HIPAA-compliant dictation apps: what to check
If you dictate patient notes, letters or session summaries, your dictation app handles protected health information. Plenty of apps call themselves "HIPAA compliant", but HIPAA doesn't certify products, and the label can mean very different things. Here's what actually matters when you choose a HIPAA-compliant dictation app, and a checklist to use before you dictate a single note.
There's no official "HIPAA-compliant" label
The US Department of Health and Human Services (HHS) doesn't certify or endorse products as HIPAA compliant. HHS has also said it doesn't recognize private organizations' "certifications", and that they don't relieve providers of their own obligations. So when a vendor says "HIPAA compliant", treat it as a claim to check, not a guarantee. Compliance depends on how the tool handles data, the agreements in place, and how you use it.
The key question: does the vendor ever receive patient data?
Under HIPAA, a company that creates, receives, maintains or transmits protected health information on behalf of a provider is a business associate. Before you share patient information with one, you need a business associate agreement (BAA): a contract in which the vendor commits to safeguarding the data.
That's why it matters so much where your audio goes:
- Cloud dictation. Your recording is uploaded and transcribed on the vendor's servers. The vendor receives patient data, so you need a BAA, and you're relying on its security, retention rules and staff.
- Encrypted cloud storage. Even when a vendor can't read your files, HHS guidance says a cloud provider that stores encrypted patient data without the key is still a business associate. You still need a BAA.
- On-device dictation. If recording, transcription and storage all happen on your own phone, and the developer never receives the data, the developer isn't handling patient information on your behalf. Your own HIPAA duties still apply, starting with securing the device.
Encryption: your safety net if a phone is lost
Phones get lost and stolen. Under HIPAA's breach notification rule, protected health information that's encrypted in line with HHS guidance counts as "secured", so losing an encrypted device generally isn't a reportable breach, as long as the decryption key wasn't compromised too. For a dictation app, look for:
- Recordings and transcripts encrypted on the device, ideally with a separate app lock, so an unlocked phone doesn't expose them.
- A key protected by the phone's secure hardware, such as Face ID and the iPhone's Secure Enclave, rather than a password stored somewhere else.
- Encryption in transit for anything that does leave the phone, such as exports to your EHR.
A checklist for choosing a dictation app
- Where is the audio transcribed? On your device, or on the vendor's servers? Test it in airplane mode.
- Will the vendor sign a BAA? If any patient data reaches its servers, you need one, and it may only come with certain plans.
- Is data encrypted at rest and in transit? Ask what standard is used, and who holds the keys.
- Is your data used to train AI? Look for a clear "no", not "de-identified data may be used".
- Who can access recordings? Staff, contractors, transcriptionists, AI providers?
- How long is data kept, and can you delete it completely?
- Can you control exports? Sending a note to your EHR or practice software should be your decision, every time.
The rest of HIPAA still applies
No app makes you compliant on its own. Keep your phone's software up to date, use a strong passcode and Face ID, don't share the device, and follow your organization's policies on mobile devices. Therapists should also remember that psychotherapy notes have additional protections under HIPAA. If you work in a practice or hospital, check with your compliance or privacy officer before adopting a new tool.
Not sure what happens to your voice with the iPhone's built-in dictation? See Is iPhone dictation private?
Frequently asked questions
Is there an official list of HIPAA-compliant dictation apps?
No. HHS doesn't certify or endorse products, so a "HIPAA compliant" label is the vendor's own claim. Check how the app handles data, and whether the vendor will sign a business associate agreement if it receives patient information.
Do I need a business associate agreement for a dictation app?
You need one if the vendor creates, receives, maintains or transmits patient information on your behalf, for example by transcribing your audio on its servers or storing your notes in its cloud. If everything stays on your own device and the vendor never receives it, there's no patient data in the vendor's hands, but check with your compliance officer.
Is the iPhone's built-in dictation HIPAA compliant?
It isn't designed as a clinical tool. Depending on your language and iPhone, dictation may be processed on the phone or sent to Apple's servers, and the text goes into whichever app you're typing in. Our guide on iPhone dictation privacy explains the settings to check.
Does encryption make an app HIPAA compliant?
Not on its own, but it matters a lot. Encryption that meets HHS guidance means a lost or stolen device generally isn't a reportable breach. You still need access controls, sensible policies and, where a vendor receives data, a business associate agreement.
This guide is general information about HIPAA, not legal advice. Your organization's policies and your compliance officer have the final say.