Disclaimer: This article is for informational purposes only and does not constitute legal or compliance advice. HIPAA requirements are complex and context-dependent. Consult your compliance officer or legal counsel for guidance specific to your organisation before using any tool to transcribe meetings involving protected health information.
Why cloud transcription creates HIPAA risk
The appeal of modern meeting transcription tools is obvious. Instead of taking notes during a patient consultation, a telehealth appointment, or a case conference, you record, transcribe, and get a summary automatically. The productivity gain is real. The compliance risk is equally real — and it's one that many healthcare and adjacent professionals are not fully accounting for.
When you use a cloud-based transcription tool — Otter.ai, Fireflies.ai, tl;dv, Rev, or most others — your meeting audio is uploaded to that vendor's servers for processing. The transcription happens in the cloud, not on your device. This means that any Protected Health Information (PHI) present in the conversation — patient names, diagnoses, treatment plans, medication details, insurance information, dates of birth — is transmitted to and temporarily stored by a third-party infrastructure provider.
Under HIPAA's Privacy Rule and Security Rule, transmitting PHI to a third party requires that third party to be a Business Associate, and the relationship must be formalised with a Business Associate Agreement (BAA). Without a BAA in place, you are in violation of HIPAA even if the vendor never misuses the data. The violation is in the act of transmission without a proper agreement, not only in a subsequent breach.
The practical exposure is significant. A typical 30-minute telehealth consultation might reference a patient's name dozens of times, include a diagnosis, a medication adjustment, and follow-up instructions. If that audio file is uploaded to Otter.ai's AWS infrastructure without a BAA, the covered entity has created a reportable violation. Multiply that by a clinic running dozens of consultations a day, and the cumulative risk is substantial.
The problem is compounded by the fact that many of these tools are used casually, without IT or compliance review. A clinician who signs up for a free transcription app on their personal laptop and records a patient call has almost certainly created a HIPAA violation without realising it. The tool didn't ask them about their HIPAA obligations, and the sign-up flow had nothing to say about it.
The BAA problem
A Business Associate Agreement is a contract between a HIPAA-covered entity (a hospital, clinic, insurance company, or healthcare provider) and a vendor that receives, processes, or stores PHI on their behalf. The BAA defines how the vendor will protect that data, what they will do in the event of a breach, and what the liability allocation looks like.
Getting a BAA is, in theory, straightforward — you ask your vendor for one. In practice, it's considerably more complicated. Most consumer-tier and SMB-tier transcription tools either do not offer BAAs at all, or restrict them to expensive enterprise plans. Otter.ai, for example, offers a BAA only as part of its Otter Business or Enterprise subscription. Fireflies.ai similarly reserves HIPAA compliance features for its enterprise tier. This means the clinician who signed up for a $20/month subscription and is actively using the tool for patient calls does not have a BAA in place, regardless of what the vendor's marketing materials say about "security".
Even when a BAA is in place, it does not eliminate risk — it allocates it. If a vendor suffers a breach and patient data is exposed, you still have a reportable incident under HIPAA's Breach Notification Rule. A BAA means the vendor shares liability; it does not mean PHI is safe. You are still responsible for having conducted a reasonable risk assessment of that vendor's security controls before entering the BAA.
This is why some compliance teams take the position that the only truly defensible approach for PHI is to not transmit it to third parties at all. A tool that processes audio entirely on your own hardware sidesteps the BAA question entirely — there is no third-party Business Associate because there is no third party.
What "local processing" actually means
The phrase "local processing" is used loosely in the meeting tool market, and it's worth being precise about what it means and what it doesn't.
A tool processes audio locally when the speech-to-text model runs on your device — your CPU or GPU — and the audio never travels over a network connection to a remote server. The entire inference pipeline, from audio waveform to text transcript, happens on hardware you physically control.
This is distinct from tools that are local-feeling but cloud-dependent. Granola, for example, presents as a Mac desktop app that captures audio without a bot. But Granola sends audio to cloud transcription APIs (such as Deepgram or AssemblyAI) for processing. From the user's perspective, this feels local — there's no bot, no visible upload — but the audio still leaves the machine. For HIPAA purposes, this is a cloud transcription tool and requires the same BAA analysis as Otter.ai or Fireflies.
True local processing requires a local speech recognition model. Whisper.cpp, developed by OpenAI and ported to C++ by Georgi Gerganov, is the leading open-source option. It can run entirely on-device, achieving near-cloud accuracy on modern consumer hardware. Several desktop applications now ship Whisper.cpp as their transcription engine, meaning the model runs in-process on your machine.
When a tool runs Whisper.cpp locally, the data flow for transcription is entirely contained within your device. No audio packet crosses a network interface during the transcription process. From a HIPAA perspective, there is no transmission of PHI to a Business Associate, because the processing happens within the covered entity's own computing environment (your laptop or workstation).
Note that this applies only to transcription. If the tool then sends the transcript text to a cloud LLM for summarisation, that text may also contain PHI and triggers the same BAA analysis. A complete local-first workflow requires both local transcription and local summarisation, or at minimum, careful review of what text is sent to cloud services.
Tools that work in HIPAA-adjacent workflows
Clearminutes
Clearminutes runs Whisper.cpp locally on your device. There is no audio upload to any server. Transcription happens in-process, on your CPU or GPU, and the resulting transcript is stored in a local SQLite database. For AI summarisation, Clearminutes includes a built-in Gemma model that also runs locally, so the default workflow sends no data over any network at all — not audio, not transcript, not summary.
