Is Apple Dictation HIPAA compliant?

No. As of October 2026 the only Business Associate Agreement Apple publishes covers health records that patients share with providers through the Health app's sharing service. Apple's own description of that agreement says the covered services "don't include any other services not listed," and Dictation, Siri and Apple Intelligence are not listed.

Apple goes further in the macOS software license. Section 11.B of the macOS 27 license (the same wording appears in the macOS 26 license) says:

"If you are a HIPAA covered entity or business associate, you will not use the Apple Software, Apple Services, or any component or function thereof, to create, receive, maintain or transmit any sensitive, individually-identifiable health information, including protected health information, or use the Apple Software or Apple Services in any manner that would make Apple (or any Apple Subsidiary) your or any third party's business associate."

Read literally, the first half is very broad. Whatever your lawyer makes of it, the second half is plain: Apple does not want to be your business associate. Any Apple feature that sends your dictated words to Apple's servers is the situation that sentence tells you to avoid. Apple's iCloud terms contain a similar clause.

Sometimes. Apple's current Mac User Guide doesn't promise on-device processing; it tells you to look it up: "You can check Keyboard settings to see whether your voice inputs and transcripts for general text Dictation (for example, composing messages and notes, but not dictating in a search box) are processed on your device and not sent to Siri servers."

The older macOS 14 guide was more specific: on a Mac with Apple silicon, dictation is processed on the device for supported languages, while on an Intel-based Mac or in a language without on-device support, "your dictated utterances are sent to Apple to process your requests." Apple's feature availability page lists the languages with on-device dictation and notes that it "requires download of speech models."

Two practical points follow. Dictating into a search box can send text to the search provider even when on-device dictation is on. And because the answer depends on your Mac, your language and your settings, you have to check each machine rather than assume.

Apple's Siri, Dictation and Privacy page says that when Keyboard settings don't show on-device processing, "the things you dictate are sent to and processed on the server, but will not be stored unless you opt in to Improve Siri and Dictation."

The same page also says your request history, "which includes transcripts and any related request data," is tied to a rotating random identifier rather than your Apple Account, and that Apple "may retain and use this data for up to two years." It adds that Apple may process and store this information with third-party service providers. The two statements are hard to reconcile, and for clinical content the safest reading is that server dictation leaves the Mac and may be kept for a while.

It lets Apple store audio of your Siri and Dictation interactions and review a sample of it. Apple says audio review is done only by Apple employees and that the data can be kept for up to two years, longer for reviewed samples. You can switch it off in System Settings, Privacy & Security, Analytics & Improvements.

Turning it off is sensible on any Mac used for clinical work, but it does not change the BAA picture. Server dictation still sends your words to Apple; you have only declined the extra storage.

Apple says many Apple Intelligence models run entirely on the device, and that requests sent to its Private Cloud Compute servers are "not stored or made accessible to Apple" and are not retained after the response is returned. That is a strong privacy design. It is still processing on Apple's servers, Apple doesn't say which features run where, and there is no BAA.

The ChatGPT extension is a separate case. It is off by default, and when you turn it on, some Siri and Writing Tools requests go to OpenAI. Keep it off on a Mac you use for notes. (We cover OpenAI's own BAA options in can therapists use ChatGPT for notes?)

1. Open System Settings, then Keyboard, and look at the Dictation section for Apple's note about on-device processing.
2. In Privacy & Security, then Analytics & Improvements, turn off Improve Siri & Dictation.
3. Leave the ChatGPT extension off in the Apple Intelligence settings.
4. Don't dictate client information into search boxes.

Even with all four done, Apple Dictation has a general vocabulary, so psychiatric drug names often need correcting, and there is still no BAA if anything ends up on Apple's servers.

Sapience Med doesn't use Apple's speech services. It runs its own speech model on your Mac's GPU, works with Wi-Fi switched off, and sends your audio and text to nobody: not to Apple, not to us. Because no vendor receives the dictation, there is no business associate and nothing to sign. It also checks drug names against a built-in medication vocabulary. It runs on Apple silicon Macs and on Windows 10 and 11.

More background: offline medical dictation for Mac and do I need a BAA for dictation software?