No dictation software is HIPAA compliant by itself. Compliance depends on how your practice uses it. For a therapist writing session notes there are two sound routes. One is a therapy note or dictation service that signs a Business Associate Agreement (BAA), such as Mentalyc or Upheal. The other is dictation that runs entirely on your own device, so no vendor ever receives the audio. The first puts your notes with a vendor that has signed up to protect them. The second keeps them with you, which makes your own device security the safeguard.
This guide is about a therapist’s own session notes. If you’re choosing a transcription service for a clinic or hospital, start with HIPAA-compliant transcription services, which covers the business associate rules, the questions to ask a vendor and device safeguards in detail. This is general information, not legal advice. Check your approach with whoever handles HIPAA compliance for your practice.
What HIPAA asks of a dictation tool #
In short: a vendor that creates, receives, maintains or transmits protected health information (PHI) for you is a business associate under 45 CFR 160.103, and you need a BAA with it before you send it session audio or notes. “HIPAA compliant” on a vendor’s website is a claim, not a certification. It usually means the vendor has security controls, will sign a BAA, and limits how it uses your data. Your side still includes client consent, access control, device security and retention.
Route 1: AI note tools that sign a BAA #
Therapy-specific AI tools can turn a recorded session, an upload or a dictated recap into a structured note. Two examples, per their own sites in September 2026:
- Mentalyc is a cloud platform for therapists, counselors and social workers. It says it is HIPAA-compliant and SOC 2 Type II certified, and you can download a signed BAA from your account settings. You can record sessions with consent, upload audio, dictate a recap or type a summary. It says session audio is deleted after transcription. Plans start at $14.99 a month (mentalyc.com).
- Upheal is an AI-based EHR built for therapists. It provides a BAA for every account and encrypts data in transit and at rest. It offers a free plan with unlimited notes, and an Individual plan at $1 per session, capped at $69 a month (upheal.io). You can dictate session summaries or capture sessions via audio, text or upload.
Good for: practices that want structured notes (SOAP, DAP, BIRP) generated for them, and EHR features in the same place.
Watch for: your notes, and possibly session audio, live on the vendor’s servers. Read the retention and AI training terms. If you record sessions, get informed client consent and check your state and licensing board rules.
Route 2: on-device dictation that never shares the audio #
If a vendor never receives PHI, it isn’t acting as your business associate for that data. On-device dictation works like that: the speech recognition model runs on your phone or computer, and nothing is sent anywhere to be transcribed.
Private Transcribe is one example, for iPhone and Android. It runs Whisper on the phone, has no account and no transcription server, and works in airplane mode. A typical use is dictating a short recap after the client has left: you speak, stop, and the text appears on the phone a few seconds later. You review it and paste it into your EHR. The app can delete the audio automatically and keep only the text, and Settings > Clear All Data wipes everything.
Be clear-eyed about the limits:
- The phone now holds PHI. Your safeguards have to cover it: passcode, encryption, auto-lock, no shared use.
- Backups can copy it. If your phone backs up app data to a consumer cloud service, that’s a copy of PHI with a provider you likely have no BAA with. Check your backup settings.
- The free version shows ads. They use the network but never see recordings. On a device used for clinical notes, the one-time Pro purchase ($7.99) removes them.
- It’s a dictation tool, not a note generator. It gives you your words as text. It doesn’t format a SOAP note, label speakers or connect to an EHR.
Built-in options follow the same logic. Apple says the device shows in Keyboard Settings whether dictation is processed on the device. If it isn’t, audio goes to Apple’s servers. On Windows 11, Voice Access works without an internet connection. More on-device tools are compared in best private dictation tools for lawyers and doctors.
Cloud BAA tools vs on-device dictation #
| Cloud tool with a BAA | On-device dictation | |
|---|---|---|
| Where audio and notes go | Vendor’s servers | Stay on your phone or computer |
| BAA | Needed, and offered | No vendor receives PHI to sign one |
| What you get | Structured notes, EHR features | Your words as text |
| Main risk to manage | Vendor security and retention terms | Your device security and backups |
| Cost | Monthly subscription, some per session | Often free or a one-time purchase |
| Examples | Mentalyc, Upheal | Private Transcribe, on-device Apple dictation |
Some practices use both: a BAA-covered platform for the official record, and on-device dictation for capturing thoughts between sessions.
A private dictation workflow for session notes #
- Dictate right after the session, while details are fresh. Two or three minutes is plenty.
- Use the minimum necessary. Refer to the client by initials or a code in the dictation, and add identifiers in the EHR.
- Follow your note format as you speak. For DAP, say the data, then your assessment, then the plan. The transcript will need less rearranging.
- Review every word. Speech recognition mishears names, medications and clinical terms. Custom vocabulary helps with recurring terms.
- Move the note into your EHR, then delete the dictation and audio from the device.
Whichever route you choose, add the device, its backups, your retention schedule and client consent to your HIPAA risk analysis. For apps built around not keeping audio at all, see speech to text apps that delete audio after transcription.
Frequently asked questions #
Is there an official HIPAA certification for dictation software? #
No. There’s no government certification that makes software “HIPAA compliant.” Vendors use the phrase to describe their safeguards and their willingness to sign a BAA. Whether your use is compliant depends on your policies and practices as well.
Do I need a BAA for an app that transcribes on my phone? #
If the developer never creates, receives, maintains or transmits PHI for you, it generally isn’t a business associate. On-device transcription is designed that way. Confirm by reading the app’s privacy policy, and check any backup services that might copy the data. Your compliance advisor should make the final call.
Is Apple’s dictation safe for therapy notes? #
Only when it’s processed on the device, which Keyboard Settings will tell you. Otherwise your audio is sent to Apple’s servers. Apple says it isn’t stored unless you opt in to Improve Siri and Dictation, but it has still left your device. Treat server-processed dictation as a disclosure to a third party.
Can I record therapy sessions for AI note-taking? #
Many therapists do, with informed client consent and a tool covered by a BAA. State laws and licensing boards may add requirements, and some clients will say no. Dictating a recap after the session avoids recording the client at all.