Do I need a BAA for dictation software?

HIPAA defines a business associate in 45 CFR 160.103 as a person or company that, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information." If you are a covered entity (most therapists and psychiatrists who bill insurance electronically are) and a vendor does any of those four things with your PHI, you need a Business Associate Agreement with them before you use the service for client information.

Dictation is a clear case. A dictated progress note is PHI. If the app sends your audio or the resulting text to the vendor's servers to be transcribed, the vendor receives PHI, and usually maintains it for at least a while. That makes the vendor a business associate, whatever its marketing says.

HHS has also said that a cloud provider that stores or processes ePHI is a business associate even if the data is encrypted and the provider has no key to read it. "We can't see your data" does not get a cloud vendor out of the BAA requirement.

When the vendor never creates, receives, maintains or transmits your PHI. Software that runs entirely on your own computer and sends nothing about your dictation back to its maker is in the same position as a word processor installed on your laptop: the PHI stays with you, so there is nobody to sign a BAA with.

That is how Sapience Med is built. The speech model runs on your Mac or Windows PC, the audio is discarded after transcription, and the text goes straight into your EHR. Our servers only see license information (a license ID and a hashed device ID), never audio or notes. The full reasoning is in our HIPAA architecture brief.

A related idea you may come across is the "conduit" exception, which covers services that only carry data from one place to another, like an internet provider. It is narrow. HHS has said it does not apply to a cloud service that stores data, so it is not a way around a BAA for cloud dictation.

You can answer most of the question in a few minutes with the vendor's own documentation and your Wi-Fi switch.

1. Turn off Wi-Fi and try to dictate. If it stops working, your audio is being processed somewhere else.
2. Read the privacy policy for words like "servers," "cloud," "subprocessors" or named AI model providers. Any of these mean your words leave the computer.
3. Check whether the vendor keeps recordings or transcripts, even briefly, and whether it uses them to improve its models.
4. If data does leave the computer, look for a BAA and check which plans it covers. Free and individual plans often have none.

A BAA is a contract. Under 45 CFR 164.504(e) it has to commit the vendor to use PHI only as the agreement allows, safeguard it, report breaches to you, pass the same obligations to its own subcontractors, and return or destroy PHI when the relationship ends. That is real protection, and for cloud services it is required.

It does not keep your data on your computer. Your client's words still travel to the vendor and live on its systems under its security program. Some clinicians are comfortable with that; others would rather the audio never leave the room. Both are defensible. The point is to know which one you have chosen.

No, and be wary of any vendor that says it is "HIPAA certified." HHS does not endorse or recognize private HIPAA certifications. Compliance is about what your practice does.

With on-device dictation, the questions shift from the vendor to your own setup: is the computer's disk encrypted (FileVault or BitLocker), does it lock when you walk away, who else uses it, and is it covered in your security risk analysis? We describe Sapience Med as HIPAA-friendly because no PHI leaves your device, which removes the vendor from the picture. The device is still yours to protect.