Medical dictation on a Mac: what HIPAA asks of a dictation app

A clinician can physically dictate a clinical note on a Mac with any dictation app, but whether that is permitted is a compliance decision, not a product feature. No app is "HIPAA compliant" by itself. HIPAA puts duties on the practice and on vendors that handle patient information for it, and if a vendor handles that information the practice normally needs a signed business associate agreement (BAA) first. General dictation apps, including SuprFlow, are not medical dictation software: they have no chart integration and no medical vocabulary guarantee. Your compliance officer decides.

This page is general information, not legal advice.

Publisher note: SuprFlow publishes this guide and is one of the products discussed. Competitor details come from each company's own pages, checked on 1 October 2026. Prices and features change; confirm before you buy.

What does HIPAA require when you dictate patient information?

The definitions come from the HIPAA regulations themselves and from United States Department of Health and Human Services (HHS) agencies.

• Covered entities. 45 CFR 160.103 lists them as a health plan, a health care clearinghouse, and "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter." The Centers for Medicare & Medicaid Services puts it plainly: providers who submit HIPAA transactions, like claims, electronically are covered.
• Business associates. The same regulation defines a business associate as a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information" for a regulated function, and it includes subcontractors that do so. A service that receives your dictated audio or note text containing patient information is a candidate for that definition.
• Business associate agreements. CMS says: "If a covered entity engages a business associate to help carry out its health care activities and functions, the covered entity must have a written business associate contract."
• Security Rule safeguards. The HHS health IT office's Guide to Privacy and Security of Electronic Health Information (version 2.0, April 2015) says the Security Rule "contains the administrative, physical, and technical safeguards" that covered entities and business associates must put in place to secure electronic protected health information, and that a central requirement is a security risk analysis. NIST's SP 800-66 Revision 2 (February 2024) is a more recent implementation guide.

HHS also publishes guidance on HIPAA and cloud computing. Read it with your compliance officer before sending patient information to any cloud service.

In short, a dictation tool is one more system that touches patient information. It belongs in the practice's risk analysis, and any vendor that receives the information needs a BAA.

Is a general dictation app the same as medical dictation software?

No. Three different kinds of product get called "AI dictation for doctors".

A general app does not know what a medication list is, does not integrate with an electronic health record (EHR), and is not sold with clinical vocabulary commitments. If you searched for "Dragon Medical dictation Mac", ask Microsoft or your EHR vendor which of its clients run on a Mac. Microsoft's page lists a web browser, a mobile app and a desktop application for physicians without naming operating systems, so we make no claim either way.

Does on-device speech recognition make dictation HIPAA compliant?

No. It narrows the question; it does not answer it.

When speech is recognised on the Mac, the audio is not sent to a transcription service, so one potential business associate drops out of the picture. Everything else stays in it:

• The Mac itself. Disk encryption, screen lock, user accounts, backups and device management are part of the practice's safeguards.
• Copies of the text. Dictation apps may keep a local history, and the clipboard may hold the last note.
• The destination. The EHR, email client or document the text lands in has its own storage and sync.
• Other network traffic. Local speech recognition is not the same as no network activity.
• The room. Dictating aloud where others can hear is a disclosure risk no software fixes.

What does this mean for specific apps?

SuprFlow. SuprFlow has no BAA to offer and holds no medical or security certification. It is not an ambient scribe, has no EHR integration and makes no medical vocabulary promise. Its speech recognition runs on the Mac with a downloaded model, and its Default formatting is local cleanup of punctuation, capitalization and numbers. Its optional Cloud API formatting sends the transcript text to whichever AI provider you configure. Do not use that option with patient information unless the practice has a BAA with that provider. SuprFlow also keeps a local history of recent transcriptions and makes separate network requests for licence checks, updates, model downloads and usage telemetry; Where does my dictation go? lists them. Whether any of that is acceptable for clinical notes is your compliance officer's decision, and "no" is a reasonable answer.

Wispr Flow. If you are asking "is Wispr Flow HIPAA compliant", Wispr's HIPAA help article documents a BAA that an individual can sign under Settings → Data & Privacy and that an organisation's administrator can sign in its admin portal. It says a signed BAA locks model-improvement sharing and cloud dictation storage off. Wispr transcribes in the cloud, so the BAA is what makes it a candidate at all. A BAA is one requirement, not a verdict on your whole workflow. More detail is in Is Wispr Flow safe?.

Apple Dictation. Apple's Dictation guide says Keyboard settings show whether general text dictation is processed on your device. We did not find a statement about BAAs on that page, so ask your compliance officer rather than assume.

Dedicated medical products. If you need visit capture, structured notes or dictation inside the chart, products built for that purpose, such as those above, are the better choice than any general app. Ask the vendor for its BAA and its security documentation.

Questions to take to your compliance officer

1. Does this tool, or any provider it sends data to, create, receive, maintain or transmit patient information on our behalf? If yes, do we have a BAA with each one?
2. Where is audio processed, and where is the resulting text stored, including history, clipboard and backups?
3. Is the Mac managed, encrypted and covered by our risk analysis?
4. Which settings must be fixed, and who checks them after an update?
5. Would a product built for clinical documentation remove the question?

Questions people ask

Is SuprFlow HIPAA compliant?

SuprFlow makes no such claim. It has no BAA and no medical certification. Recognising speech on the Mac reduces what leaves the device, but compliance depends on the practice's whole workflow and is decided by its compliance officer.

Is Wispr Flow HIPAA compliant?

Wispr documents a BAA that users and organisations can sign and settings that the BAA locks. Whether your use is compliant depends on your practice's policies, devices and the apps you dictate into.

Can I use Apple Dictation for patient notes?

That is a question for your compliance officer. Check the processing notice in Keyboard settings on the actual Mac, whether audio sharing with Apple is switched on, and whether your organisation has any agreement with Apple covering it.

Is there Dragon Medical for Mac?

Microsoft's current pages describe Dragon Medical One and Dragon Copilot without stating operating system support. Ask Microsoft or your EHR vendor. Nuance discontinued Dragon Professional Individual for Mac in October 2018; see Dragon for Mac alternatives.

Related guides

• Is Wispr Flow safe?
• Where does my dictation go?
• Is Mac Dictation private?
• Local vs cloud formatting
• On-device dictation vs no internet
• Dragon for Mac alternatives

Sources

• U.S. Government Publishing Office — 45 CFR 160.103, Definitions (1 October 2024 edition)
• Centers for Medicare & Medicaid Services — Are You a Covered Entity?
• HHS Office of the National Coordinator for Health IT — Guide to Privacy and Security of Electronic Health Information, version 2.0, April 2015
• NIST — SP 800-66 Rev. 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide
• HHS — Guidance on HIPAA and Cloud Computing
• Microsoft — Dragon Copilot
• Microsoft — Dragon Medical One
• Nuance — Dragon Professional for Mac 6: end of life, end of support dates
• Wispr Flow Help Center — HIPAA Compliance and Healthcare Use
• Apple — Dictate messages and documents on Mac