is not sold. Transcript retention is user-controlled with a 30-day default; chats and documents remain until deletion or 30 days of account inactivity. | States that vendors and partners follow a 0-day retention policy and that meeting data is not used for AI-model training. Enterprise adds custom data-retention controls. |
| Security assurance | A+ SecurityScorecard rating; independent third-party penetration testing; infrastructure providers maintain HITRUST CSF certification and SOC 2 Type II attestations; Microsoft Partner. | SOC 2 Type II and GDPR alignment. |
| Transcription output | Transcription, Summary, SOAP, Detailed SOAP, DAP, and Custom Note tabs on every recording. Up to 10 speakers. | Transcript, summary, action items, and healthcare note formats including SOAP, DAP, and BIRP. |
| Frameworks supported | HIPAA, PIPEDA (Canada), Australian Privacy Principles, FERPA. | HIPAA on Enterprise, GDPR, SOC 2 Type II. |
Conclusion
Fireflies.ai publishes a strong vendor-processing and training posture, provides a clear HIPAA pathway, and lets eligible Enterprise customers sign the BAA online. Those are meaningful advantages and they deserve to be stated plainly.
The constraint is the annual Enterprise commitment behind the signature. Fireflies’ HIPAA pathway requires the $39-per-seat monthly price billed annually, Private Storage, and a signed BAA. Fireflies now offers healthcare note formats, while BastionGPT gives solo practitioners and small practices a lower-commitment path with a BAA on every plan and a broader clinical-workflow toolset.
Most users can sign up and start using BastionGPT in about 10 minutes. There are no setup costs, a 7-day free trial, and no fixed commitments. Whether you need secure transcription, help drafting SOAP or DAP notes, or support with prior authorizations and insurance appeals, BastionGPT is designed to support HIPAA-compliant clinical workflows.
Begin with a 7-day free trial of BastionGPT.
BastionGPT is designed to assist healthcare professionals with documentation and clinical workflows. It does not replace professional judgment, clinical expertise, or human oversight. All AI-generated output should be reviewed by qualified professionals before use in clinical settings.
If you have questions or want to connect:
Email: [email protected] Phone: +1 (214) 619-8696 Schedule a Chat: Book a Meeting
Frequently Asked Questions (FAQ)
Is Fireflies.ai HIPAA compliant?
Yes, Fireflies.ai supports HIPAA use on Enterprise with Private Storage enabled and a signed BAA. Its knowledge base says HIPAA compliance is available only on Enterprise. Free, Pro, and Business plans fall outside Fireflies’ published HIPAA pathway.
Does Fireflies.ai sign a BAA?
Yes, and it is self-serve. Fireflies hosts the agreement at fireflies.ai/baa, where a customer enters their legal entity name and an effective date and signs on screen. The agreement only takes effect on an Enterprise plan with Private Storage enabled, and Fireflies states that compliance disables if the plan is downgraded, Private Storage is turned off, or the BAA is removed.
How much does Fireflies.ai Enterprise cost?
$39 per seat per month, billed annually. Enterprise is annual only; there is no monthly billing option. That is the plan HIPAA compliance requires, so it is the real price of a compliant Fireflies deployment.
Does Fireflies charge for its AI assistant features?
Fireflies includes standard transcription, note-taking, and recap emails with its plans. Advanced features such as AI Skills, Daily Digest, Meeting Prep, custom summary sections, Voice Agents, Sales Assist, Slack Assistant, CRM autofill, and AskFred use dynamically priced AI credits. Credits are pooled across the team, and purchased credits renew monthly or annually. BastionGPT includes unlimited AI assistant chat on every plan for normal human use, with safeguards against bots and account sharing. This gives healthcare teams predictable assistant access without per-query charges.
Can therapists use Fireflies.ai for session notes?
Fireflies’ supported path for patient-session use requires Enterprise, Private Storage, and a signed BAA. Its current healthcare materials publish SOAP, DAP, and BIRP note formats. Practices also need an applicable recording-consent process and professional review of generated notes.
Does Fireflies.ai use my recordings to train AI models?
