HIPAA and dictation

HIPAA dictation on a Mac: an honest guide

No dictation app settles HIPAA on its own. What HIPAA cares about is where protected health information goes and who handles it, across a practice’s whole workflow.

Loquen keeps dictation on the Mac, which takes the dictation vendor’s server out of that picture. Loquen does not claim to be HIPAA compliant, and no single app can make a practice HIPAA compliant. Check how it fits your practice with your compliance officer. This page explains what to ask, and gives Loquen’s answers.

What HIPAA cares about when you dictate

The HIPAA Rules apply to covered entities (health plans, clearinghouses, and health care providers who transmit health information electronically in connection with certain transactions) and, in part, to their business associates. Three questions matter for a dictation tool.

Where does the PHI go?

A dictated note usually contains protected health information (PHI): a name, a date, a diagnosis. The Security Rule asks a practice to protect the electronic PHI it creates, receives, maintains or transmits, with administrative, physical and technical safeguards, starting from a risk analysis. The recording itself is sensitive too: HHS’s Safe Harbor list of identifiers includes biometric identifiers such as voice prints.

Who processes it?

HHS defines a business associate, in general terms, as a person or organization that creates, receives, maintains or transmits PHI on behalf of a covered entity. Its examples include a cloud service provider that processes or stores electronic PHI, and an independent medical transcriptionist or app vendor that provides transcription services to a physician. HHS’s cloud guidance adds that a provider holding only encrypted data, without the key, is still a business associate.

Is there a business associate agreement?

Before PHI goes to a business associate, the covered entity needs satisfactory written assurances, a business associate agreement (BAA), that the information will be safeguarded. With a cloud dictation service, that means a BAA with the vendor, and the vendor in turn needs one with any subcontractor that touches the data.

Why on-device processing changes the question

With cloud dictation, the audio of a patient encounter is processed on someone else’s servers. That can work with the right contracts, but it means a vendor, a BAA and a retention policy to trust.

Loquen runs speech to text and AI cleanup on the Mac’s own chip. In Private mode, the default, no audio and no text leaves the computer. Built for HIPAA the simple way: patient notes never touch a server, so there is no server to trust.

That does not make the Mac irrelevant. Loquen’s History can contain transcripts and normally keeps the 50 most recent recordings so Retry works; choosing Keep all audio retains more. An original recording or transcript can remain there after a redacted paste until it is deleted. The practice’s usual safeguards for any workstation that can reach PHI still apply: who can sign in, whether the disk is encrypted, and what happens when the Mac is retired.

What Loquen does

• Keeps every dictation on the Mac in Private mode, the default, and works offline.
• Uses the network for the initial approximately 2.2 GB model download, which carries no dictation. After setup, licence validation (licence key and an instance id, after the trial) and update checks (the app version) can use the network and carry no audio or text.
• Normally keeps the 50 most recent recordings locally so Retry works; Keep all audio retains more. It has no account, no telemetry, and never takes screenshots.

What Loquen does not do

• It does not make a practice compliant. Compliance is the practice’s whole workflow: policies, training, devices, vendors and the EHR.
• It does not de-identify text. Privacy Mode, below, is a redaction aid, and every result needs a human check.
• It does not decide what a cloud provider does with text in Enhanced mode. That is between you and the provider you choose.

Enhanced mode and your EHR

Enhanced mode is opt-in. It sends the text of a dictation, never the audio, to a cloud model you choose with your own API key. Once text goes to that provider, the BAA question applies to it, so Settings shows whether your account with the provider has a business associate agreement and zero retention. Any app can be kept in Private mode, so the EHR can stay on the computer while Enhanced handles other writing.

Privacy Mode: a tool, not a compliance programme

Hold a second key and Loquen finds and replaces common identifiers before pasting: names, dates and ages, record and account numbers, phone numbers and emails, addresses. It writes them as plain words, then cleanup rewrites the sentence so it reads naturally. The year of a birth date stays. A dictation comes out like this:

The patient, born in 1962, was seen today for chest pain. A family member was notified by phone.

You see every replacement marked. Return pastes it; Cmd-Z pastes the original. It is built around the categories HIPAA’s Safe Harbor method lists, and it runs on the computer. Safe Harbor names eighteen kinds of identifier and also requires that the covered entity have no actual knowledge that what remains could identify someone. That judgement belongs to a person, which is why the app says it plainly:

A tool, not a compliance programme. Detection is not exhaustive. Review every result before sharing.

Questions to take to your compliance officer

• Where do the audio and the text go, and is either stored?
• What network requests does the app make, and what do they carry?
• Which apps, such as the EHR, should be locked to Private mode?
• How are the Macs that run it secured?

Questions

Can I dictate patient notes with Loquen?

That is a decision for your practice and its compliance officer. What Loquen can tell you is where the words go: in Private mode, the default, speech to text and cleanup run on your Mac and no audio or text leaves it.

Does Loquen's maker ever receive my dictations?

No. There is no Loquen server that receives audio or text. The initial model download carries no dictation. After setup, licence validation sends the licence key and an instance id, and the update check sends the app version.

Does Privacy Mode de-identify my notes?

No, and nothing can promise that. It finds and replaces the common identifiers and shows you every replacement before it pastes; you check the text. It is built around the categories HIPAA's Safe Harbor method lists and runs on your computer, but what you share stays your call.

Sources

HHS pages on HIPAA, checked October 2026. This page is general information, not legal advice.

• HHS: Business Associates
• HHS: Guidance on HIPAA and Cloud Computing
• HHS: Summary of the HIPAA Security Rule
• HHS: Guidance on De-identification of Protected Health Information