Is on-device dictation HIPAA compliant?

For the recognition step, yes, with conditions. When speech recognition runs on the device, no vendor receives the audio, so there is no third party to sign a business associate agreement (BAA) for that step. HIPAA still applies to the device, the transcript and every copy of them. The honest answer is that on-device dictation can be used for protected health information (PHI) inside a compliant program. No software is certified as HIPAA compliant, and this does not make the device compliant by itself. This is general information, not legal advice.

On-device recognition takes the vendor out of the audio path

Apple says dictation on iPad is processed on the device in many languages, and that no internet connection is required ¹. The words "in many languages" matter. On-device support depends on the language, so check that your language is supported before you rely on it. On a Mac, Apple's Help says you can check whether general text Dictation is processed on your device and not sent to Siri servers ².

If the audio never leaves the computer, the question of whether a vendor is a business associate for that step does not arise. The vendor is not creating, receiving, maintaining or transmitting PHI. That is the reason the BAA question largely falls away. It is not a reason to skip the rest of the program.

Check the setting, because older versions and other paths sent words to servers

On-device is a setting, not a guarantee for every version. In the macOS Catalina 10.15 Dictation guide, keyboard dictation sent your words to Apple servers to be analyzed and converted to text in real time ³. That is a dated example, but it shows why you check the version and the setting on the machines you use, rather than assuming the answer from a product name.

The check is simple. Open the Dictation settings on each device, confirm the processing mode, and record the macOS or Windows version. If a computer is updated, check again, because the mode can change with the operating system.

The device still has to meet the Security Rule

The transcript and the recording are electronic PHI on the device, so the Security Rule's safeguards still apply to them. The Security Rule requires a unique name or number for identifying and tracking each user of an electronic system that holds ePHI ⁴. Shared logins make it hard to tell who dictated a record, so each clinician needs their own.

The Security Rule's technical safeguards also include audit controls: mechanisms that record and examine activity in systems that contain or use ePHI ⁵. Encryption is an addressable implementation specification, which means you must assess it and document what you do ⁶. For a laptop that holds transcripts, that usually means full-disk encryption, a locked screen and automatic logoff. Our reading is that these safeguards apply to a device that dictates just as they do to a device that stores notes.

An AI step after recognition can still send text out

Recognition can stay on the device while a later step leaves it. Superwhisper's documentation recommends that organizations which already have a BAA with an AI provider use their own API keys ⁷. That is a sign that some dictation tools send text to an AI provider after the speech is recognized. Check every step in the chain, including grammar cleanup, summaries and sync, not only the recognizer.

It depends on the device, the language and the app

The answer changes with four things. The first is the device: a lost, unencrypted laptop holds every transcript on it. The second is the language, because on-device support varies. The third is the app, since some dictation apps have a cloud mode or an AI rewrite option that is on by default. The fourth is the version of the operating system, as the Catalina example shows.

Our guide to HIPAA-compliant dictation covers the whole program, including the risk analysis. The question on whether you need a BAA for dictation software explains when a vendor must sign one, and the question on Apple Dictation applies the same checks to the Mac. The question on Windows dictation covers the Windows case, and the voice privacy overview explains where your voice goes on each platform.

What to do to make on-device dictation defensible

1. Turn off the network for a test dictation, and confirm that recognition still works. That shows the speech step does not need a server, though it does not prove that nothing else is sent.
2. Check the processing setting on each device, and record it with the operating system version.
3. Turn off any option that improves the service with your data, and confirm that your transcripts are not synced to a cloud account you do not control.
4. Secure the device. Use a unique login for each person, automatic logoff, encrypted storage and audit logs where the operating system or app offers them.
5. Document it. Put each device and dictation tool in your risk analysis, with the decision and its reason, because the Security Rule requires that analysis ⁸.

Yap, which we make, is an on-device dictation app for Mac and Windows. Its recognition runs on your computer, so it avoids the vendor-server step described above. It does not make a clinic compliant. The clinic still has to secure the device, control access and document its decisions. If you are under HIPAA, ask every vendor, including us, for its written terms before you use it with patient information. You can read about offline dictation on Mac to see how the on-device mode works.