HIPAA-compliant transcription: what the rule actually requires

Vendor selection follows from one definition. Under 45 CFR 160.103, a business associate is a person who,

“On behalf of such covered entity… but other than in the capacity of a member of the workforce of such covered entity… creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter…”

Every element matters, and reducing this to “they received PHI” is the most common way to get it wrong. The party must be acting on your behalf, must be outside your workforce, and the activity must be one the rule regulates. Someone can receive PHI and still not be a business associate, most obviously another provider receiving it for treatment. A separate branch of the definition covers enumerated professional services, such as legal or accounting work, where providing the service involves disclosure of PHI.

Applied to this category the answer is usually straightforward: a transcription provider that processes identifiable patient recordings for you is ordinarily a business associate, and 45 CFR 164.502(e) then requires a written contract with satisfactory assurances before you disclose the recording.

Notice what the definition does not turn on: encryption strength, data center location, or SOC 2. Those may be useful inputs to your risk management and your vendor diligence, but none of them determines business associate status, and two of them are not HIPAA requirements at all. What the Security Rule requires is reasonable and appropriate safeguards, with encryption treated as addressable rather than mandatory in every case.

Paragraph (4) of the definition excludes four categories, each with conditions worth reading rather than paraphrasing loosely:

• A health care provider, with respect to disclosures by a covered entity to that provider concerning the treatment of the individual.
• A plan sponsor, with respect to disclosures by a group health plan, or by a health insurance issuer or HMO with respect to a group health plan, to the plan sponsor, and only to the extent the requirements of § 164.504(f) apply and are met.
• A government agency, with respect to determining eligibility for or enrollment in a government health plan that provides public benefits and is administered by another government agency, or collecting PHI for such purposes, to the extent those activities are authorized by law.
• A covered entity participating in an organized health care arrangement that performs a function or activity described in paragraph (1)(i) for that arrangement, or provides a service described in paragraph (1)(ii) to or for it, by virtue of those activities or services.

Software vendors are not on that list, and vendors sometimes present that as ominous. It is not, and the reason matters: paragraph (4) is not the only route to not being a business associate. A vendor that never satisfies the positive definition, because it never creates, receives, maintains, or transmits PHI on your behalf, needs no exception at all. It simply is not one.

The related “conduit” idea is narrower than its reputation. OCR treats it as covering transmission-only services, storage that is temporary and incidental to transmission, and access that is transient or infrequent and necessary to that transmission or required by law. A transcription service that stores your audio or transcripts persistently is outside it, and OCR has been explicit that persistent storage defeats conduit status even where the provider holds no decryption key.

This is the part our own category oversells, so here it is plainly. Keeping processing local can remove one question, whether a software vendor receives PHI and therefore needs a BAA. It removes nothing else, and it creates work of its own.

• You owe a fresh risk analysis. The Security Rule requires an accurate and thorough assessment of risks to all ePHI you hold, and recording consultations creates a new corpus of audio and transcripts on an endpoint that may never have held a designated record set before. That is a change to analyze, not a step you skip because nothing was uploaded.
• Encryption is risk-based. Encryption is an addressable implementation specification, so the question is what your risk analysis concludes and what you document, not a universal checkbox. In practice, full-disk encryption on a portable endpoint holding patient audio is very hard to reason your way out of.
• A lost laptop triggers an assessment, not automatic notification. Breach notification concerns unsecured PHI and requires the regulatory risk assessment. PHI encrypted to the specified standard can fall outside the notification requirement entirely, which is the practical argument for encrypting before you need it.
• The rest of the Security Rule still applies. Access control, audit controls, integrity, authentication, device and media controls, contingency planning and backup, and secure disposal all reach these files. How long you must keep the records themselves is a separate question: the Security Rule’s six-year rule governs required HIPAA documentation, while medical record retention periods generally come from other federal or state law.
• Privacy Rule duties follow the record. If a transcript becomes part of a designated record set, patient access and amendment rights attach to it.
• Recording consent is a separate question. State wiretap and recording law, and professional ethics rules, apply regardless of where processing happens, and they are not the same thing as a HIPAA authorization. HIPAA permits many treatment, payment, and operations uses without individual authorization; authorization is required where the Privacy Rule does not otherwise permit the use or disclosure.
• You lose a party to hold accountable. A business associate under contract carries obligations and liability. Your own endpoint carries none.

The honest summary: local processing converts a vendor-disclosure problem into an endpoint problem. That can be a very good trade, particularly where the endpoint is already managed to the standard your other clinical systems require. It is a trade, not an exemption, and an unmanaged personal laptop is a materially worse place for this corpus than a managed workstation.

Minutes is built for the third architecture. It records on your device, transcribes locally with whisper.cpp, diarizes with local models, and writes markdown into a folder you control. In a local-only deployment, we do not receive, maintain, or transmit your PHI, and supplying software to someone who uses it that way does not by itself create a business associate relationship.

That conclusion is conditional on your deployment, and it is worth being blunt about what breaks it. Configure a provider-backed summarizer, which is off by default, and transcript text goes to whichever model provider you chose, whose terms then govern. Connect an AI agent over MCP and ask it to read your meetings, and what it reads travels to that agent's provider as context. Sync your meetings folder to a hosted drive and that host is now storing PHI. Grant anyone remote access to the machine and the same applies. None of those are exotic; they are ordinary choices that change the analysis, and each needs its own review and ordinarily a BAA with that party. Our security page enumerates every case where bytes touch the network.

Where it is the wrong tool:

• You need a certified transcript for a filing or proceeding. Requirements vary by jurisdiction and use, and that is generally a human service.
• You want an ambient clinical scribe that writes structured notes into your EHR, suggests codes, or drafts to a SOAP template. Minutes is not a medical scribe and has no EHR integration.
• You need centralized audit logs and administrative oversight across a practice. Local files give you ownership, not governance.
• Your posture depends on having a business associate to hold accountable. Sometimes that contract is precisely the point.
• The endpoint is an unmanaged personal device. Then you have moved the risk rather than reduced it.

If you are comparing named products rather than architectures, we keep a sourced vendor-by-vendor breakdown of which AI note takers can be used with PHI, and on which plan tier.