Is Windows voice typing HIPAA compliant?

To Microsoft. The Windows support page for voice typing (the Windows key + H shortcut) says: "Voice typing uses online speech recognition, which is powered by Azure Speech services," and "To use voice typing, you'll need to be connected to the internet."

Microsoft's privacy page for speech describes online speech recognition the same way: it uses Microsoft cloud services, and voice data "is sent to Microsoft only to provide the service and create text transcriptions." Microsoft says it does not store or listen to recordings unless you opt in to contributing voice clips.

One inconsistency is worth knowing about. The Microsoft Privacy Statement says voice typing "may use both device-based and online speech recognition technologies." The support page is more specific and says it needs the internet. For a decision about client information, assume the cloud.

Microsoft does sign Business Associate Agreements. Its HIPAA compliance page says the BAA is available "when utilizing Microsoft enterprise products and services" and comes by default through the Microsoft Online Services Data Protection Addendum. The in-scope list covers enterprise cloud services such as Azure, Office 365, Dynamics 365, Intune, Windows 365 and the Power Platform.

Windows voice typing and the Windows online speech recognition setting are not on that list as of October 2026. The fact that voice typing runs on Azure Speech services doesn't, on its own, bring a Windows desktop feature under your organization's Azure agreement; consumer Windows features are governed by the Microsoft Privacy Statement. That last point is our reading of Microsoft's documents, not a Microsoft statement, so if your practice has a Microsoft enterprise agreement, ask your Microsoft contact to confirm in writing.

A little. On Copilot+ PCs, Microsoft offers "fluid dictation" in voice typing, which cleans up grammar, punctuation and filler words using on-device small language models. The support page describes that cleanup step as on-device. It does not say the speech recognition itself runs on the PC, and the same page still says voice typing needs an internet connection.

From a privacy point of view, yes. Voice access is the Windows 11 accessibility feature (version 22H2 and later) that lets you control the PC and write text by voice, and Microsoft says it works "without an internet connection." If the audio never leaves your computer, Microsoft never receives PHI and no BAA is involved.

The trade-off is that voice access is designed for hands-free control of the whole computer. Its dictation vocabulary is general, so psychiatric drug names often need correcting, and its command mode takes some getting used to if all you want is to dictate a progress note.

The older Windows Speech Recognition app also ran on the PC, but Microsoft deprecated it in December 2023 and says it "is no longer being developed" and is being replaced by voice access.

Dictate in Microsoft 365 is a cloud feature too. Microsoft says it needs "a reliable internet connection" and that the service "does not store your audio data or transcribed text." Microsoft lists it among the connected experiences that analyze your content. Whether your organization's Microsoft 365 BAA covers it is a question for whoever administers your Microsoft 365 tenant; Microsoft's in-scope list does not name Dictate specifically.

Open Settings, then Privacy & security, then Speech. If you don't use voice typing, turn online speech recognition off. If you do, make sure you are not contributing voice clips; with a personal Microsoft account, contributed clips can be reviewed by Microsoft employees and vendors and kept for up to two years. Microsoft says sharing voice data isn't available at all when you sign in with a work or school account.

Sapience Med runs on Windows 10 and 11 as well as on Apple silicon Macs. The speech model runs on your PC (with Vulkan GPU acceleration), the audio never leaves the machine, and it checks drug names against a built-in medication vocabulary. It types into whatever field your cursor is in, so it works in browser-based EHRs and desktop apps alike. Since we never receive your dictation, there is no BAA to sign.

See also is Dragon HIPAA compliant?, which covers the Windows-first Dragon products, and do I need a BAA for dictation software?