Is there an official HIPAA certification for software?

No. Neither HHS nor any government body certifies software as HIPAA-compliant. Badges that say 'HIPAA certified' are marketing. What you can verify instead: a signed BAA, independent security audits such as SOC 2 reports, documented encryption and access-control practices, and the vendor's data-retention and model-training policies.

Can I use consumer AI note-takers for patient conversations?

Generally no. Most consumer note-takers and free transcription apps will not sign a BAA, may retain recordings indefinitely, and may use your audio to train their models — each of which is disqualifying for PHI. If a conversation contains patient information, use a tool operating under a BAA with no-training guarantees and retention controls.

What happens if a transcription vendor has a breach?

The Breach Notification Rule applies: the business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery, and the covered entity must notify affected individuals and HHS. Your BAA should spell out notification timelines, cooperation duties, and liability — read that section before you sign, not after an incident.

Guide

Is AI transcription HIPAA-compliant? The BAA, safeguards & vendor checklist that actually decide it

Q: Is AI transcription HIPAA-compliant?

Not automatically. HIPAA compliance is a property of how a vendor handles protected health information, not of the technology. An AI transcription service can be used compliantly when the vendor signs a Business Associate Agreement, encrypts audio and transcripts in transit and at rest, enforces access controls with audit logging, does not use your data to train AI models, and gives you control over retention and deletion. Consumer transcription tools typically fail several of these.

Q: Do I need a BAA with a transcription vendor?

Yes, if you are a covered entity or business associate and the recordings contain protected health information. A transcription vendor processing PHI on your behalf is a business associate under HIPAA, and the Privacy Rule requires a written Business Associate Agreement before you share PHI with them. Using a vendor that will not sign a BAA is itself a violation, regardless of how secure the vendor claims to be.

By the exma team · August 6, 2026 · 8 min read

TL;DR: AI transcription is not automatically HIPAA-compliant, and no official "HIPAA certification" exists — any badge claiming otherwise is marketing. Compliance is decided by the vendor's practices: a signed Business Associate Agreement (BAA), encryption in transit and at rest, access controls with audit logs, a contractual promise never to train AI models on your audio, and retention and deletion you control. Consumer note-takers typically fail several of these; purpose-built tools like exma are designed around them.

When HIPAA applies to a recording

HIPAA governs protected health information (PHI) — individually identifiable health information held or transmitted by a covered entity (providers, health plans, clearinghouses) or its business associates. A recording doesn't need to be a clinical dictation to qualify. If the audio identifies a person and touches their health — a telehealth visit, a care-team meeting, an independent medical examination, a workers'-comp interview, a peer-review committee, an insurance claim call — the recording and its transcript are PHI.

The moment you hand that audio to a transcription service, the service is processing PHI on your behalf. Under HIPAA, that makes the vendor a business associate — and that classification, not the vendor's marketing page, is what triggers the obligations below.

The four non-negotiables

1. A signed Business Associate Agreement

The Privacy Rule requires a written BAA before PHI is shared with a business associate. The BAA binds the vendor to safeguard PHI, restrict its use to the contracted service, report breaches, and flow the same obligations down to its own subcontractors (such as the cloud and speech-recognition providers underneath). A vendor that won't sign a BAA is a hard stop — using them for PHI is a violation on its own, however good their security happens to be.

2. Encryption in transit and at rest

Audio uploads and live streams should travel over TLS, and stored recordings and transcripts should be encrypted at rest. Encryption is technically an "addressable" specification under the Security Rule, but in practice it is the baseline every credible vendor meets — and unencrypted PHI is what turns a lost laptop or leaked bucket into a reportable breach.

3. Access controls and audit logs

Unique accounts, role-based access, multi-factor authentication, session timeouts — and an audit trail recording who accessed which recording and transcript, when. The Security Rule expects it, and it's also how you answer the question every incident review starts with: who has seen this file?

