Granola is not currently HIPAA compliant and cannot sign a Business Associate Agreement (BAA), according to its security and privacy FAQs. Therapists should not use it to process psychotherapy sessions, client assessments, crisis interventions, or other conversations containing protected health information (PHI).
Session documentation is important, but Granola's general meeting summaries do not establish clinical accuracy, a compliant recordkeeping workflow, or suitability for therapy notes.
Bot-free capture still uses cloud processing
Granola's transcription documentation says its desktop app runs on macOS and Windows, captures microphone and system audio, and passes audio to a transcription provider. Granola says it does not record or save meeting audio or video. Cloud AI processing creates enhanced notes.
The absence of a retained audio recording does not mean client information stays on your device. Transcripts and notes can contain the same sensitive information. Granola documents US AWS storage and encryption in transit and at rest; notes and transcripts are retained unless a retention policy is configured. These controls do not establish HIPAA compliance or replace a BAA.
Workflows to exclude
Keep Granola out of:
- Individual, couples, family, and group therapy sessions containing PHI
- Intake interviews, assessments, and treatment planning
- Crisis response, risk assessments, and safety planning
- Supervision or case consultations that identify clients
- Dictation of progress notes or client records
Do not assume a first name, initials, or a changed name makes a case discussion de-identified. Have your privacy or compliance adviser evaluate the actual information and workflow. Removing identifiers from the finished summary does not undo the earlier cloud processing.
Consent is necessary, but it does not solve this limitation
Informed consent for transcription does not supply a missing BAA or turn a general meeting tool into a compliant clinical service. Professional rules, licensing requirements, employer policy, and applicable law may impose additional restrictions.
For any permitted non-clinical use, explain the tool, its cloud processing, the purpose of the notes, who will receive them, and how long they will be kept. Obtain the required consent and use manual notes if participants decline. Granola's security and compliance guidance recommends disclosure and legal advice for jurisdiction-specific consent questions.
Do not assume therapy-specific capabilities
The cited product documentation does not establish validated recognition of therapeutic dynamics, complete crisis assessments, or clinical-grade SOAP notes. A template with clinical headings is not proof that the content meets documentation requirements.
It also does not establish direct integrations with SimplePractice, TherapyNotes, or TheraNest. Copying text into another system is different from a supported, reviewed integration, and does not resolve the original data-handling problem.
Choose a clinical documentation vendor based on its contract and evidence. Require appropriate PHI handling, a BAA for the intended service, retention and access controls, and a clinician review process. Check how it handles omissions, uncertain statements, speaker errors, and corrections before relying on generated notes.
Possible non-clinical use in a practice
An explicitly approved meeting about public marketing materials or office logistics may be suitable if it contains no PHI and everyone can keep that boundary. A staffing meeting that routinely turns into client case discussion is a poor pilot.
Start with a written list of allowed meeting categories, approved sharing and retention settings, and a process for stopping capture and reporting accidental disclosures. If those requirements cannot be met, do not transcribe the meeting with Granola.
For that narrow approved use only, consider Granola for non-clinical administrative notes. Review names, dates, decisions, and action owners before sharing the result.
Bottom line
Do not choose Granola for therapy-session documentation under its current documented HIPAA and BAA limitations. The medical transcription guide explains what to require from a clinical vendor; the enterprise security review covers Granola's general cloud and retention controls.
Recheck current official documentation and contractual terms before reconsidering clinical use. A security certification or a free trial is not evidence that a product can handle your clients' PHI.
Discussion
Giscus