Is Microsoft dictation HIPAA compliant?

Not on the evidence we could read, and the answer depends on which feature you mean. Microsoft has two dictation paths that matter here. Windows voice typing sends speech to Microsoft's online service, and we found no Microsoft statement that covers it under a Business Associate Agreement (BAA). Dictate in Microsoft 365 is a cloud service too, and it is the stronger candidate for a BAA route, but Microsoft's pages do not say that the Dictate button uses the service that the BAA covers. Confirm the feature you use, in writing, before you dictate patient information. This is general information, not legal advice.

No HHS certification exists, so the BAA and the feature decide it

Microsoft says there is currently no certification standard that the Department of Health and Human Services approves to show that a business associate complies with HIPAA ¹. No badge or logo settles the question. What counts is whether Microsoft has signed a BAA that covers the feature you use.

Microsoft says it enters into BAAs with covered entity and business associate customers when they use its enterprise products and services ². That statement is about enterprise products, so a personal Microsoft account is outside what it describes. Check which account and plan you dictate under.

Windows voice typing uses online recognition, which sends your speech to Microsoft

Microsoft says voice typing converts speech to text using online speech recognition ³. Under that path, Microsoft says it sends voice data to Microsoft "only to provide the service and create text transcriptions" ⁴. Patient audio sent that way leaves your device, so Microsoft would be handling protected health information for you. That is the situation a BAA exists for, and we found no statement that voice typing is covered by one.

You can switch online recognition off. Microsoft says you do this under Settings, Privacy & security, then Speech ⁵. When it is off, Microsoft says only device-based speech features, such as Narrator, are available ⁶. So turning it off protects your audio, but it may also remove the feature you wanted. Check what still works on your version of Windows before you rely on it.

Dictate in Microsoft 365 may be covered, but the pages do not say so

Dictate is a Microsoft 365 feature. It needs a Microsoft 365 subscription, a microphone and a reliable internet connection ⁷. Your speech is sent to Microsoft to produce the text ⁸, which is the case where a BAA matters.

Microsoft's HIPAA page lists a "Speech" microservice in its in-scope table for Office 365 ⁹. That is the closest match we found. But the table names the service without saying which feature calls it, and the Dictate help page does not name it either. We could not connect the two, so do not assume that Dictate is covered until Microsoft says so for your agreement.

What to do before patient information goes through either feature

1. Name the feature. Is it the Dictate button in Word, Windows voice typing, or dictation in another app? Each one can have a different answer.
2. Turn off online recognition for Windows voice typing if you do not have a BAA that covers it, using the Speech setting described above.
3. Ask Microsoft in writing whether your agreement covers the speech service that Dictate uses. Get the answer from your compliance officer, not from a product page.
4. Record the decision in your risk analysis. The Security Rule requires an accurate and thorough risk analysis of the electronic protected health information you hold ¹⁰, and that includes every dictation tool your staff use.
5. Default to not covered. If Microsoft has not confirmed the feature, do not send patient audio through it.

It depends on the account, the feature and the date

The answer changes with three things. The first is the account: an enterprise tenant with a signed BAA is a different case from a personal Microsoft account. The second is the feature: Dictate, Windows voice typing and Windows Voice Access are separate paths, and each needs its own answer. The third is the date. Microsoft changes its features and its in-scope lists, and the pages we read were checked on 16 and 17 October 2026.

If you want the Windows case in more detail, read our question on whether Windows dictation is HIPAA compliant. The question on Google voice typing takes the same steps for Google Docs, and the question on whether you need a BAA for dictation software explains when a vendor has to sign one. Our guide to HIPAA-compliant dictation covers the whole program, and the voice privacy overview explains where your voice goes on each platform.