Is there a HIPAA dictation app? The honest answer

A HIPAA dictation app does not exist as a certified category, since HIPAA has no certification program for software. Parlo has not been HIPAA certified. What a covered entity can check instead is where processing happens, how history is encrypted, and whether a vendor will sign a business associate agreement.

By Eric Friedman. Last updated 2026-09-08.

Search "hipaa dictation app" and the results split two ways. Some vendor pages say yes in the headline, then get vague in the fine print. Others say nothing about it at all. This guide sorts out what HIPAA actually covers and why no dictation app carries a government HIPAA certification. It also covers what a clinician, a practice manager, or a compliance lead should check before trusting any vendor with a patient or client recording, Parlo included. If you are a solo practitioner or a small practice, you are probably comparing a consumer app against something built for a hospital IT department. The two are not the same shopping decision.

Dictation apps for medical and legal work fall into two rough camps. Some process your voice on a server the vendor controls, then send text back to your device. Others process on the device you are already holding, so the audio never travels to a server in the first place. Where processing happens is the first fact a compliance lead needs, since it changes whether protected health information touches a network at all. The second fact is how a vendor talks about compliance. A signed business associate agreement is a commitment between two parties. A HIPAA certification for software is not, because no such certificate exists to earn.

Is there a HIPAA dictation app?

No. HIPAA has no certification program for dictation software, note-taking tools, or any other app. No government body certifies an app under HIPAA; vendors sign agreements instead. Parlo has not been HIPAA certified. Of the five products in this guide, only Wispr Flow's own pages list HIPAA among its security claims, and that is the vendor's statement, not a government certificate. What a covered entity actually needs is a vendor willing to sign a business associate agreement, plus a workflow that keeps protected health information inside safeguards the entity itself controls. A marketing page that calls an app compliant is describing that vendor's own claim, not a badge any agency issued.

What the HIPAA Security Rule actually requires

The Security Rule is the part of HIPAA that governs electronic protected health information, and the Department of Health and Human Services enforces it. It applies to covered entities, such as clinics, hospitals, and insurers, and to their business associates, meaning the vendors those entities work with. The rule requires administrative, physical, and technical safeguards: access controls, audit logging, and encryption where it is reasonable and appropriate. It also requires a documented risk analysis that the entity keeps up to date. It does not certify any specific product, dictation app or otherwise. A covered entity stays responsible for its own risk analysis. It also stays responsible for the agreements it signs with every vendor it uses, no matter what that vendor's site claims about itself.

The Office for Civil Rights, the HHS division that enforces the Security Rule, does not run a certification program either. It investigates complaints and breach reports, and it can require corrective action from a covered entity or a business associate that falls short. That enforcement authority reaches covered entities and their vendors under a signed agreement, not a piece of software sitting on an app store shelf on its own. An app becomes part of a covered entity's compliance picture only once that entity puts it to work under its own safeguards and its own signed agreements.

What a vendor's claim about HIPAA usually means

When a vendor's site says it satisfies HIPAA, that sentence describes practices the vendor chose on its own. Think encryption at rest, access logging, a signed agreement it will offer on request, and sometimes a third-party audit. None of it is a government certification, since none exists for any vendor to hold. The distinction matters because a practice or a firm still has to run its own review before it trusts a tool with protected health information. Ask what the claim actually rests on. Is it a signed business associate agreement, an audit report you can read, or only a paragraph of marketing copy with no document behind it? A vendor that will not put an agreement in writing is not one to trust with a patient's or a client's words, no matter what its homepage promises.

Where do dictation apps process your voice?

Processing location is the fact every other privacy claim rests on, so start there. The table below comes from each vendor's own published pages, not from summaries written somewhere else.

Wispr Flow's home page states SOC 2 Type II, HIPAA, and ISO 27001 certification as a security claim. Ask any vendor what each of those covers and what agreement it will sign for your data. superwhisper, Spokenly, and Monologue process at least some audio on the device by default or by your choice. Wispr Flow's privacy page names the cloud as the only place transcription happens for that product. Parlo processes everything on the device: transcription with Apple's SpeechAnalyzer and SpeechTranscriber, and cleanup with an on-device FoundationModels model. The speech engine is the same one behind Apple's own newest system dictation.

Where does dictation audio go?

Audio is the most sensitive input in this whole category, so it is worth spelling out on its own. With Parlo, audio is captured, transcribed on your device, and discarded right after. Parlo never stores a recording of an appointment, a call, or a deposition. The first run may need a one-time download of Apple's on-device speech model. Beta builds also refresh the transform prompts once a day from parlokey.com, a fetch that carries no user data. Your transcript stays on the device, encrypted at rest under a key that never leaves it through iCloud Keychain or a backup. If history sync is on, the transcript also syncs through your private iCloud, end-to-end encrypted, so Apple and Parlo hold ciphertext, never the plaintext and the key together.