4. No training on your data — and retention you control

Two questions AI adds on top of classic HIPAA diligence. First, does the vendor use your audio or transcripts to train models? For PHI the answer must be a contractual no — "de-identified" training claims deserve scrutiny, because audio is hard to truly de-identify. Second, who controls retention? You should be able to delete recordings and transcripts, set retention windows, and get PHI returned or destroyed when the contract ends — that last part belongs in the BAA.

The "HIPAA certified" myth

Neither HHS nor any government body certifies software as HIPAA-compliant. There is no official seal, and the Office for Civil Rights has fined organizations that relied on vendors waving one. What you can verify:

a signed BAA (not "available on request" — signed, by you);
an independent SOC 2 report or equivalent security audit;
written encryption, access-control, and incident-response practices;
explicit model-training and data-retention policies in the terms, not a blog post.

The vendor checklist

HIPAA diligence for an AI transcription vendor
Question	Disqualifying answer
Will you sign a BAA?	No, or only on an enterprise plan you don't have
Is audio encrypted in transit and at rest?	Anything but yes, for both
Do you train AI models on customer audio or transcripts?	Yes, or an opt-out buried in settings
Who can access recordings, and is access logged?	No role-based controls, no audit trail
Can we delete data and set retention windows?	Indefinite retention you can't control
Where is data processed and stored?	Vendor can't say, or won't name subprocessors
What are your breach-notification commitments?	Nothing in writing, or slower than the 60-day rule
Do you have an independent security audit (e.g., SOC 2)?	"We take security seriously" with nothing to show

This is the healthcare-specific slice of a broader vendor review — for the full 12-point security checklist covering any confidential audio, see Is your AI transcription tool safe for confidential audio?

Why consumer note-takers don't clear the bar

Most free and consumer-grade transcription apps fail this checklist at the first or third row: no BAA, and training rights over your audio. Some also retain recordings indefinitely, sync them to consumer cloud accounts, or route audio through subprocessors they won't name. None of that is sinister for a podcast interview — all of it is disqualifying for a patient conversation. The same divide shows up in legal work; we've written about it in exma vs. consumer AI note-takers.

Rule of thumb: if a conversation would belong in the chart, its recording belongs only in tools operating under a BAA.

Beyond HIPAA: the adjacent rules

State privacy and recording laws. Consent to record varies by state (one-party vs. all-party) — HIPAA compliance doesn't cure an unlawfully recorded call.
42 CFR Part 2. Substance-use-disorder treatment records carry stricter federal confidentiality rules than baseline HIPAA.
Medical-legal work. Recordings that may become evidence — IMEs, depositions of treating physicians, disability hearings — also need the verbatim fidelity and chain-of-custody practices covered in What makes a transcript court-admissible?

Frequently asked questions

Is AI transcription HIPAA-compliant?

Not by default. Compliance depends on the vendor: a signed BAA, encryption in transit and at rest, access controls with audit logs, no model training on your data, and retention you control. With those in place, AI transcription can be used compliantly.

Do I need a BAA with a transcription vendor?

Yes — if you're a covered entity or business associate and the audio contains PHI, the vendor is your business associate and a written BAA is required before any PHI moves.

Is there an official HIPAA certification?

No. No government body certifies software as HIPAA-compliant. Verify a signed BAA, SOC 2-type audits, and written data-handling policies instead of trusting a badge.

Can I use a consumer AI note-taker with patients?

Generally no — no BAA, possible training rights over your audio, and retention you don't control. Use purpose-built tools operating under a BAA.

What if the vendor has a breach?

The Breach Notification Rule applies: the vendor must notify you without unreasonable delay (60 days at the outside), and you must notify affected individuals and HHS. Your BAA should set the timelines and duties — read it before signing.

This article is general information, not legal advice. HIPAA obligations depend on your role, your state, and the specifics of your data flows — consult your privacy officer or counsel for decisions about PHI.

Transcription built for data-sensitive work

exma encrypts audio and transcripts in transit and at rest, never trains AI models on your data, logs access, and supports the workflows regulated teams rely on. Try it in your browser.

Create your free workspace