"HIPAA-compliant" on a vendor's website is a marketing claim about their capability. What protects you is a Business Associate Agreement - a signed contract, covering the specific plan you're on, that makes the vendor legally accountable for the protected health information you send them.

Those two things come apart more often than you'd expect. The most useful thing this article can tell you is how to check.

The short version

• A HIPAA badge is not a BAA. Ask for the BAA in writing.
• Confirm the BAA covers your plan, not just the vendor's enterprise tier.
• Free tiers frequently aren't covered. Nabla's free plan reportedly has no BAA.
• SOC 2 Type II is a security audit, not HIPAA compliance. Useful, different.
• Check subprocessors. If your vendor routes audio through a third-party model provider, that provider needs BAA coverage too.
• Local processing removes the business associate entirely, but doesn't discharge your other obligations.

Tools with HIPAA in scope

Filter the directory by the HIPAA collection.

The free tier trap

This is the failure mode that catches individual clinicians and small practices.

Nabla offers a free tier at a reported 30 consultations a month, and it reportedly comes without a BAA. Its paid plans - around $119 a month for Starter, $239 for Pro - are HIPAA-compliant. Same product, same infrastructure, different contractual position. Using the free tier with real patient data is a HIPAA problem regardless of how secure the servers are.

Heidi Health has an unusually generous free tier - unlimited basic consults and dictation, with ten Pro Actions a month. Confirm in writing which plans its BAA covers before you use it clinically.

The same pattern appears outside clinical tools. Wispr Flow offers a HIPAA-ready BAA on Enterprise only; its $12-a-month Pro tier doesn't have one. Willow Voice states SOC 2 Type II and HIPAA, but enforces it only from the Business tier up.

If a vendor's HIPAA page doesn't say which plans are covered, that's the question to ask first.

What a BAA actually does

Under HIPAA, a covered entity - you, your practice, your hospital - may share protected health information with a business associate that performs a service on your behalf, provided there's a written agreement. The BAA obliges the vendor to safeguard the information, use it only as permitted, report breaches, and pass the same obligations to their own subcontractors.

Without one, disclosing PHI to that vendor is impermissible. The vendor's security posture doesn't change that. This is contract law, not engineering.

Practical steps:

1. Request the BAA before uploading anything. Reputable clinical vendors have a standard one ready.
2. Read which services and plans it names. A BAA for the enterprise platform doesn't cover the self-serve tier.
3. Check the subprocessor list. Many tools route audio through OpenAI, Deepgram, AssemblyAI, or Groq. Those relationships must be covered too.
4. Keep a copy. You'll need it for your own compliance documentation.

Certifications that aren't HIPAA

SOC 2 Type II audits security controls over a period. Genuinely meaningful, and held by Wispr Flow, superwhisper, and Willow Voice. It is not HIPAA compliance and doesn't substitute for a BAA.

ISO 27001 is an information security management standard. Same logic - Wispr Flow holds it.

"HIPAA-ready" or "HIPAA-capable" means the vendor believes their product can be used compliantly, usually once a BAA is signed and the right tier is purchased. Read it as an invitation to ask, not an answer.

GDPR compliance is a different jurisdiction and a different framework. Krisp Pro states both HIPAA and GDPR.

Does on-device processing solve it?

Partly, and it's worth understanding exactly how far.

If audio never leaves your machine, there's no business associate to contract with - no third party receives PHI, so no BAA is needed for that step. That's a real simplification, and it's why INVOX Medical's on-premises deployment option appeals to hospitals with strict data residency rules.

But HIPAA also covers storage, access control, audit logging, encryption at rest, and breach notification. A local dictation app on an unencrypted laptop is not compliant just because the transcription happened offline. And in practice, clinical workflows need EHR integration that general local dictation apps don't provide.

The realistic use of a local tool in clinical work is dictating notes that you then place in a compliant system yourself, on a managed, encrypted device. See cloud vs on-device dictation.

Meeting tools and PHI

General meeting assistants are not appropriate for patient encounters. Otter.ai, Fireflies.ai, Fathom, Granola, and the rest are built for business meetings, and most don't offer a BAA at any tier.

Krisp is the exception in that category, stating HIPAA and GDPR compliance on its Pro tier at $8 a month. Even so, for a clinical encounter you want a clinical tool - see the best AI medical scribes.

If you're recording multidisciplinary meetings that discuss patients, treat that as PHI and apply the same standard.

Legal work has a parallel problem

There's no HIPAA equivalent for legal privilege, but the obligation is comparable and less codified. Sending privileged client material to a third-party transcription service may breach your professional conduct rules or a client engagement letter, regardless of the vendor's security.

The tools built for this treat it as a workflow problem. BigHand handles legal dictation with routing and delegation, at a reported $3,000–4,000 per attorney per year. Philips SpeechLive starts at $12.90 per user per month, with speech recognition a $25.90 add-on. Dragon Legal is part of the active Dragon line.

For sensitive matters, local transcription with MacWhisper, Buzz, or Vibe avoids the third-party question entirely.

The questions to ask, in order

1. Will you sign a BAA, and does it cover the plan I'm buying? In writing.
2. Which subprocessors handle audio or transcripts, and are they covered?
3. Is my data used to train models? Can I opt out, and on which tier?
4. What's the retention period, and can I configure it?
5. Where are the servers?
6. What happens to my data when I cancel?
7. Do you have SOC 2 Type II, and what's in scope?

A vendor that can't answer the first two quickly and in writing is not a vendor for clinical work.

Frequently asked questions

What makes a transcription service HIPAA-compliant?

A signed Business Associate Agreement covering your plan, plus appropriate safeguards for transmission, storage, access control, and breach notification. A "HIPAA-compliant" claim on a website is not sufficient on its own.

Is Otter.ai HIPAA compliant?

Otter.ai is a general business meeting tool and is not appropriate for protected health information. Use a clinical scribe such as Freed, Abridge, or Dragon Medical One.

Is there a free HIPAA-compliant transcription tool?

Be very careful here. Heidi Health has a free tier but you must confirm BAA coverage for it. Nabla's free tier reportedly has no BAA. Transcribing locally with MacWhisper, Buzz, or Vibe avoids the business associate question, though your other HIPAA obligations remain.

Does SOC 2 mean HIPAA compliant?

No. SOC 2 Type II is a security controls audit. It's meaningful evidence of a vendor's security practice, and it does not substitute for a BAA.

Do I need a BAA if the transcription runs on my own computer?

Not for the transcription step, because no third party receives the information. You still need to meet HIPAA's requirements for storage, encryption, access control, and audit on that device.

Which AI medical scribe is easiest to buy compliantly?

Freed - HIPAA-compliant, self-serve, $39–119 a month, seven-day trial with no card. See the best AI medical scribes.

This article explains how vendors describe their compliance posture. It is not legal advice - confirm any arrangement with your own compliance officer or counsel.

Last verified: 10 August 2026.