HIPAA compliant transcription: why local processing changes the answer
What HHS says about PHI, business associates and the Security Rule, and why HIPAA compliant transcription looks different when the audio stays on your device.
HIPAA compliant transcription is not a status the government hands out. HHS’s Office for Civil Rights says it does not endorse, certify or recommend specific technology or products. What the rules do say is narrower. If a third party receives patient information to transcribe it, that party is generally a business associate and needs a written agreement with you. If the audio never leaves your own computer, no third party receives anything for that step, and the question moves to how well you secure the device. Here are both halves, with citations to HHS.
PHI is identifiable health information, in audio as much as on paper
HHS’s Privacy Rule summary says the rule protects individually identifiable health information held or transmitted by a covered entity or its business associate, in any form, “whether electronic, paper, or oral”. The rule calls this protected health information, or PHI. It covers information about a person’s health, their care or payment for it, where the person is identified or reasonably could be. A recorded consultation or a dictated note usually ticks every box.
The rules bind covered entities: health plans, health care clearinghouses, and health care providers who transmit health information electronically for a transaction with an HHS standard. HHS’s covered-entities page names doctors, clinics, psychologists, dentists, chiropractors, nursing homes and pharmacies, “but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard”. Email alone doesn’t make you covered, HHS says; sending standard claims, even through a billing service, does.
If your practice is covered, the Security Rule applies as well. HHS’s Security Rule summary says it covers PHI that is held or sent electronically, which it calls ePHI. An audio file on a laptop qualifies, and so does the transcript you make from it.
A transcription service that receives PHI is generally a business associate
HHS’s business associates guidance defines a business associate as a person or organisation, other than a member of your workforce, that creates, receives, maintains or transmits PHI on your behalf, or provides certain services that involve disclosing PHI to it. Its examples include a cloud service provider that processes or stores ePHI and an “independent medical transcriptionist, or the vendor of an app, that provides transcription services to a physician”.
That is the hinge. A cloud transcription service takes your recording, holds it at least while the job runs, and returns text. On HHS’s description that is receiving, maintaining and transmitting PHI on your behalf, so it is generally a business associate.
HHS says you may disclose PHI to a business associate only once you have its written assurance that it will safeguard the information: the business associate agreement, or BAA. The BAA must set out what the business associate may do with the PHI and, under the Security Rule, require it to comply with that rule and report security incidents to you. HHS’s cloud computing guidance adds that using a cloud provider to store or process ePHI without a BAA puts the covered entity in violation of the rules.
Your own workforce sits outside the definition, so a staff member typing up a recording is not a business associate.
HIPAA compliant transcription is a vendor claim, not an HHS status
In its cloud computing guidance, HHS answers the question of which providers offer HIPAA-compliant services with one sentence: “OCR does not endorse, certify, or recommend specific technology or products.” The same guidance says the HIPAA Rules neither endorse nor require particular technology; they require you to analyse the risks of whatever you use and put reasonable safeguards in place.
So read “HIPAA compliant” as shorthand for “we will sign a BAA and we say our safeguards meet the Security Rule”. It’s still your BAA and risk analysis that make the arrangement work, not the label.
Local processing means nobody receives the recording for that step
Now suppose the speech model runs inside a browser tab on your computer and the audio never leaves your disk. That is how FreeTranscribe works: OpenAI’s open-source Whisper model runs on your graphics card through WebGPU, and the site sends the model file to you rather than your audio to it. We explained why upload-based sites are built the other way round in why free transcription sites cap you at 30 minutes.
On HHS’s definitions, a business associate is someone who creates, receives, maintains or transmits PHI on your behalf. If nobody outside your practice receives the audio or the transcript, there is no one to sign a BAA with for that step: the transcription stops being a disclosure at all. The recording was ePHI before and the transcript is ePHI after.
| Question | Cloud transcription service | Local processing in your browser |
|---|---|---|
| Does a third party receive the recording? | Yes. HHS lists cloud providers and transcription vendors as business associate examples. | No. The audio is read from your disk into the tab and stays there. |
| Is a BAA needed for this step? | Generally yes, under HHS’s business associate guidance. | The question doesn’t arise; there’s no recipient. |
| Who safeguards the audio and transcript? | The vendor under its BAA and the Security Rule, and you at your end. | You, under the Security Rule, on the device you used. |
Local processing removes a party. It doesn’t remove obligations; it concentrates them on you.
