Home > > > Before You Transcribe a Patient Conversation: 10 Plain-Language Privacy Questions

Before You Transcribe a Patient Conversation: 10 Plain-Language Privacy Questions

Author : Jordan Hale | Published On : 04 Nov 2026

Before you turn a recorded patient conversation into text, ask ten simple questions. Where does the audio go? Where is the transcript kept, and for how long? Is it used to train AI? Can you delete it? Will the vendor sign a business associate agreement if your organization needs one? This guide lists those questions in plain words, with short notes on why each one matters. It does not tell you whether any tool or workflow is compliant. That call belongs to your organization's privacy or compliance officer. It is not medical advice or legal advice.

Why ask questions instead of trusting a badge

Transcription tools are easy to start. You drop in a file, wait a minute, and get text. The hard part is everything you cannot see. The audio may travel to a server. A copy may sit in storage for weeks. A transcript may sync to an account you forgot you made.

Marketing pages often show words like "secure", "encrypted" or "HIPAA-ready". Those words are not answers. The U.S. Department of Health and Human Services (HHS) is direct about this. Its cloud guidance says: "OCR does not endorse, certify, or recommend specific technology or products." (HHS, Guidance on HIPAA & Cloud Computing). OCR is the HHS Office for Civil Rights. It enforces the HIPAA Privacy Rule.

A better habit is to ask every tool the same ten questions and write down the answers.

A quick word on terms. HIPAA is a 1996 U.S. law. Its Privacy Rule covers "protected health information", or PHI. HHS describes the scope. "The Privacy Rule protects all 'individually identifiable health information' held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral." (HHS, Summary of the HIPAA Privacy Rule). Note the word "oral". Spoken words are covered too, not just files and paper.

A fictional example to keep in mind

Take Dr. Lena Ortiz, a made-up family doctor with a small practice. She wants to record a follow-up visit, with the patient's permission, and turn it into a draft note. She has three tools open in three browser tabs. All three say "private". Which one should she use?

She cannot answer that from the home pages. She can answer it by working through the questions below.

Question 1: Where does the audio go when I press "transcribe"?

Start here, because every other answer depends on it. There are two basic designs.

  • Cloud tools upload the file to the vendor's servers. The speech model runs there. You get text back.
  • Local tools run the speech model on your own computer or in your browser. The audio file is not sent anywhere for transcription.

Many products mix both. A free mode may be local while a paid mode uploads. Ask which mode you are in at the moment you press the button.

You can check this yourself. Open your browser's developer tools, go to the Network tab, and watch for a large upload while the file is processed. Or load the page, turn off Wi-Fi, and see if transcription still works. If it works offline, the audio is not being sent anywhere at that moment.

Question 2: Where is the transcript stored afterwards?

Audio is only half of it. The transcript holds the same details in an easier form to copy. Ask where the text lives after the job is done.

It might stay only in your browser tab. It might be saved to a cloud account. It might sync across your devices. Read the privacy policy for the words "sync", "workspace" or "history".

This matters for local tools too. If you sign in and turn on sync, the text may leave your device even though the audio never did.

Question 3: How long is the audio and the transcript kept?

Look for a section called "Data retention". Good policies give separate answers for audio files, transcripts, account records and backups.

Watch for vague wording. "We keep data as long as necessary" tells you very little. Also look for edge cases. Some services clean up audio after a job succeeds but keep files from jobs that failed or were interrupted.

Write down the actual number of days, if there is one. If there is none, ask.

Question 4: Is my audio or transcript used to train AI models?

Search the terms of service and privacy policy for "train", "improve our services", "machine learning" and "human review". Some vendors use customer content to improve their models. Some let you opt out. Some never do it.

Also ask whether people at the vendor can listen to recordings for quality checks. For a patient conversation, that is a real difference.

Question 5: Can I delete it, and what does delete really mean?

Ask three things:

  1. Can I delete a single recording and its transcript?
  2. Does deleting it remove it from backups and logs, or only from my screen?
  3. Can I delete my whole account and its data?

Some services say that deleting an item removes it from your view, while sync records stay until the account is deleted. That is a fair disclosure. It is also worth knowing before you upload anything sensitive.

A tool where Question 1 has a short answer

Dr. Ortiz may decide the simplest path is to keep the audio on her own computer. That is one way to make Questions 1 to 5 easier to answer, because there is less data in other places to track.

For example, the free mode of Whisper Web's browser-based medical transcription page runs the Whisper speech model inside the browser. The audio is processed on the device instead of being uploaded. The free mode takes files up to 20 minutes and 200 MB, and needs no account. There are limits you should know. The optional paid Pro plan uses cloud processing, so files you pick there are uploaded. If you sign in and sync a workspace, the privacy policy says completed transcripts, including ones made locally, are sent to its servers. And Whisper is a general speech model, not a medical one, so drug names, doses and abbreviations need a careful human check. Its own FAQ says that compliance depends on your overall workflow and tells you to ask your compliance officer. For a longer look at why local processing matters in clinics, see this explainer on free AI medical scribes and browser privacy.

