Is Windows Voice Access HIPAA compliant?

Not on the evidence we found. On October 17, 2026, we found no Microsoft statement that puts Windows Voice Access under a HIPAA Business Associate Agreement. Voice Access does its recognition on the PC ¹, which lowers one risk, but it does not settle the contract question. Treat Voice Access as unverified for protected health information until Microsoft confirms coverage in writing. This is general information, not legal advice. For the wider picture, see our overview of Windows dictation.

Voice Access works on the PC, which narrows the question

Microsoft says Voice Access lets you control your PC and write text using your voice "without an internet connection" ². Setup needs the internet, because Voice Access downloads language files "to be used by on-device speech recognition," and you need an internet connection to finish that download ³.

HIPAA's question is who handles your health information. A covered entity may let a business associate create, receive, maintain or transmit electronic protected health information on its behalf only after it obtains satisfactory assurances that the business associate will safeguard it ⁴. If Voice Access never sends your audio or text to Microsoft, Microsoft may not be handling your information on that path at all. We could not confirm that from Microsoft's pages. The FAQ's offline statement does not say what happens to your data ², and Microsoft's speech privacy article never mentions Voice Access.

The PC still holds whatever you dictate. A covered entity that uses Voice Access must include it in its risk analysis, because the Security Rule requires an accurate and thorough risk analysis of the electronic protected health information it holds ⁵.

Microsoft's HIPAA list does not name Voice Access

Microsoft says its Business Associate Agreement covers in-scope Microsoft services, meaning the services listed on its page ⁶. When we checked the Microsoft Cloud HIPAA page on October 17, 2026, it did not name Voice Access or Windows voice typing. The only speech entry is a Speech microservice in the Office 365 table ⁷. That table does not say which feature the microservice serves, and it does not mention Voice Access, so do not read it as covering Windows dictation.

A signed agreement is not the same as compliance

Even with an agreement in place, the result depends on how you use the service. Microsoft says its agreement helps support your HIPAA compliance, but using its services does not achieve HIPAA compliance on its own ⁸. Voice Access being on-device is a reason to ask fewer questions about audio. It is not a substitute for the written agreement or for your own risk analysis.

It depends on your account, your PC and your IT policy

• Personal account on a work PC. Microsoft's pages we read do not address this case. Ask your compliance team before anyone dictates patient information into it.
• Managed PC. We did not verify whether an administrator can control Voice Access by policy. Ask IT before you assume you can.
• Copilot+ PCs with fluid dictation. Microsoft says fluid dictation is enabled by default, and you can turn it off in settings or by voice ⁹. The default matters because a feature that is on without anyone choosing it is easy to forget in a compliance review.
• Older Windows versions. Microsoft describes Voice Access as a feature of Windows 11 ². Check your Windows version before you plan around it.

What to do before you dictate protected health information

1. Ask Microsoft in writing whether Voice Access is covered by a Business Associate Agreement for the account type you use.
2. Ask whether any Voice Access audio or text leaves the PC, and whether anything is kept after the text appears.
3. Check fluid dictation. Open Voice access settings, then Manage options, and turn Fluid dictation off if your compliance team asks you to.
4. Add Voice Access and the PC to your risk analysis, and record the answers.
5. Test before you rely on it. You can watch your network activity with a tool you trust while you dictate. That shows what your own PC sends, but it is not a compliance statement from Microsoft.

Until those answers are in writing, do not dictate protected health information into Voice Access.

For the voice typing side, which does send audio to Microsoft, read whether Windows dictation is HIPAA compliant. To see how the audio paths differ, read whether Voice Access sends audio to Microsoft and what Windows Voice Access is. Keep the terms Business Associate Agreement, protected health information and on-device speech recognition in mind when you read Microsoft's pages. For the wider choice, read our guide to HIPAA compliant dictation and our guide to Windows dictation privacy.