Is Dragon HIPAA compliant?

"Dragon" covers several different products from Nuance, now part of Microsoft, and they answer the HIPAA question differently. The first thing to settle is which one you mean.

Dragon Professional v16 runs on your Windows PC. Nuance's data sheet says it needs an internet connection only "for product download and automatic product activation," and Nuance groups it under "locally installed" products. If your dictation is transcribed on your own computer, Nuance never receives it, so Nuance is not acting as your business associate for that dictation.

The catch is fit, not privacy. Dragon Professional is a general business product. Nuance's Dragon page routes healthcare buyers to Microsoft's health solutions instead, and its only HIPAA statement for this family is a narrow one about public-sector social services. It runs on Windows only; the Mac edition of Dragon was discontinued on October 22, 2018.

Dragon Medical One (DMO) is Nuance's clinical dictation product. It is a Windows app backed by Microsoft's cloud speech service, so your audio leaves the computer. Microsoft's Marketplace listing describes it as "cloud-based HITRUST CSF-certified."

Because DMO is a cloud service that receives PHI, you need a BAA covering it. Microsoft's general HIPAA page says its BAA is available through the Microsoft Online Services Data Protection Addendum for the services it lists as in scope, and that list does not name Dragon Medical One or Dragon Copilot. We would not read that as "no BAA," since DMO is sold to hospitals that require one, but a small practice should get written confirmation of BAA coverage from Microsoft or the reseller before going live. Pricing and Mac access are covered in Dragon Medical One on Mac, and its price.

Microsoft announced Dragon Copilot on March 3, 2025, describing it as bringing together "the trusted natural language voice dictation capabilities of DMO with the ambient listening capabilities of DAX." It became available in the US on May 1, 2025, through a web browser, mobile apps, a Windows desktop app and inside EHRs such as Epic.

Microsoft's FAQ says the applications "have been built to support HIPAA" and its privacy whitepaper points to the Microsoft Products and Services Data Protection Addendum. As with DMO, confirm BAA coverage in your contract. Ambient listening means recording the encounter, which brings client consent into the picture; see push-to-talk dictation vs AI scribes.

Dragon Anywhere, the mobile cloud dictation app, is gone for new users: "As of July 1, 2026, Dragon Anywhere Mobile is no longer available for sale," and renewals are no longer possible. Its EULA had said that when PHI was involved, Nuance's BAA applied.

Dragon Medical Practice Edition, the old desktop medical version, stopped being sold in North America in 2021, lost support in 2022, and Nuance said it would not be tested or supported on Windows 11. Running unsupported software on a computer that holds PHI is its own security problem, so plan to move off it.

Sapience Med works like Dragon Professional in one important way: transcription happens on your own computer, so the vendor never receives your dictation and no BAA is needed. The differences are that it is built for mental health, with a built-in medication vocabulary, and that it runs on Apple silicon Macs as well as Windows 10 and 11. It costs $149 once.

Dragon Medical One is the broader tool. It covers every medical specialty and offers EHR integrations a hospital may need. If you are a therapist or psychiatrist who wants to dictate notes into SimplePractice or TherapyNotes on a Mac, that breadth may be more than you need. See Dragon Medical alternative for Mac.