Otter.ai develops speech-to-text transcription and translation apps using artificial intelligence (AI) and machine learning. Many healthcare organizations use such solutions to properly record and backup communication with employees, patients, and other healthcare providers. To do so, however, those within the healthcare industry need to work with companies that are HIPAA compliant.
In the healthcare industry, sensitive protected health information (PHI) must be safeguarded under HIPAA. A major part of this compliance is working with vendors who will sign a business associate agreement (BAA) and ensure the security of PHI. Otter.ai does not mention a BAA on its website and may not be HIPAA compliant.
Otter.ai is a California-based company that creates speech-to-text transcriptions and translations. Its software, called Otter, shows captions of live speakers and uses AI to generate written transcriptions of speeches. Today, there are several Otter.ai apps and integrations available, including:
According to Otter, the idea is to have an AI assistant to record audio, write notes, caption action items, and generate summaries.
LEARN ABOUT: The future of machine learning and AI in healthcare security
HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates (i.e., vendors) of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.
A BAA is a written contract between a covered entity and a business associate. It outlines the responsibilities and obligations of each party regarding the handling of PHI. Typical provisions within a BAA include:
The agreement is required by law for HIPAA compliance and is considered the primary item to consider when it comes to Otter.ai and its ability to be HIPAA compliant. Otter.ai is a business associate of a healthcare organization if it is transcribing storing, processing, or transmitting PHI.
RELATED: How to know if you're a business associate
Generally, the HIPAA Privacy Rule allows healthcare providers to disclose PHI if they receive assurance that the information is protected through a signed BAA. We checked the Otter.ai website in 2022 for mention of healthcare and found no reference to HIPAA or a BAA. Questions about HIPAA compliance were asked (but not answered) on Reddit and Quora.
Today, there is still no mention of HIPAA or a BAA on the Otter.ai website. The Reddit and Quora questions were never answered completely.
Covered entities must consider the administrative, physical, and technical safeguards that a vendor utilizes to protect PHI. Healthcare websites function as a source of information, providing services and facilitating communication between patients and healthcare providers. With the increasing importance of data privacy and security, healthcare websites that collect, store, or process PHI are subject to HIPAA regulations.
According to Otter.ai’s privacy policy, the company utilizes physical, managerial, and technical safeguards. A privacy & security web page states that the company uses AWS (Amazon Web Services) cybersecurity for data at rest but not for data in transit. Other specific features mentioned by Otter.ai include access controls and data segregation.
Customers, however, are responsible for the information they provide to Otter.ai. Additionally, the user agreement states that customers “grant Otter.ai the right to collect, process, transmit, store, use, and disclose Data.”
SEE ALSO: Is voice recognition technology HIPAA compliant?
The BAA is a necessary component of HIPAA compliance and Otter.ai still does not appear to sign a BAA. Conclusion: Otter.ai may not be HIPAA compliant.
Healthcare providers know that clear and efficient communication with patients is necessary to run a successful practice. When evaluating a platform’s HIPAA compliance, especially on the cloud, consider the following security needs beyond a BAA: