Cloud Transcription and HIPAA: Where the Liability Actually Sits

Many healthcare and legal teams treat a cloud transcription vendor's "HIPAA compliant" label as the end of the conversation. It is the start. A business associate agreement governs what a vendor promises to do with your data once it has it. It does not change the fact that the vendor has it, along with the logs, backups, and metadata that come with every session.

Local speech recognition changes that starting point. When transcription runs on the device, no speech vendor receives the audio for that step. That does not make a workflow compliant on its own, but it removes a party, a contract, and a set of retention questions from the review.

Here is where the liability actually sits when you dictate sensitive material, and what local processing does and does not change.

The Metadata Problem Nobody Talks About

Even when a vendor says it does not keep your audio, its systems usually record something about each session: when it happened, how long it lasted, which account and device made the request, and whether errors occurred. That information lives in operational logs, analytics, and backups, each with its own retention schedule.

Why does that matter? Patterns in metadata can reveal more than people expect. Session times can show when a clinic is busiest or when a lawyer is working on an urgent matter. On their own, these details may not be protected health information or privileged content, but they describe your work, and they sit on someone else's systems.

When you review a vendor, ask about metadata explicitly:

• Which session details are logged?
• How long are logs and backups kept?
• Are logs covered by the same deletion process as audio and transcripts?
• Which sub-processors receive logs or analytics?

If the answers are vague, treat that as a finding in your risk assessment.

What Happens When You Hit Record on a Cloud Service

When you press record in a cloud transcription app, the app captures audio, opens an encrypted connection to the vendor, and streams or uploads the recording. The vendor's servers transcribe it and return text.

Several parties can be involved along the way. Many transcription products run on large cloud infrastructure providers, and some send audio to a separate speech-recognition provider rather than running their own models. Each party's role, location, and retention policy is part of your exposure.

Read the vendor's privacy policy and data processing terms for:

• Sub-processors: who else receives audio, transcripts, or logs.
• Model training: whether customer data is used to train or improve models, and whether that is opt-in or opt-out.
• Retention: how long audio, transcripts, and logs are kept, including in backups.
• Human access: whether staff or contractors can review recordings.

Under the GDPR, a processor "shall not engage another processor without prior specific or general written authorisation of the controller."^[1] HIPAA expects a similar chain of written assurances for business associates.^[2] Your contract should tell you who those parties are.

The HIPAA Picture

HIPAA defines a business associate as a person or entity that "creates, receives, maintains, or transmits protected health information" on behalf of a covered entity.^[3] A cloud transcription vendor that receives patient audio fits that definition. Before letting it do so, the covered entity must obtain satisfactory assurances, documented "through a written contract or other written agreement or arrangement."^[2]

HIPAA's minimum necessary standard asks covered entities and business associates to "make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request."^[2] Dictated notes usually contain the full clinical narrative, so it is worth asking whether a third party needs to receive that audio at all, or whether the transcription step can happen on the device.

Responsibility does not transfer with the data. If a breach of unsecured protected health information occurs, the covered entity must notify each affected individual "without unreasonable delay and in no case later than 60 calendar days after discovery."^[4] Even when a vendor causes a breach, the covered entity carries obligations to patients, and the BAA governs how costs and cooperation are handled between the parties.

The HIPAA Security Rule's technical safeguards also call for audit controls: mechanisms "that record and examine activity in information systems that contain or use electronic protected health information."^[5] When a vendor holds the data, you depend on the vendor's logs to know who accessed what. When the data stays on your devices, those controls are yours to configure and verify.

Legal Dictation and Client Confidentiality

Lawyers face a parallel question under their duty of confidentiality. Bar ethics opinions have generally allowed cloud services with conditions. The North Carolina State Bar's 2011 Formal Ethics Opinion 6 answers "May a law firm use SaaS?" with "Yes, provided steps are taken to minimize the risk of inadvertent or unauthorized disclosure of confidential client information and to protect client property."^[6] New York State Bar Association Ethics Opinion 842 says a lawyer may use an online data storage system "provided that the lawyer takes reasonable care to ensure that confidentiality will be maintained."^[7]

Those conditions put the burden on the lawyer to understand and monitor the vendor's practices. For a transcription service, that means knowing where recordings go, who can access them, how long they are kept, and how the vendor would respond to legal process seeking your data.

Records held by a third party can also become part of discovery and legal process. If dictated case notes or strategy discussions sit on a vendor's servers, you need to know what exists there and how long it persists. Local processing reduces the number of places those recordings can exist, which simplifies that analysis.