Fireflies says its vendors and partners follow a 0-day data-retention policy and that meeting data is not used for AI-model training. Enterprise customers also receive custom data-retention controls. BAA coverage remains a separate requirement for PHI.
Does Fireflies put a bot in the meeting?
Fireflies can join a call as a visible notetaker participant or capture Google Meet through its Chrome extension without a bot. Healthcare organizations should disclose the recording and follow applicable consent requirements for each jurisdiction and care setting.
Is SOC 2 Type II the same as HIPAA compliance?
No. SOC 2 Type II describes a company's controls around data security, privacy, and confidentiality. A HIPAA Business Associate Agreement is a contract that assigns legal responsibility for PHI and obligates the vendor to specific safeguards, breach reporting, and subcontractor terms. A vendor can hold SOC 2 Type II and still be unusable with patient information if no BAA covers your plan.
What happens if I recorded a patient session on a Fireflies plan without a BAA?
Using a vendor to handle PHI on behalf of a covered entity generally requires the applicable BAA and safeguards. Stop the practice, determine what data was recorded and where it is stored, assess the incident under your breach-notification process, and involve counsel or your compliance officer.
Is there a HIPAA-compliant alternative to Fireflies.ai without an annual Enterprise contract?
BastionGPT includes a BAA with all plans, including the free trial, with no seat minimum and no annual commitment. It provides unlimited HIPAA-compliant transcription with multi-speaker recognition for up to 10 speakers and recordings up to 240 minutes on every plan, and every recording produces Transcription, Summary, SOAP, Detailed SOAP, DAP, and Custom Note outputs. Plans start at $20 per user per month.
Do I need patient consent to record a session, even with a compliant tool?
Yes. Recording consent is separate from HIPAA. Requirements vary by state, medium, context, and the parties’ expectations of privacy, with some situations requiring every participant’s consent. Use a documented consent process reviewed for the jurisdictions where you practice.
Disclaimer: This article provides general information about HIPAA compliance and AI tools based on publicly available information as of September 2026. It does not constitute legal advice. Healthcare organizations should consult qualified legal counsel and compliance experts to confirm their specific use of any technology meets HIPAA requirements and other applicable regulations. AI provider policies and features are subject to change.
Sources
- Fireflies Knowledge Base, "Set up HIPAA compliance for your workspace": https://guide.fireflies.ai/articles/3704059205-set-up-hipaa-compliance-for-your-workspace (Enterprise-plan requirement, Private Storage requirement, BAA step, conditions under which compliance disables)
- Fireflies.ai BAA: https://fireflies.ai/baa (self-serve signature process, "Private Storage is a requirement for the BAA to take effect")
- Fireflies.ai Pricing: https://fireflies.ai/pricing (Enterprise at $39 per seat per month billed annually, annual only; per-plan recording limits of 2h/2h/3h/4h; storage and AI credit allowances)
- Fireflies.ai Security: https://fireflies.ai/security (0-day retention with vendors and partners, no-training statements, SOC 2 Type II and GDPR references, unqualified "HIPAA Compliant" claim)
- Fireflies.ai Healthcare: https://fireflies.ai/use-cases/healthcare (SOAP, DAP, and BIRP note formats); Fireflies.ai Chrome Extension: https://fireflies.ai/product/chrome-extension ("without a bot joining the meeting," Google Meet capture)
- Fireflies Knowledge Base, "AI Credits Pricing and Overview": https://guide.fireflies.ai/articles/2114151875-learn-about-ai-credits (advanced AI features, per-query dynamic pricing, team-pooled credits, renewal and auto-upgrade terms)
- BastionGPT plan comparison: https://bastiongpt.com/#pricing (unlimited AI assistant chat on Professional, Professional Plus, and Ultra; normal-use safeguard explanation)
- 45 CFR § 164.502(e): https://www.ecfr.gov/current/title-45/section-164.502 (business associate disclosures)
- 45 CFR § 164.504(e): https://www.ecfr.gov/current/title-45/section-164.504 (business associate contract requirements)
- HHS, Business Associate Contracts guidance: https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html