HIPAA-compliant transcription: a buyer checklist

“HIPAA-compliant transcription” is not a product you can buy — it is a property of how a tool is deployed and operated. In practice it means one of two things: a cloud vendor that will sign a Business Associate Agreement (BAA) and that you configure with proper safeguards, or an on-prem / on-device tool where audio never leaves your environment. Either way, you remain responsible for access controls, encryption and audit logging on top of the transcription itself.

Why a vendor “checkbox” is not enough

HIPAA’s Security Rule governs electronic protected health information (ePHI), and the Privacy Rule’s business-associate provisions require a signed contract before you share ePHI with any third party. A transcription vendor that lists “HIPAA” but will not sign a BAA cannot lawfully receive your patient recordings. Of the cloud tools covered in this catalog, some advertise HIPAA support — Rev lists HIPAA among its compliance options — while consumer meeting tools like Otter list SOC 2 and GDPR but not a BAA path suited to clinical PHI. Always confirm the BAA in writing before sending any audio.

The buyer checklist

Treat these as the minimum bar when evaluating a transcription tool for health data:

• Signed BAA — required for any cloud/third-party processor that touches ePHI. No BAA, no PHI.
• On-prem or on-device option — processing audio locally avoids disclosing PHI to an outside processor at all; for many practices this is the simplest path.
• Encryption — in transit (TLS) and at rest, per the Security Rule’s technical safeguards.
• MFA and access controls — multi-factor authentication and least-privilege roles so only authorized staff reach transcripts.
• Audit logging — a record of which user accessed which transcript and when, retained for review.
• Diarization — clinician-vs-patient labelling, useful for accurate clinical notes.
• Accuracy you can verify — published WER figures are only a guide; benchmark on your own audio.
• A responsible vendor — one that takes contractual ownership of the deployment, not just the software.

Build, buy, or keep it on-prem

The honest trade-off comes down to where the audio lives. Cloud services such as Rev are cheap and easy to integrate, but PHI leaves your environment, so the BAA and your own configuration become the load-bearing controls. On-prem and self-hosted tools keep recordings inside your network — removing the third-party disclosure entirely — at the cost of higher setup effort and your own infrastructure to secure. NoParrot, for example, is one on-prem option that lists HIPAA, BAA and GDPR support and runs transcription locally; the best transcription for HIPAA, legal & privacy ranking covers others.

There is no single right answer: a solo practice with one machine may run a self-hosted Whisper pipeline, while a clinic that needs EHR integration and a vendor on the hook may prefer a cloud service under a BAA. Weigh the effort, cost and compliance ownership in our build vs buy transcription and on-prem vs cloud transcription guides before committing — and remember that no tool, on its own, makes you HIPAA-compliant. The HHS guidance on the Security Rule makes clear the safeguards are your responsibility regardless of which tool you choose.