Local processing reduces the number of places data goes. It does not answer Questions 6 to 10 for you.

Question 6: Who else can touch the data?

Cloud services rarely run everything themselves. They use storage providers, processing providers, analytics tools and payment companies. These are often called subprocessors or service providers.

Ask for the list. Ask which of them receive the audio or the transcript, and which only see billing or usage data. A good privacy policy names them.

Question 7: Will the vendor sign a business associate agreement, if we need one?

A business associate agreement, or BAA, is a contract between a HIPAA covered entity and a service provider that handles PHI for it. HHS explains when a cloud service falls into this group. "When a covered entity engages the services of a CSP to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA." HHS adds: "This is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." (HHS cloud guidance). CSP means cloud service provider. ePHI is electronic PHI.

You do not need to decide here whether you are a covered entity or whether a BAA is required. Your compliance team decides that. HHS itself notes that using email or other technology "does not mean a health care provider is a covered entity". Your job in this checklist is simpler. Ask the vendor: "Do you sign BAAs? On which plans? Can I see the document?" Get the answer in writing. A logo on a pricing page is not a signed agreement.

Question 8: What happens to the data when I stop using the service?

Plans end. Free trials expire. Companies get bought. Ask what happens to stored audio and transcripts when you leave.

HHS's page on business associate contracts gives a useful hint about what to look for. It says a written contract between a covered entity and a business associate must, among other things, do this: "at termination of the contract, if feasible, require the business associate to return or destroy all protected health information" it received or created for the covered entity (HHS, Business Associate Contracts). Even if you are not signing a BAA, "return or destroy" is a fair thing to ask about.

Question 9: Do I have permission to record this conversation at all?

This question is about you, not the tool. Before any file exists, ask:

  • Did the patient agree to be recorded, and is that written down?
  • Does my clinic, hospital or school have a policy on recording visits?
  • Are there local or state rules on recording conversations that apply to me?

Your organization's policy is the place to start. If you are a student or trainee, ask your supervisor or program first.

Question 10: How much of the conversation do I actually need?

The less you record and keep, the less you have to protect. HHS describes a "minimum necessary" principle for covered entities. "A covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request." (HHS Privacy Rule summary).

In practice, that can mean recording only the part of a visit you need, or trimming the file before you transcribe it. It can also mean removing names, dates and places from the transcript.

A voice can identify someone on its own. HHS lists the identifiers that must be removed under the "safe harbor" method of de-identification. That list includes "Biometric identifiers, including finger and voice prints" (HHS Privacy Rule summary, end note 15). So a recording with the names cut out can still point to a person.

A one-page checklist you can copy

Copy this into a note and fill it in for each tool:

  1. Audio path: uploaded / local / depends on mode
  2. Transcript storage: browser only / cloud account / synced
  3. Retention: audio ___ days, transcript ___ days, failed jobs ___
  4. Training use: yes / no / opt-out available
  5. Deletion: single item / account / backups covered?
  6. Service providers that receive audio or text: ___
  7. BAA: offered on plan ___ / not offered / not stated
  8. Exit: return / destroy / unclear
  9. Permission: patient consent recorded? Policy checked?
  10. Minimum needed: what can I leave out?

If more than two lines say "unclear", stop and ask before you upload anything.

Short FAQ

Does using a local tool make me HIPAA compliant? No tool can promise that by itself. Local processing changes where data goes. Compliance depends on your whole workflow and your organization's rules. Ask your compliance officer.

Is an "encrypted" cloud service automatically fine? Encryption is good, but it is one piece. HHS notes that a cloud provider storing only encrypted ePHI can still be a business associate.

Can I use a recording of a real patient to try out a tool? Use a scripted, made-up conversation for testing. Save real recordings for tools you have already checked and been cleared to use.

Who should I ask if I am unsure? Your privacy officer, compliance officer or supervisor. HHS also says its own summary is "not a complete or comprehensive guide to compliance".

Sources

  • HHS, Summary of the HIPAA Privacy Rule: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
  • HHS, Guidance on HIPAA & Cloud Computing: https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html
  • HHS, Business Associate Contracts (sample provisions): https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html
  • Whisper Web, Medical transcription page: https://whisperweb.dev/transcribe-medical
  • Whisper Web, Privacy Policy (retention and sync sections): https://whisperweb.dev/privacy

All quotes checked against the pages above on October 19, 2026 (Beijing time). This article lists questions only. It is not legal, compliance or medical advice.