Is Windows dictation HIPAA compliant?

Not on the evidence we found. On October 16, 2026, Microsoft's HIPAA pages did not name Windows voice typing or Voice Access. Microsoft offers a Business Associate Agreement ¹, the contract HIPAA requires with a vendor that handles health information, but whether it covers a given feature is the question. Until Microsoft confirms in writing that a feature is covered, treat Windows dictation as outside the agreement. That is a reading of public pages, not legal advice.

No HHS-approved certificate exists for business associates, so compliance depends on how you use the tool

Be careful with the word "compliant" for software. Microsoft says there is currently no certification standard approved by the Department of Health and Human Services that shows a business associate complies with HIPAA ². So no HHS-approved certificate shows that a dictation product is compliant.

The HIPAA Security Rule requires an accurate and thorough risk analysis of the electronic protected health information you hold ³. That analysis is your job, and it has to include the dictation tools your staff use.

The Business Associate Agreement has to cover the feature

A covered entity may let a business associate handle electronic protected health information only after it obtains satisfactory assurances that the business associate will safeguard it ⁴. HHS guidance says a cloud service provider that holds health information must sign a HIPAA-compliant business associate agreement ⁵. We read that guidance in an archived copy, because HHS's current page would not open.

The word that matters is in-scope. Microsoft's HIPAA page lists Azure and Azure Government among its in-scope cloud platforms and services ⁶. Windows voice typing uses online speech recognition ⁷, which sends voice data to Microsoft ⁸. The page does not name Azure Speech, Windows voice typing or Voice Access. So the Azure listing does not settle the question for dictation.

Cloud and on-device dictation carry different questions

The two dictation paths raise different questions, and neither has a clear answer for HIPAA yet.

Voice typing sends audio to the cloud, so the agreement question is the important one. Microsoft describes Voice Access as on-device ¹⁰, so less audio should leave the PC. That does not remove the need for a risk analysis or an agreement, because the PC still holds whatever the dictated text contains. On-device processing answers the audio question only, not the contract question.

Account type also changes the picture. On a work or school account, sharing voice data is not available, but voice typing still works ¹¹. That removes the optional clip sharing, but not the cloud path.

It depends: the answer changes with your setup

• Voice Access only. This is the lower-exposure setup, since Microsoft describes it as on-device. You still need a written answer about the agreement.
• Voice typing on a managed PC. Assume audio goes to Microsoft, and ask IT whether online speech recognition can be controlled by policy. We did not verify that Microsoft's pages allow it.
• Personal account on a work PC. Microsoft's pages we read do not address this case, so ask your compliance team before anyone dictates patient information into it.

What to do before you dictate patient information

1. Ask Microsoft in writing whether Windows voice typing or Voice Access is covered by a Business Associate Agreement for the account type you use.
2. Ask whether any dictated audio leaves the PC, and if so, whether any of it is kept after the transcript is returned.
3. Ask whether an administrator can turn off online speech recognition and voice clip contribution for your accounts.
4. Ask whether the speech recognition under fluid dictation runs online or on the device. Microsoft's pages we read do not say where it runs.
5. Include the dictation tools in your risk analysis, and record the answers.

Until those answers are written down, do not dictate protected health information into Windows voice typing. Our guide to HIPAA compliant dictation covers the wider choice. For the privacy switches themselves, read our guide to Windows dictation privacy. Our answer on what online speech recognition is covers the setting, and whether Voice Access sends your voice to Microsoft covers the on-device path. For Apple's dictation, see whether Apple dictation is HIPAA compliant. If you are comparing products, Yap, which we make, runs on the PC, but check its agreement terms with your compliance team as you would for any vendor.