If you choose to use cloud LLM providers (Claude, OpenAI, Groq) for better summary quality, the transcript text will be sent to those APIs. In a HIPAA context, you would need to review whether those providers offer BAAs and whether the transcript text constitutes PHI. For many healthcare adjacent workflows (internal team meetings without patient identifiers, for example), this is a reasonable trade-off. For direct patient care contexts, using the local Gemma model is the more conservative choice.
Important note: Clearminutes has not obtained formal HIPAA certification, has not undergone a third-party HIPAA compliance audit, and has not published a standard BAA. It is not marketed as a HIPAA-certified product. However, because audio and transcripts remain on your device by default, it avoids the transmission-to-a-Business-Associate issue that affects cloud tools. Whether this is sufficient for your organisation's compliance posture is a decision for your compliance officer, not for a product description.
Whisper.cpp (direct)
For technical teams, running Whisper.cpp directly via command line offers maximum control and auditability. There is no application layer, no database, and no UI — just the model processing audio files you provide. This is the most defensible option from a pure data-flow perspective, but it requires comfort with the command line and provides no workflow automation. Suitable for a compliance or IT team evaluating local transcription before deploying a more polished tool.
Dragon Medical One and Dragon Ambient eXperience
For clinical documentation specifically, Nuance's Dragon Medical products are the established standard. Dragon Medical One is cloud-based (Microsoft Azure) and comes with a BAA as part of the enterprise agreement. Dragon Ambient eXperience (DAX) is purpose-built for ambient clinical documentation in consultation settings. These are expensive, enterprise-grade products designed for the healthcare market. They are the right answer for large health systems or practices with formal EHR integration requirements. For small clinics or individual practitioners, the cost and complexity may be prohibitive.
Tools to approach with caution for PHI
Otter.ai: Cloud transcription, BAA available on Business/Enterprise tiers only. Do not use for PHI on free or individual plans.
Fireflies.ai: Cloud transcription via meeting bot, HIPAA features reserved for enterprise. The bot joining your call is itself a data issue — it's a third-party participant in a confidential conversation.
tl;dv: Cloud-based, recording stored on vendor servers. BAA not widely advertised on standard plans.
Granola: Mac-only, no bot, but cloud transcription API. Audio leaves the device. Evaluate the same way you would any cloud transcription tool.
This list is not exhaustive. Before using any tool for calls involving PHI, go through the evaluation framework below.
How to evaluate any tool
Before deploying any meeting transcription or note-taking tool in a context involving PHI, ask the following questions. Document your answers as part of your risk assessment.
1. Where is audio processed?
Is the speech-to-text model running on your device or on the vendor's servers? If the vendor's marketing says "local" but doesn't specify that the model runs on your hardware, ask directly. "We process your data securely" is not the same as "your audio never leaves your device." Demand a clear answer about the data flow from audio capture to text output.
2. Is a BAA available?
If audio or transcript text leaves your device, the vendor is a Business Associate and you need a BAA. Ask whether one is available on your current subscription tier. If the answer is "only on enterprise," understand that you cannot use the tool for PHI on your current plan, regardless of any security certifications the vendor has.
3. Where is data stored, and for how long?
Even if a vendor processes audio in real time and doesn't "store" recordings, temporary buffers, logs, and cached data may persist longer than you expect. Ask specifically about audio retention policies, transcript retention, and whether data is used for model training (opt-out should be available for BAA customers).
4. Who are the subprocessors?
Cloud services rarely run entirely on infrastructure they own. The transcription vendor may be using AWS, Google Cloud, or Azure for compute, and a third-party speech API (Deepgram, AssemblyAI, Rev) for the actual transcription. Each of these is a potential subprocessor that may need to be in your BAA chain. Ask for a full list of subprocessors that may handle PHI.
5. What happens in a breach?
Under HIPAA's Breach Notification Rule, you must notify affected individuals and in some cases the HHS Secretary if PHI is improperly accessed. Your BAA should specify the vendor's notification obligations and timelines. Verify this before signing, not after an incident.
The safest architecture for PHI is one where the question of breach notification, subprocessors, and BAAs simply doesn't arise — because the data never left your device in the first place. Local transcription removes an entire category of compliance risk from the equation.
A practical recommendation
For healthcare professionals, telehealth providers, medical billing companies, health insurance staff, mental health practitioners, and anyone else whose meetings regularly involve PHI: the lowest-risk approach to meeting transcription is a local-first tool running Whisper.cpp on-device, with local LLM summarisation.
This doesn't require a BAA negotiation, doesn't depend on a vendor's security posture, and doesn't expose you to the liability surface of cloud data transmission. The trade-off is some setup effort and potentially slightly lower accuracy on specialised medical vocabulary compared to cloud models fine-tuned for healthcare.
Clearminutes offers this architecture in a usable desktop application for macOS and Windows. It is not a HIPAA-certified product, and your compliance officer should review its use for PHI. But for teams that want to understand what a defensible, low-risk transcription workflow looks like, it's a reasonable starting point for evaluation.
Whatever tool you choose: document your risk assessment, ensure BAAs are in place wherever data crosses an organisational boundary, and revisit your setup whenever a vendor changes their data handling practices or you change subscription tiers.