Fact · Voice privacy and security

Under the HIPAA Security Rule, a covered entity may let a business associate create, receive, maintain or transmit electronic protected health information only if it obtains satisfactory assurances that the business associate will safeguard it.

Checked against its source on October 16, 2026

In the source's own words

“A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances”

45 CFR 164.308: Administrative safeguards, Legal Information Institute, Cornell Law School, 2026, 164.308(b)(1).

Open the original

What it measures: A clinic that uses a dictation product from a vendor that handles its patients' information on its behalf is a covered entity using a business associate. The satisfactory assurances are normally written into a business associate agreement.
What it does not show: This is the regulation's text, not legal advice. Whether a particular Mac app counts as a business associate depends on how it handles the data, so ask your compliance team.

Source

45 CFR 164.308: Administrative safeguardsGovernment and public statistics · Legal Information Institute, Cornell Law School, 2026

Under the HIPAA Security Rule, a covered entity may let a business associate create, receive, maintain or transmit electronic protected health information only if it obtains satisfactory assurances that the business associate will safeguard it.

In the source's own words

Source

Cited on

Under the HIPAA Security Rule, a covered entity may let a business associate create, receive, maintain or transmit electronic protected health information only if it obtains satisfactory assurances that the business associate will safeguard it.

In the source's own words

Source

Cited on