Is Yap HIPAA compliant?

No app makes a practice HIPAA compliant on its own. What Yap changes is where the words go: speech is recognized on your computer, and the audio and the text are never sent to us or to a speech service. Your computer still needs your own safeguards, such as disk encryption, a screen lock and your risk analysis. This is not legal advice.

Do I need a business associate agreement for it?

HHS treats a vendor as a business associate when its service involves access to protected health information. Yap has no access to what you dictate: recognition runs on your device and nothing you say is uploaded. Whether your practice's policy still calls for an agreement is for your compliance lead to decide.

Does Yap record my sessions?

No. Yap is not a scribe. It listens only while you dictate (you hold the key, or lock it on with Space for a longer note), so you say your own note after the session and your client's voice is never captured.

Does it work with SimplePractice, TherapyNotes or my EHR?

It types into whatever text field your cursor is in, including web-based EHRs in your browser and Word. Hold Fn on a Mac or Ctrl + Win on Windows, speak, and let go.

Where is my dictation kept?

The finished text goes into the field you dictated into, and a copy stays in a local history on your computer until you delete it. It is not synced to our servers.

Yap for therapists

Dictate your session notes. Nothing leaves your computer.

For therapists, psychologists and counselors: after the session, hold one key and say your progress note. Yap types it with punctuation into your EHR, SimplePractice or Word. Speech is recognized on your own Mac or PC, so no recording of the session exists and nothing you say reaches us.

Get Yap for Mac What HIPAA asks of dictation

Mac, Windows, iPhone and Android. $6.90 USD a month or $69 USD a year per clinician. 3 days free with a free account, no card, then a 10-day trial with a card.

Dictation, not a scribe

Your words about the session, not the session.

An AI scribe records the whole conversation. In therapy that is a heavier step than in a medical visit: HIPAA treats psychotherapy notes as a separate category, kept apart from the rest of the record, and clients notice. In a 2026 NPR report, a client learned midway that her therapist was recording with an AI note tool, and she stopped seeing that therapist.

With Yap you write the note the way you always have, only by voice: after the client leaves, in your own words. There is no session audio to consent to, store or delete. More in our guide to dictation for nurses and therapists.

HIPAA

No vendor holding your clients’ words.

With a cloud dictation service, client audio sits on someone else’s servers: HHS says most vendors whose service involves access to health information are business associates, and a cloud provider that holds it must sign a business associate agreement. Even then, an agreement does not on its own make a practice compliant.

Yap recognizes speech on your computer. The audio and the text are never uploaded, and nothing you dictate trains a model, so that vendor question does not arise. What stays is your own part: the Security Rule requires a risk analysis, and encryption is one of its safeguards, so keep the computer encrypted and locked, and delete dictation history you do not need.

This is not legal advice. Your state licensing board and your employer’s policy can add rules of their own.

Into the note you have open.

Place the cursor in the note, hold Fn on a Mac or Ctrl + Win on Windows, speak, and let go. It works in web-based EHRs, practice software and Word.

Listens only while you dictate.

No always-on microphone and no ambient recording. It listens while you hold the key, or until you finish a longer note you locked on with Space.

Nothing uploaded.

No audio, no text and no client names reach us; the history stays on your computer until you delete it. Read our privacy policy.

Being fair

What it does not do.

It does not write the note for you. Yap types what you say; it does not summarize a session or fill a SOAP template. For dictating one, see how to dictate SOAP notes.
No custom dictionary. In our own spot check of clinical sentences, therapy language came out word for word, but some drug names did not (“furosimide” for furosemide, “atorvastadin” for atorvastatin). Read medication names back before you sign.
Not for flowsheets. Dictation suits narrative notes; checkboxes and scores are still faster with a click.

Questions.

Is Yap HIPAA compliant?: No app makes a practice HIPAA compliant on its own. What Yap changes is where the words go: speech is recognized on your computer, and the audio and the text are never sent to us or to a speech service. Your computer still needs your own safeguards, such as disk encryption, a screen lock and your risk analysis. This is not legal advice.
Do I need a business associate agreement for it?: HHS treats a vendor as a business associate when its service involves access to protected health information. Yap has no access to what you dictate: recognition runs on your device and nothing you say is uploaded. Whether your practice's policy still calls for an agreement is for your compliance lead to decide.
Does Yap record my sessions?: No. Yap is not a scribe. It listens only while you dictate (you hold the key, or lock it on with Space for a longer note), so you say your own note after the session and your client's voice is never captured.
Does it work with SimplePractice, TherapyNotes or my EHR?: It types into whatever text field your cursor is in, including web-based EHRs in your browser and Word. Hold Fn on a Mac or Ctrl + Win on Windows, speak, and let go.
Where is my dictation kept?: The finished text goes into the field you dictated into, and a copy stays in a local history on your computer until you delete it. It is not synced to our servers.

More on the rules: Is on-device dictation HIPAA compliant?

From the library

Speech to Text Privacy: Where Your Voice Goes

Dictation is only as private as the place your voice is processed and the rules of whoever processes it. On-device recognition keeps the audio on your hardware, while cloud recognition sends it to a server that may store it, train models on it or let people review it. Voice is personal data everywhere and biometric data when it identifies you, so privacy laws, HIPAA, legal ethics rules and recording consent statutes all apply, and the reliable way to dictate privately is on-device recognition with history, training and sharing settings switched off.