Which dictation apps and software are HIPAA compliant?

No dictation app is HIPAA compliant by itself, and HIPAA does not certify software. HIPAA sets duties for the people and organizations that handle protected health information. So the answer depends on the arrangement around the app: where the audio goes, whether the party that receives it has signed a business associate agreement (BAA) that covers the feature you use, and what your organization does to secure the device and its records.

The tools below are the ones we checked, and each claim comes from the vendor's own pages or from a primary source. For the wider picture, read our guide to HIPAA-compliant dictation. For the privacy basics, start with the voice privacy overview.

Any vendor that receives patient audio needs a BAA

HHS says that the covered entity and a cloud service provider that holds its health information must sign a HIPAA-compliant business associate agreement ¹. A cloud dictation service that receives patient audio is in the same position, because it handles protected health information for the clinic. If there is no signed BAA, sending that audio to the service is the compliance problem, whatever the product page says.

A BAA is necessary, but it is not enough. Microsoft says that a Business Associate Agreement does not on its own make an organization compliant with HIPAA ². The agreement sets the vendor's duties. Your own safeguards still have to be in place: unique logins, logoff on shared machines, audit records ³, and a documented risk analysis.

Dragon Medical One's seller terms name a BAA, but you need the signed copy

Dragon Medical One is the clinical product in this group. The terms of service for Dragon Medical USA, a seller of the product, list a business associate agreement among the agreements that govern it, including one among the vendor, the customer and the customer's healthcare group ⁴. That page does not contain the BAA, and we did not find a copy published by Nuance or Microsoft. Ask for the signed agreement that applies to your deployment, and check that it names Dragon Medical One.

Wispr Flow and Superwhisper offer BAAs, but the plan or setup decides

Wispr Flow says BAA signing is available on Mac, Windows and iOS ⁵. Its Growth and Enterprise organization plans both include a standard BAA ⁶. Members of an organization with active billing cannot sign personal BAAs, so they should ask their admin ⁷. Individual accounts can sign too, and downloading the signed copy requires an individual, non-enterprise account ⁸. An applicable signed BAA locks both data-sharing controls off ⁹, and Wispr Flow tells you to confirm both settings are off before dictating patient information ¹⁰.

Superwhisper describes a local-only setup, a cloud setup and a bring-your-own-key setup, and the contract depends on which one you use. In its local-only setup, the compliance page says: "No audio or transcripts leave the device. No BAA required with Superwhisper for those models." ¹¹ Its cloud models need Superwhisper's own BAA ¹². For bring-your-own-key, Superwhisper recommends that organizations that already have a BAA with an AI provider use their own API keys ¹³, because the provider agreement governs how the data is handled ¹⁴. Get Superwhisper's position on the setup you use in writing before you rely on it.

The table summarizes the vendor pages and what to confirm before patient audio goes through each tool.

Microsoft's Dictate sends speech to Microsoft, and we found no BAA statement for it

In Word, Microsoft says that when you use Dictate, your speech utterances are sent to Microsoft and used only to provide text results ¹⁵. Microsoft's HIPAA and HITECH page lists Azure among its in-scope cloud platforms ¹⁶ and a Speech microservice in its Office 365 in-scope table ¹⁷. The Dictate feature is not named there. We did not find a statement that Dictate is covered, so treat it as not covered until your Microsoft account team confirms it in writing. Our question on Microsoft dictation covers the Windows and Office cases in more detail.

On-device recognition removes the vendor BAA for that step only

When recognition runs on the computer, there is no outside party to sign a BAA with for that step. This is the case Superwhisper's local-only setup describes. The device still holds the audio, the transcript and the edit history, and the HIPAA Security Rule applies to that copy.

Yap, which we make, is an on-device dictation app for Mac and Windows, so recognition does not send audio to a vendor. That removes the BAA question for recognition only. Ask us for our written terms before you use it with patient information, as you would for any tool.

Check each tool before patient audio goes through it

1. Find where recognition runs. Local-only setups keep audio on the device. Cloud setups send it to the vendor, and that vendor needs a contract.
2. Get the signed agreement that names the feature. A company-level BAA may not cover the product you will use, so ask for the copy that covers it.
3. Set the data-sharing controls the agreement requires. For Wispr Flow, confirm that both controls are off before you dictate patient information.
4. Check the plan and the account type. Organization and individual accounts differ.
5. Record the decision in your risk analysis. Write down the tool, the agreement you signed, and why you chose it.

The answer depends on the setup, the account and the tool

• A clinic with a shared account: The BAA must be the organization's, and an admin should control the settings.
• A clinician on a personal account: Wispr Flow lets an individual account sign a BAA, but members of an organization with active billing cannot sign a personal one ^{8 7}.
• Local-only dictation: No vendor BAA is needed for recognition, but the device still needs access control, logoff and audit records.
• Consumer voice typing: Treat it as not covered unless the vendor confirms a BAA for that feature in writing.

This is not legal advice. Your compliance officer or counsel should approve the tool and the contract before patient information goes through it. Related questions include whether transcription software is HIPAA compliant, whether you need a BAA for dictation, whether on-device dictation is HIPAA compliant and whether Whisper AI is HIPAA compliant.