The Local Processing Architecture

On-device speech recognition runs a speech model on your computer. When you dictate into a local app, the audio goes from the microphone to the model on your Mac and comes back as text, without a speech vendor receiving it for that step.

Apple describes the benefit for on-device machine learning generally: running a model strictly on the device "removes any need for a network connection, which helps keep a person's data private."^[9]

What local processing does not do is secure the rest of the workflow. Your review still needs to cover:

• Device security: disk encryption, screen lock, and who can sign in.
• Transcript storage: where drafts are saved and for how long.
• Sync and backups: whether a sync service or backup copies transcripts off the device.
• Integrations: any cloud AI feature, plugin, or automation you enable.
• App network behavior: update checks, license checks, and telemetry.

You can check the transcription step yourself. Watch the app's network activity while you dictate online, then block its network access with an outbound firewall and see whether transcription still works. The two tests together, plus the vendor's documentation, tell you more than either alone. Our guide to auditing a transcription app walks through the method.

Performance Questions That Keep Organizations on Cloud

"Cloud transcription is faster" is a common assumption. Whether it holds for you depends on your hardware, model size, runtime, and network. Cloud services add a network round trip and depend on your connection; local models depend on your Mac and the model you choose.

Test both on the same recordings and measure two things: how long you wait for text after you stop speaking, and how many corrections you make. Our guide to measuring word error rate shows how to score accuracy consistently.

Offline availability matters for continuity. A local model keeps working during a network outage, in a basement office with poor signal, or behind a restrictive network. If dictation is part of a time-sensitive workflow, that reliability has real value.

What Compliance Officers Need to Document

A HIPAA risk assessment should show where protected health information flows and who can access it. For cloud transcription, that diagram includes the device, the vendor, its sub-processors, its storage and backups, and its logging systems, each of which needs contractual and technical review.

A local transcription workflow removes the speech vendor from that diagram. Document it plainly: which app performs transcription, that the transcription step runs on the device, where transcripts are stored, how long they are kept, which systems they flow into, and who can access them.

Vendor management also takes time. Negotiating and maintaining business associate agreements, reviewing vendors periodically, and tracking sub-processor changes all consume legal and compliance effort. Fewer vendors receiving protected health information means less of that work, though the size of the saving depends on your organization.

Making the Switch Without Workflow Disruption

Start with low-risk content. Try local dictation for internal emails, meeting notes, and memos before using it with patient or client information. Give your team time to learn how the model handles your vocabulary.

Expect differences in behavior. A general speech model may not format drug names, abbreviations, or citations the way a specialized product does. Add recurring terms to a custom vocabulary, and adjust dictation habits, such as spelling rare terms.

Plan multi-device use carefully. If clinicians or lawyers need transcripts on more than one device, decide how they will move, and make sure that path is covered by your security review.

Pilot and measure. Run a pilot with a small group. Track wait time, correction effort, and any workflow problems, then compare with your current tool.

Compare total cost. Include software price, the time spent on vendor agreements and reviews, and the cost of any outage. Auditory's current plans are on the pricing page.

The choice is not simply convenience versus security. Your audio either reaches a speech vendor or it does not, and that single fact determines how much of the vendor review you need to do.

References

[1] GDPR Article 28, Processor. https://gdpr-info.eu/art-28-gdpr/

[2] 45 CFR 164.502, Uses and disclosures of protected health information (Cornell Legal Information Institute). https://www.law.cornell.edu/cfr/text/45/164.502

[3] 45 CFR 160.103, Definitions (Cornell Legal Information Institute). https://www.law.cornell.edu/cfr/text/45/160.103

[4] 45 CFR 164.404, Notification to individuals (Cornell Legal Information Institute). https://www.law.cornell.edu/cfr/text/45/164.404

[5] 45 CFR 164.312, Technical safeguards (Cornell Legal Information Institute). https://www.law.cornell.edu/cfr/text/45/164.312

[6] North Carolina State Bar, 2011 Formal Ethics Opinion 6. https://www.ncbar.gov/for-lawyers/ethics/adopted-opinions/2011-formal-ethics-opinion-6/

[7] New York State Bar Association, Ethics Opinion 842. https://nysba.org/ethics-opinion-842/

[8] GDPR Article 83, General conditions for imposing administrative fines. https://gdpr-info.eu/art-83-gdpr/

[9] Apple Developer Documentation, Core ML. https://developer.apple.com/documentation/coreml