Choosing HIPAA-compliant AI transcription starts with the data and the workflow, before a product demo. A clinic evaluating an ambient scribe, a researcher transcribing interviews, and a student recording a public lecture have different requirements. A vendor's healthcare landing page cannot settle those differences for you.
This guide helps practice managers, clinicians, and IT teams ask useful procurement questions. It is an evaluation framework, not a legal opinion or certification of any vendor. Have your organization's privacy, security, and clinical owners approve the intended use before patient information enters a new service.
First decide what you are buying
Separate three jobs that are often grouped under “medical transcription.”
| Workflow | Output to evaluate | Question to resolve before a pilot |
|---|---|---|
| Ambient clinical scribing | A draft note from an encounter | Who checks omissions, clinical meaning, and the final chart entry? |
| Recorded dictation or interview transcription | Text derived from a recording | How are speaker errors, terminology, corrections, and exports handled? |
| General voice notes without PHI | Personal notes or summaries | Has the material actually been cleared for the intended service? |
An attractive summary does not prove that a transcript is accurate. A good transcript does not prove that a generated clinical note is appropriate. Evaluate the output your team will use, including the work needed to correct it.
What the HIPAA review needs to cover
HHS describes the Security Rule as requiring appropriate administrative, physical, and technical safeguards for electronic protected health information, or ePHI. It is technology neutral and includes risk analysis and ongoing review. Do not reduce that process to a badge, a single encryption algorithm, or a SOC 2 report. See the HHS Security Rule summary.
For cloud processing, the relationship and contract matter. HHS explains that a cloud provider handling ePHI on behalf of a covered entity or business associate is itself a business associate, including when it cannot decrypt the information it stores. An appropriate business associate agreement, or BAA, and compliance with the applicable HIPAA requirements are necessary; the contract alone is not the whole review. See HHS guidance on cloud computing.
For procurement, ask the vendor to demonstrate its actual controls: account access, authentication, encryption and key management, activity records, incident response, and recovery. Establish which controls your organization must configure and which the vendor operates. This is a proposed evaluation checklist, not a claim that HIPAA mandates every named product feature in every deployment.
A nine-question vendor checklist
Request written answers for the exact product, plan, and configuration you intend to use. Keep unresolved answers visible instead of treating them as “probably included.”
| Question | Evidence to request |
|---|---|
| 1. What is covered by the BAA? | The applicable agreement, parties, covered services, exclusions, and activation requirements. |
| 2. Where does the data go? | A flow covering capture, transcription, summaries, support access, subprocessors, integrations, and backups. |
| 3. How can content be used? | Contract terms for training, product improvement, human review, and optional features. |
| 4. Who can access it? | A demonstration of user roles, authentication, administrator access, and offboarding. |
| 5. What activity can we review? | Sample activity records and the process for investigating access or changes. |
| 6. What is retained and deleted? | Separate policies for audio, transcripts, generated notes, backups, and downstream copies. |
| 7. How are incidents handled? | Contacts, notification obligations, escalation steps, and contractual response commitments. |
| 8. How do we correct and export records? | A demonstration using test material, including corrections and the receiving system. |
| 9. What happens when we leave? | Export formats, access removal, deletion confirmation, and the cost of transition. |
For incident planning, distinguish a contractual response target from a legal notification deadline. HHS states that business associates must notify covered entities of a breach without unreasonable delay and no later than 60 days after discovery. That outer limit is not a recommended time to wait before escalating an incident. Review the HHS Breach Notification Rule guidance with the responsible team.
Two vendor examples to investigate
The following are examples from public vendor documentation checked on September 9, 2026. They are not an independent security audit, a performance ranking, or approval for your organization to send PHI.
| Example | What the vendor's public page says | What you still need to verify |
|---|---|---|
| Freed | Its security page describes HIPAA compliance, encryption, BAAs with healthcare organizations, and a policy of not storing patient recordings. | The agreement and data handling that apply to your account, the complete note lifecycle, and the clinical review workflow. |
| Fireflies | Its BAA page offers an agreement and states that Private Storage is required for the BAA to take effect. | Eligibility, the required storage configuration, covered features, and confirmation that the agreement is effective before use. |
Read Freed's security page and Fireflies' BAA requirements directly. Public statements can help you shortlist a vendor; the signed terms and configured service determine what you can actually deploy.
For other vendors, use the same questions. Avoid assuming that an ordinary subscription includes a healthcare arrangement, or that a vendor's general security claims apply to every integration and AI feature.
Where Vowise fits
Vowise is a general-purpose voice capture and transcription product. This guide does not establish a Vowise BAA or authorize its use with PHI. Do not use it for patient encounters, identifiable case discussions, or another workflow requiring a BAA unless the appropriate product and contractual arrangements have been explicitly confirmed through your organization's review.
Possible non-PHI use cases include your own study notes, a public lecture you are permitted to record, or a marketing script containing no patient information. “Internal meeting” is not enough to establish that content is non-PHI: patient details can still be spoken, displayed, or included in an attachment.
Removing a person's name is also not, by itself, proof of HIPAA de-identification. HHS describes two methods: Expert Determination and Safe Harbor, with their associated conditions. Audio and free text need particular care because identifying context may remain. Use the HHS de-identification guidance and your qualified review process before treating patient-derived material as de-identified. Do not upload PHI to an unapproved service in order to have that service remove it.
For material your organization has cleared, explore Vowise's current features and available download options. Review the transcript and any generated output before relying on them. This is a route for general voice workflows, not a recommendation to use Vowise as a clinical scribe.
Plan a pilot that produces a decision
Start with synthetic or otherwise approved non-sensitive material. Specify the decision the pilot must answer before choosing a duration or inviting a whole department.
- Name the workflow and owners. Identify the person who captures audio, the person who reviews output, and the privacy and security owners who approve the service.
- Define meaningful errors. For a clinical-note evaluation, examples might include negation, medication names, dosage, speaker attribution, or invented details. Use qualified reviewers and appropriate test material.
- Measure correction work. Compare the output with its source and record the time spent reviewing and correcting it. Do not substitute a vendor's headline accuracy claim for this check.
- Test the handoff. Verify the actual export, correction, access, and deletion steps. A demo of an integration is not evidence that your configured workflow works.
- Set the release decision. Document what passed, what failed, who accepted any remaining limitations, and which changes require another review.
Keep data-retention choices tied to applicable obligations and approved policy. There is no useful universal “keep every recording for 30–90 days” recommendation for all these workflows. Retaining less can reduce exposure, but deleting too early can conflict with clinical, contractual, or recordkeeping needs.
Self-hosting also requires evaluation. Keeping a model on your infrastructure changes who operates the system; it does not remove the work of securing endpoints, controlling access, maintaining backups, handling updates, and checking output.
Frequently asked questions
Does a signed BAA make an AI transcription tool compliant by itself?
No. Treat it as part of a wider review of the intended relationship, service configuration, safeguards, policies, and actual operation. A contract does not verify clinical accuracy or configure your users' access.
Can we assume an administrative meeting contains no PHI?
No. Evaluate the content and the capture process. An agenda may be administrative while a participant mentions an identifiable patient or shares a record.
Which vendor is best?
The answer depends on the job, approved data handling, correction workload, and integration requirements. Shortlist vendors that can document the arrangement you need, then compare them using the same approved test material. This guide does not provide a universal winner or a tested accuracy ranking.
What should we do next?
Write a one-page workflow description: what is captured, which output is needed, who reviews it, where it goes, and what data it may contain. Use that description with the nine-question checklist before a vendor demo. For general note organization, see how to turn raw audio into structured notes and keep healthcare approval separate from a general productivity trial.