Beyond HIPAA:
No PHI ever leaves your device
Cloud dictation tools sign BAAs because your patient data hits their servers. VoicePrivate doesn't need a BAA because your data never leaves your device. That's not a policy — it's physics.
Why BAAs exist — and why you don't need one
Under HIPAA, a Business Associate Agreement (BAA) is required when a third party creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered entity. Cloud dictation services receive your audio (which may contain PHI), process it on their servers, and transmit text back — making them business associates who require a BAA.
VoicePrivate never receives, processes, or transmits your PHI. All processing happens on your device. There is no business associate relationship, and no BAA is needed.
Where PHI goes during dictation
Every step occurs on your local Mac. PHI never enters a network.
HIPAA risks eliminated
On-device processing removes entire categories of compliance risk.
Data in transit
Cloud tools encrypt audio during transmission, but encryption can be misconfigured, intercepted via MITM, or compromised at endpoints. VoicePrivate eliminates this risk entirely — audio never enters a network.
Data at rest on third-party servers
Even with encryption, cloud-stored PHI is a target for breaches, insider threats, and legal discovery. Your data exists only on your device's local storage, under your physical control.
Third-party vendor risk
Cloud dictation vendors may use subprocessors (AWS, GCP, OpenAI) who also access PHI. Each adds risk and requires their own compliance verification. VoicePrivate has zero subprocessors.
Employee access to PHI
Cloud vendor employees may access stored audio for debugging, quality assurance, or model training. No VoicePrivate employee can access your data — it physically exists only on your device.
Breach notification obligations
If a cloud vendor is breached, both they and you may face notification requirements under HIPAA. With no data on external servers, there is no external breach vector to trigger notification.
VoicePrivate vs cloud dictation compliance
| Compliance Factor | VoicePrivate Health | Cloud Dictation (with BAA) |
|---|---|---|
| PHI leaves device | ✓ Never | ✗ Every dictation |
| BAA required | ✓ No — no business associate | Yes — mandatory |
| Audio stored on servers | ✓ No servers exist | ✗ Varies by vendor policy |
| Works offline | ✓ Fully offline | ✗ Internet required |
| Third-party subprocessors | ✓ Zero | ✗ AWS, GCP, OpenAI, etc. |
| Vendor employee access risk | ✓ Impossible | Access controls (trust-based) |
| Breach exposure | ✓ None — no external data | Server breach exposes all stored PHI |
| Medical vocabulary | 74,000+ terms | Varies |
| Specialty-specific dictionaries | ✓ Cardiology, Oncology, etc. | Limited |
Regulatory context
On-device processing simplifies compliance across multiple frameworks.
No business associate relationship
VoicePrivate never creates, receives, maintains, or transmits PHI. The covered entity retains full control of all data on their device.
No breach notification trigger
HITECH breach notification applies to unsecured PHI accessed by unauthorized individuals. With no external storage, the attack surface for unauthorized access is limited to physical device theft.
Simplified compliance
States like California (CCPA/CPRA), Texas, and New York have additional health data protections. On-device processing means no data sharing with vendors — simplifying compliance with state-specific requirements.
Substance use disorder records
42 CFR Part 2 imposes strict limits on disclosure of substance use disorder records. On-device processing ensures these sensitive records never transit to a third party.