Is transcription software HIPAA compliant, and how do you check?

No transcription tool is HIPAA compliant by itself, and a "HIPAA compliant" label on a product page does not prove that your use is compliant. HIPAA governs the healthcare organizations that hold patient information and the businesses that handle it for them. So the answer depends on your setup: who receives the audio, what they keep, and what you have written down. The guide to choosing transcription software covers the wider checks. This page covers the HIPAA ones.

HIPAA applies to the vendor once it handles patient information

HIPAA treats a company as a business associate when it handles patient information on your behalf. Under the rule, a business associate is a person who, other than as a member of the covered entity's workforce, creates, receives, maintains or transmits protected health information ¹. A transcription service that receives a recording of a patient visit, a case conference or a clinical interview is therefore in scope. Protected health information, or PHI, is health information that can identify a person.

HHS says that the covered entity and a cloud service provider holding its health information must enter into a HIPAA-compliant business associate agreement ². That contract is the written assurance HIPAA requires before the vendor touches the data.

Encryption does not remove the vendor from scope. HHS says that lacking an encryption key does not exempt a cloud service provider from business associate status ³. A tool that encrypts your audio on its servers still needs the agreement if it stores or processes that audio.

A signed agreement is necessary but it does not finish the job

Microsoft says that using its services "doesn't on its own achieve HIPAA compliance" ⁴. The same point holds for transcription tools. The agreement covers what the vendor promises. Your settings and your procedures decide what happens to the audio day to day, and HIPAA holds you responsible for both.

Settings can conflict with the agreement. Google's HIPAA page lists Speech-to-Text among its services and tells customers who have a BAA covering PHI not to opt in to data logging for it ⁵. A customer can hold a valid agreement and still breach its own terms by switching on a logging option. Read the agreement and the settings together.

Cloud tools, on-device tools and apps built on cloud APIs need different checks

The answer changes with where the audio goes. The table sets out the three common setups.

For the on-device row, our reading is that no outside party is a business associate when nobody else receives the PHI, because the definition turns on who receives it ¹. That is our reading, not a legal opinion. For the third row, Superwhisper's documentation recommends using your own API keys for organizations that already have HIPAA business associate agreements with an AI provider ⁶. That recommendation shows the chain: the app's own terms do not replace the agreement with the provider behind it.

An on-device app such as Yap, which we make, keeps the audio on your computer. That removes the vendor agreement question for the audio itself. It does not remove your own duties under HIPAA, described below.

It depends: several cases change the answer

• The recordings contain no PHI. Many transcription jobs, such as a podcast or a product interview, involve no patient information. Then the HIPAA checks do not apply, though other privacy rules might.
• Your organization is not a covered entity or business associate. HIPAA covers those organizations. If neither applies to you, HIPAA may not govern the recording, but other privacy law may still apply.
• The institution forbids the tool. Some organizations rule out a feature for regulated data even when the vendor offers a contract. Northwestern's guidance says its Zoom recording and transcription option should not be used with data subject to HIPAA ⁷. Your employer's rule overrides a vendor's marketing.
• The vendor says "HIPAA eligible" and nothing more. Ask for a signed agreement that names the product you will use. A label is not a contract.

How to check a transcription tool, step by step

1. Decide whether the audio contains PHI. Patient names with diagnoses, treatment details or appointment information count. If the answer is no, stop here.
2. Find out where the audio is processed. Ask whether it stays on your device or goes to a named provider and region.
3. Ask for a signed BAA for that exact product. Check that its scope covers the audio, the transcripts and any logs the tool keeps. Keep the signed copy.
4. Check the logging, retention and training settings. Turn off any logging the agreement excludes. If the vendor offers a zero data retention option, ask for it in writing as well, and confirm that it applies to the product you will use.
5. Ask how access is controlled. Find out who can open transcripts, whether each user has a separate account, and whether sessions end after a period of inactivity.
6. Record the decision. HIPAA requires an accurate and thorough risk analysis of the risks to electronic PHI ⁸. Write down the tool, its settings, the agreement and who approved it. Repeat the check when the vendor changes its terms.

Testing the output matters too. A transcript that drops or invents a sentence can put a wrong statement into a patient's record, even when the privacy setup is correct. Compare each transcript with its audio before you file it.

Where to go next

For the same question about specific products, read whether Apple dictation is HIPAA compliant, whether Google voice typing is HIPAA compliant, whether Microsoft dictation is HIPAA compliant and whether Whisper AI is HIPAA compliant. For transcription tools that use generative AI, see whether transcription software uses generative AI. The wider rules for dictation are in the guide to HIPAA-compliant dictation.

This page explains the rules and is not legal advice for your situation. Ask your compliance officer or a lawyer in your jurisdiction to confirm any arrangement before PHI goes into a tool.