Do you need a BAA for dictation software?

Yes in most cloud setups, and no when the vendor never touches patient information. The test is not whether the software is medical or consumer. It is whether the vendor creates, receives, maintains or transmits protected health information (PHI) on your behalf. HIPAA defines a business associate as a person who, other than as a member of the covered entity's workforce, does those things ¹. A dictation vendor that receives your recordings or your transcripts usually fits that definition, and the business associate agreement (BAA) is the contract that covers it. This is general information, not legal advice.

A vendor that handles patient audio for you is a business associate

In its 2016 guidance on health apps, HHS says that most vendors and contractors that provide services to covered entities, and that involve access to PHI, are business associates ². A dictation service that receives recordings made during care is in that group. The Privacy Rule lets a covered entity share PHI with a business associate only after it obtains satisfactory assurance that the information will be safeguarded ³. In practice, the BAA is that written assurance.

HHS also says that the covered entity and a cloud service provider that holds its health information must sign a HIPAA-compliant BAA ⁴. Dictation that goes to a vendor's cloud can be the same kind of arrangement when the vendor holds the audio or transcripts.

Encryption does not remove the BAA requirement

Encryption can look like a way out of the contract. For cloud providers, HHS does not treat it as one. It says that lacking an encryption key does not exempt a cloud service provider from business associate status ⁵. A vendor that stores your audio in encrypted form can still be a business associate, so encryption is a safeguard you check for, not a way out of the BAA.

When no vendor receives patient information, no vendor BAA is needed

If recognition, storage and transcripts all stay on your device, the software maker never creates, receives, maintains or transmits PHI on your behalf, so the definition does not reach it. Apple, for example, says that Keyboard settings show whether dictated audio and transcripts are processed on the device or sent to Apple servers ⁶. If the answer is the device, the audio stays with you.

That is not the same as saying nothing leaves the device. Check for telemetry, crash reports, account sync and any AI step that rewrites your text. Any of those can send PHI to a vendor even when speech recognition runs locally. The question on on-device dictation and HIPAA covers this case in more detail.

The BAA must cover the feature, not only the company

A signed BAA with a company does not cover every product it sells. Google's Workspace list is a clear example. It names Google Drive, including Google Docs, among the services included in the Google Cloud BAA ⁷. Docs is covered, but the browser speech service that powers voice typing in Docs is not on that list. The same test applies to any dictation tool: the agreement has to name the feature that receives your audio.

Microsoft's pages show the same gap. A general statement that it signs BAAs with enterprise customers ⁸ does not say which dictation feature the agreement covers. Ask for the feature by name, every time.

What to do before patient information goes through a dictation tool

1. Map the data flow. Ask where the audio goes, where the transcript is stored, and whether any step, including updates, telemetry and AI cleanup, sends it elsewhere.
2. If any part leaves the device, ask for a signed BAA that names the dictation feature and the speech service, not only the company.
3. Read the contract, not the marketing page. Check the terms on storage, model training and human review. A promise on a web page is not a contract.
4. If there is no BAA, do not send PHI through that path. Use a tool whose recognition stays on the device, if you can confirm it.
5. Record the decision in your risk analysis. The Security Rule requires an accurate and thorough risk analysis of the electronic PHI you hold ⁹, and every dictation tool belongs in it.

It depends on who you are and what the vendor does

A solo clinician and a large clinic face the same test, but the paperwork differs. A clinic may also be a business associate for another practice, so the chain of agreements can be longer than one contract. A vendor that offers a BAA may only do so on certain plans, so check the plan you are actually buying. A vendor that does not offer a BAA at all is a clear reason not to use it for patient audio.

For the Windows and Microsoft case, read our question on whether Microsoft dictation is HIPAA compliant. The question on Google voice typing takes the same steps for Docs, and the question on Apple Dictation covers the Mac case. Our guide to HIPAA-compliant dictation puts these steps in order, and the voice privacy overview explains where audio goes on each platform.