Is Apple Dictation HIPAA compliant?

Apple has not shown that Dictation is HIPAA compliant. We found no business associate agreement (BAA) that covers it, and Apple's own privacy pages describe consumer terms, not a HIPAA commitment. Whether it is safe for your practice depends on where your speech is processed and on what agreement you have in writing. The steps below show how to decide.

Apple's published pages do not mention HIPAA or a business associate agreement

Apple's privacy page on Siri and Dictation, which we read on October 16, 2026, explains how audio and requests are handled. It does not mention HIPAA, health information or business associate agreements ( Apple, Siri, Dictation and Privacy). Its page on Improve Siri and Dictation says nothing on those points either ( Apple, Improve Siri and Dictation).

A page that leaves out a term does not prove that the term is excluded. Our searches turned up no Apple statement that it signs a BAA for Dictation or Siri. Most of the results were compliance vendors' blogs, and we did not treat those as evidence of Apple's position. Ask Apple in writing before you rely on it.

The two retention facts that matter most are consumer terms. Dictation sent to Apple's servers is not stored unless you opt in ¹. Apple may keep request history, including transcripts, for up to two years ². Neither is a promise to handle health information under HIPAA.

HIPAA requires a written assurance before a vendor handles health information for you

HIPAA's Privacy Rule allows a covered entity to let a business associate create, receive, maintain or transmit protected health information on its behalf only if the entity obtains satisfactory assurance that the information will be safeguarded ³. The usual form of that assurance is a written agreement, the business associate agreement.

HHS's cloud guidance says that a covered entity and a cloud service provider holding its health information must sign a HIPAA-compliant business associate agreement ⁴. HHS wrote that for cloud providers, not dictation apps. It still shows how regulators read a service that holds data on your behalf.

The answer changes with on-device and server dictation

On-device dictation is the stronger case. Apple says that, on a Mac, voice inputs and transcripts for general text Dictation are processed on your device and not sent to Siri servers ⁵. If the health information never reaches Apple, the business associate rules may not apply to Apple at all. That is a legal reading, so have counsel confirm it for your practice rather than assume it.

Server dictation is the weaker case. Your Mac's Keyboard settings say whether dictated audio and transcripts are processed on the device or sent to Apple servers ⁶. Not every language is processed on the device ⁷, so check the indicator for each language you dictate in.

Signing a BAA is necessary but not enough

Microsoft, which offers a BAA for its cloud services, says that using its services does not on its own achieve HIPAA compliance ⁸. Your practice still has to meet the Security Rule. Its audit controls standard calls for mechanisms that record and examine activity in information systems that contain electronic protected health information ⁹.

Apple's request history is linked to a random identifier rather than to your Apple Account ². In our reading, that means it does not give your practice a record of which staff member dictated what, so it cannot stand in for an audit trail. Treat this as our reading of Apple's description, not a finding from Apple.

What to do before you dictate patient information

1. Check the indicator. Open System Settings, click Keyboard, and read the line under Dictation for each language you use.
2. Turn off Improve Siri & Dictation if the indicator shows server processing, because Apple stores dictated audio only when you opt in ¹. To remove history that is already stored, see our guide to deleting Siri and Dictation history.
3. Ask Apple in writing whether it will sign a BAA that covers Dictation on your Mac, in the languages you use.
4. Get a decision from your privacy or compliance officer. Ask counsel to review the on-device reading before you rely on it.
5. If you have no written agreement, keep patient information out of server dictation. On-device dictation is the narrower option, and the settings still need checking.

Yap, which we make, is an on-device dictation app for Mac and Windows. We have not checked whether it signs a business associate agreement, so ask its vendor the same question before you use it with patient information.

This is general information, not legal advice for your practice. For the wider picture, read our guide to Apple's dictation privacy, our question on whether Apple keeps dictation recordings, and our guide to HIPAA-compliant dictation. You can also read whether on-device dictation is HIPAA compliant, whether you need a BAA for dictation and whether Microsoft dictation is HIPAA compliant. For the setting itself, see the Improve Siri & Dictation glossary entry.