HIPAA Compliant Transcription — Local AI, No PHI Upload, No BAA Roulette

Only on the Enterprise plan, and only after your organization signs a Business Associate Agreement through Otter's sales team (Otter announced HIPAA support in July 2025). Free, Pro, and Business plans have no path to a BAA, so recording patient visits, therapy sessions, or any conversation containing PHI on those tiers is an impermissible disclosure to a vendor — regardless of how strong the encryption is. Verify against Otter's help center before relying on any plan for PHI.

A signed Business Associate Agreement is the legal requirement — without one, sending PHI to a vendor is an impermissible disclosure under 45 CFR 164.502(e), no matter how good the security marketing is. Encryption at rest and in transit, audit logging, access controls, and retention limits are the technical safeguards the Security Rule expects on top. SOC 2 Type II is now the baseline expectation, not a differentiator. The fastest test: if the vendor cannot produce a BAA for your plan tier, it is not HIPAA compliant for your use.

Local transcription changes the legal question instead of answering it. If audio never leaves your machine, no business associate relationship is created — there is no vendor receiving PHI, so there is no BAA to negotiate and no vendor breach surface. But your HIPAA obligations do not disappear: the workstation holding recordings and transcripts must still satisfy Security Rule safeguards (disk encryption such as BitLocker or FileVault, access controls, audit trails, backup, and your retention policy). Local moves the compliance burden from vendor contracts to your own device controls. This page is general information, not legal advice.

Human services charge $1.25–$2.00 per audio minute (CareCloud publishes $0.08–$0.15 per 65-character line); HIPAA-eligible speech-to-text APIs run $0.006–$0.05 per minute at volume; consumer AI tools gate HIPAA behind enterprise tiers (Fireflies Enterprise $39/seat/mo annual with Private Storage, Rev's HIPAA plan is enterprise and annual-billing only, Otter Enterprise is quote-only). A local setup has no per-minute meter at all: the free VocalFuse tier transcribes on your Windows PC, and Pro is a flat $10/mo for AI notes.

Three of the most common tools require enterprise-grade commitments before any PHI touches them: Otter (Enterprise plan + signed BAA only), Fireflies (Enterprise $39/seat/mo billed annually, Private Storage enabled, and a signed BAA — Fireflies' own documentation says compliance is disabled if any one of the three lapses), and Rev (a HIPAA-specific enterprise subscription, annual billing only, MSA plus BAA required). Consumer and self-serve tiers of these tools are not covered. Microsoft Teams and Zoom support BAAs on healthcare plans, but note Zoom's own guidance: some AI features are automatically disabled once a covered entity signs the BAA because those features are not covered by it.

No BAA is needed because no PHI ever reaches us. VocalFuse transcribes with a local Whisper model on your Windows PC — audio and transcripts stay on your disk, and there is no vendor server holding patient conversations to breach, subpoena, or train on. The optional Pro plan syncs text notes to your account; for clinical work, keep sync off and nothing leaves the device. We deliberately do not market VocalFuse as "HIPAA compliant" — the accurate claim is that no vendor disclosure occurs in the first place.

Yes — record the session audio on your machine (a recorder, your microphone, or the telehealth platform's local audio feed) and transcribe locally. Two cautions: your telehealth platform itself still needs its own BAA and configuration (Zoom for Healthcare, Doxy.me, VSee, and properly configured Teams are the common choices), and patient consent for recording follows the most restrictive state involved in multi-state telehealth. Get consent before the visit starts, document it, and give patients a way to decline.

Modern Whisper-class models handle clinical vocabulary, drug names, and anatomical terms reasonably well on clear audio, and VocalFuse labels speakers (clinician, patient, specialist) in its structured notes — but verify both in the on-screen editor before anything enters a chart. Independent speech-recognition evaluations put AI word-error rates at roughly 5–9% on clean one-on-one audio, with accuracy dropping on noisy rooms, heavy accents, and crosstalk. That review pass is the same duty you already apply to any AI-drafted documentation.