The Security Rule still applies to your own device
HHS’s Security Rule summary says a regulated entity must ensure the confidentiality, integrity and availability of all ePHI it creates, receives, maintains or transmits, protect against reasonably anticipated threats and impermissible disclosures, and ensure compliance by its workforce. A laptop holding a patient recording is squarely inside that.
The safeguards HHS lists that bite on a transcription workstation:
- Risk analysis: an accurate and thorough assessment of the risks and vulnerabilities to ePHI.
- Workstation use and security: policies and physical safeguards for workstations that can access ePHI.
- Device and media controls: rules for hardware and media that hold ePHI, including wiping media before re-use.
- Access control and authentication: only authorised people reach ePHI, and the system verifies who they are.
- Transmission security: protection for ePHI on a network, which matters the moment you email the transcript.
HHS calls the rule “flexible, scalable, and technology neutral”: it doesn’t dictate measures, it asks you to pick what is reasonable and appropriate for your size, resources and risks, and document the choice. Some specifications are “addressable” rather than “required”, but HHS is explicit that addressable does not mean optional.
On encryption, HHS’s cloud guidance says a breach of ePHI encrypted to the level HHS specifies falls within a breach “safe harbor”; ePHI that isn’t is “unsecured PHI”. A lost laptop with full-disk encryption on is a very different event from one without. That decision is yours; no transcription tool makes it for you.
What the tool does and does not do
What it does: reads MP3, WAV, M4A, AAC, FLAC, OGG, MP4, MOV, WEBM, MKV or AVI from your disk, runs the base English Whisper model on your graphics card inside the browser tab, and saves TXT, SRT or VTT. Nothing is uploaded and there is no account. The model is about 200 MB, downloaded once and cached. In our test a desktop with a graphics card ran at about 1.5x real time; a thin laptop takes roughly as long as the recording.
What it doesn’t do: it doesn’t sign a BAA, because on HHS’s definitions it doesn’t receive PHI. It doesn’t encrypt your disk, manage logins, keep an audit log or wipe anything. It doesn’t run on Firefox, Safari or phones, and it’s English only for now. The base model was word-perfect on clean speech in our test but weaker on names, technical terms, accents and noisy rooms, and clinical vocabulary is technical vocabulary. Read every transcript through before it goes near a chart. The page is ad-supported, so an ad script loads alongside the tool; if your policy bars third-party scripts on machines that handle PHI, settle that first.
If your compliance officer is comfortable with local processing on a properly secured workstation, you can try it on a recording and watch the browser’s network panel while it runs.
Frequently asked questions
Does a local tool mean my practice can stop thinking about HIPAA for transcripts? No. It removes the business associate question for the transcription step. The Security Rule still applies to the device and the transcript, and the Privacy Rule still governs how the transcript is used and shared.
Is the website a business associate because it serves the model file? HHS’s guidance says a party whose services don’t involve the use or disclosure of PHI, with access incidental at most, is not a business associate. Serving a model file doesn’t involve your audio. Whether that satisfies your compliance programme is for your officer to confirm.
What if I leave names out of the recording? HHS says there are no restrictions on de-identified health information, but describes two ways to de-identify: a formal determination by a qualified statistician, or removing a specified list of identifiers with no actual knowledge that the rest could identify someone. Skipping a name falls well short.
This post is general information about what HHS publishes, not legal advice. Check with your compliance officer before changing how your practice handles recordings.
Sources, checked 14 September 2026
- https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html : HHS summary of the HIPAA Privacy Rule (covered entities, PHI, business associate contracts, workforce, de-identification)
- https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html : HHS business associates guidance (definition, examples including medical transcriptionists and cloud providers, BAA contents, exceptions)
- https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html : HHS summary of the HIPAA Security Rule (ePHI, general rules, safeguards, required versus addressable)
- https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html : HHS covered entities and business associates page (provider examples and the standard-transaction condition)
- https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html : HHS guidance on HIPAA and cloud computing (“OCR does not endorse, certify, or recommend specific technology or products”, encryption and the breach safe harbor, BAA required before using a cloud provider)