What AI dictation software for doctors should actually do

Clinicians looking for an AI dictation app for medical notes usually want two things at once: accurate transcription, and a note that reads clean the first time. That is the difference between a note you can file and one you rewrite. It is a feature question, separate from the compliance question above. Parlo's cleanup runs on-device, removing filler sounds, false starts, and repeated words, and applies spoken commands like "new paragraph" while you talk. A length guard rejects cleanup output that runs implausibly longer than what you actually said. It falls back to the plain transcript instead, so the note does not quietly grow clinical detail you never spoke.

AI dictation software for doctors, in other words, is really two separate claims sold together. One is an engine that turns speech into text; the other is a model that turns rough speech into a readable note. Neither one is a compliance claim by itself. A vendor can be excellent at cleanup and still process audio on a server you have no visibility into, or the reverse. Judge the two questions on their own facts. Use the processing table above for the first question. Use your own read of a sample note for the second, rather than letting a single label like "best dictation software for doctors" answer both at once.

A custom dictionary is a separate, smaller feature worth knowing about here. In Parlo, it is a do-not-correct list you build in Settings. Add a drug name, a diagnosis, or a client's name once, and the iPhone keyboard's autocorrect stops changing it when you type. It does not change what the speech engine recognizes when you dictate, and it does not feed the cleanup model. Treat it as a typing convenience, not a transcription accuracy feature, when you compare tools a medical team might pick.

The clinician guide covers daily use: notes, letters, and what to turn off.

Does the same honest answer apply to legal dictation?

Yes. Lawyers dictate client notes, call summaries, and draft letters just as often as clinicians dictate charts, and the same absence of a certification applies. There is no government body that certifies a dictation app for legal privilege either. A firm's own confidentiality obligations do not change because a vendor's marketing page uses the word compliant. The processing-location table above and the compliance-lead questions below work the same way for a law firm evaluating a vendor as they do for a medical practice. Bar rules on confidentiality vary by jurisdiction, and this page cannot summarize every one of them. The honest move is the same one clinicians make: check a vendor's practices directly rather than trust a label on its homepage. The private dictation for lawyers guide covers the day-to-day questions a firm asks that this page does not have room for.

Questions a compliance lead should ask

A vendor's marketing copy is not the review. These are the questions that actually matter, with what to check instead of taking a claim at face value.

Notice that the Parlo column never answers with a plain yes. That is deliberate. A processing location and an encryption design are facts you can verify against the app repo and this page's sources. The business associate agreement row is the one place the answer is "Check the vendor" instead of a fact. A signed agreement is a legal step a practice or firm takes with a vendor directly, and no page on this site can complete that step for you.

Is a beta safe for clinical or legal use?

It is a beta, and that matters more here than in most categories on this site. Dictation, cleanup, and the feed work every day for our testers, but rough spots exist and are listed on the beta page. Your notes are encrypted on the device and, if sync is on, in your private iCloud, so a bad build does not expose them. Still, a beta is not the same commitment as a signed agreement with an established vendor, and this guide is not telling you to treat it as one. If your practice or firm needs a signed business associate agreement before any tool touches protected health information, ask any vendor, Parlo included. Confirm it will sign one before you rely on that tool for that purpose. Send feedback by replying to beta@parlokey.com if something does not hold up during your own review.

Where Parlo fits

Parlo transcribes with Apple's SpeechAnalyzer and SpeechTranscriber, the on-device engine class behind the newest system dictation. It is the only engine Parlo uses. There is no cloud transcription option and no bring-your-own-key path to a third-party server.

Audio is never persisted. Parlo captures it, transcribes it, and discards it right after, the same way on iPhone and on Mac.

Local history is encrypted at rest under a device-only key, so a copy of your device's storage on its own does not reveal your dictations.

History sync, when it runs, is end-to-end encrypted through your private iCloud and on by default. Turn it off in Settings, or skip signing in with Apple, and no encrypted copy is ever created in the first place.

There is no Parlo account and no server of ours holding your content. Sync, if you use it, is keyed to your own iCloud identity, and signing out drops you into a fully local mode.

Beta builds refresh the on-device transform prompts once a day from parlokey.com. That fetch carries only prompt text, never anything you dictated. App Store builds never fetch at all.

The beta is free. The apps carry no purchase or subscription code, so there is no billing relationship to review as part of a vendor assessment. Install on iPhone through the public TestFlight link, on Mac through a notarized download.

None of that adds up to a HIPAA certification, because none exists for any dictation app to hold. It is a set of file-backed facts a compliance lead can check directly, which is the most any dictation app, this one included, can honestly offer today.