VoicePrivate Healthcare
Buy Now
Beyond HIPAA:
Dictation processed on your device
Cloud dictation tools sign BAAs because your patient audio reaches their servers. VoicePrivate processes dictation on your computer and does not receive your audio or transcripts, so there is no PHI on our servers to agree about.
Why BAAs exist, and why VoicePrivate is different
Under HIPAA, a Business Associate Agreement (vendor agreement) is required when a third party creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered entity. Cloud dictation services receive your audio (which may contain PHI), process it on their servers, and transmit text back, which generally makes them business associates who require a vendor agreement.
VoicePrivate does not receive your audio or transcripts. Dictation is processed on your computer. Because no PHI is shared with us, some practices conclude a business associate agreement does not apply. That is a determination for each practice, so consult your compliance officer or legal counsel to confirm your specific obligations.
Where PHI goes during dictation
Dictation is processed on your computer, and your audio is not sent to VoicePrivate.
Fewer places for PHI to leak
On-device processing reduces the number of third parties that handle your dictation. This is the architecture behind our medical dictation software.
Data in transit
Cloud tools encrypt audio during transmission, but encryption can be misconfigured, intercepted via MITM, or compromised at endpoints. With VoicePrivate, dictation audio is processed on your computer and is not sent to us.
Data at rest on third-party servers
Even with encryption, cloud-stored PHI is a target for breaches, insider threats, and legal discovery. Your transcript history is kept on your own computer, under your control, and is not uploaded to VoicePrivate.
Third-party vendor risk
Cloud dictation vendors may use subprocessors (AWS, GCP, OpenAI) who also access PHI. Each adds risk and requires their own compliance verification. VoicePrivate does not receive your audio or transcripts, so none of it passes to subprocessors on our side.
Employee access to PHI
Cloud vendor employees may access stored audio for debugging, quality assurance, or model training. Because VoicePrivate does not receive your audio or transcripts, we have no copy of your dictation to access.
Breach notification obligations
If a cloud vendor is breached, both they and you may face notification requirements under HIPAA. Because VoicePrivate does not hold your audio or transcripts, a breach of our systems would not expose them. Your own computer and backups still need to be secured, and your compliance officer can advise on your notification duties.
VoicePrivate vs cloud dictation
| Compliance Factor | VoicePrivate Health | Cloud Dictation (with vendor agreement) |
|---|---|---|
| Audio sent to the vendor | ✓ No | ✗ Every dictation |
| Vendor agreement (BAA) | Confirm with your compliance officer | Yes, typically required |
| Audio stored on servers | ✓ Not sent to VoicePrivate | ✗ Varies by vendor policy |
| Works offline | ✓ Dictation works offline | ✗ Internet required |
| Third-party subprocessors | ✓ None for dictation | ✗ AWS, GCP, OpenAI, etc. |
| Vendor employee access risk | ✓ We do not receive your audio | Access controls (trust-based) |
| Breach exposure | ✓ No audio or transcripts held by us | Server breach exposes all stored PHI |
| Medical vocabulary | 74,000+ terms | Varies |
| Specialty-specific dictionaries | ✓ Cardiology, Oncology, etc. | Limited |
Regulatory context
How on-device processing relates to several frameworks. Confirm your obligations with your compliance officer.
Business associate agreements
VoicePrivate does not receive your audio or transcripts. Whether a business associate agreement applies to your practice is for you and your compliance officer to decide. The covered entity keeps its data on its own device, plus any optional encrypted backup it turns on in its own iCloud Drive or a folder it chooses.
Breach notification
HITECH breach notification applies to unsecured PHI accessed by unauthorized individuals. VoicePrivate does not store your audio or transcripts on its servers, so there are fewer outside systems to breach. Your own device and backups still need to be secured.
State health data rules
States like California (CCPA/CPRA), Texas, and New York have additional health data protections. With on-device processing, your dictation is not shared with VoicePrivate. Check with your compliance officer on what each state requires of your practice.
Substance use disorder records
42 CFR Part 2 imposes strict limits on disclosure of substance use disorder records. With on-device processing, your dictation is not sent to VoicePrivate. Confirm requirements with your compliance officer.