Do not use Granola to capture patient or therapy sessions; this guide does not recommend Granola for clinical capture. Granola documents HIPAA support for Enterprise customers with HIPAA enabled and a signed Business Associate Agreement (BAA). Its security FAQs limit current BAA coverage to desktop and laptop apps. Free, Personal, and Business accounts must not store or process protected health information (PHI). Therapists considering Enterprise must have their organization approve the exact contract, covered apps, settings, and clinical workflow before any clinical use is considered. A referral trial does not supply that approval.
Session documentation is important, but Granola's general meeting summaries do not establish clinical accuracy, a compliant recordkeeping workflow, or suitability for therapy notes.
Bot-free capture still uses cloud processing
Granola's transcription documentation says its desktop app runs on macOS and Windows, captures microphone and system audio, and passes audio to a transcription provider. Granola says it does not record or save meeting audio or video. Cloud AI processing creates enhanced notes.
The absence of a retained audio recording does not mean client information stays on your device. Transcripts and notes can contain the same sensitive information. Granola documents US AWS storage and encryption in transit and at rest; notes and transcripts are retained unless a retention policy is configured. These controls do not establish HIPAA compliance or replace a BAA.
Workflows to exclude
This guide excludes Granola from:
- Individual, couples, family, and group therapy sessions containing PHI
- Intake interviews, assessments, and treatment planning
- Crisis response, risk assessments, and safety planning
- Supervision or case consultations that identify clients
- Dictation of progress notes or client records
Do not assume a first name, initials, or a changed name makes a case discussion de-identified. Have your privacy or compliance adviser evaluate the actual information and workflow. Removing identifiers from the finished summary does not undo the earlier cloud processing.
Consent and account eligibility are separate requirements
Informed consent for transcription does not supply a missing BAA or turn a general meeting tool into a compliant clinical service. Professional rules, licensing requirements, employer policy, and applicable law may impose additional restrictions.
For any permitted non-clinical use, explain the tool, its cloud processing, the purpose of the notes, who will receive them, and how long they will be kept. Obtain the required consent and use manual notes if participants decline. Granola's security and compliance guidance recommends disclosure and legal advice for jurisdiction-specific consent questions.
Do not assume therapy-specific capabilities
The cited product documentation does not establish validated recognition of therapeutic dynamics, complete crisis assessments, or clinical-grade SOAP notes. A template with clinical headings is not proof that the content meets documentation requirements.
It also does not establish direct integrations with SimplePractice, TherapyNotes, or TheraNest. Copying text into another system is different from a supported, reviewed integration, and does not resolve the original data-handling problem.
Choose a clinical documentation vendor based on its contract and evidence. Require appropriate PHI handling, a BAA for the intended service, retention and access controls, and a clinician review process. Check how it handles omissions, uncertain statements, speaker errors, and corrections before relying on generated notes.
Possible non-clinical use in a practice
An explicitly approved meeting about public marketing materials or office logistics may be suitable if it contains no PHI and everyone can keep that boundary. A staffing meeting that routinely turns into client case discussion is a poor pilot.
Start with a written list of allowed meeting categories, approved sharing and retention settings, and a process for stopping capture and reporting accidental disclosures. If those requirements cannot be met, do not transcribe the meeting with Granola.
For that narrow approved use only, consider Granola for non-clinical administrative notes. Review names, dates, decisions, and action owners before sharing the result.
Recommendation
This guide recommends keeping therapy-session documentation out of Granola. Enterprise eligibility still requires a separate clinical, privacy, and contractual review. The medical transcription guide explains what to require from a clinical vendor; the enterprise security review covers Granola's general cloud and retention controls.
Recheck current official documentation and contractual terms before reconsidering clinical use. A security certification or a free trial is not evidence that a product can handle your clients' PHI.
Discussion
Giscus