HIPAA-compliant medical dictation: why on-device matters

When a radiologist dictates into Dragon Medical One, the audio travels from the reading room to a Microsoft Azure data centre before text comes back. The same pattern applies to Augnito (audio to Augnito cloud), Dolbey Fusion Narrate (audio to nVoq), and most cloud medical dictation tools. Patient audio containing imaging findings for a named patient leaves your institution on every dictation.

This is a HIPAA-relevant transmission. It means a Business Associate Agreement with each dictation vendor, an audit trail for those audio flows, and a compliance posture that depends on the vendor staying compliant too.

The alternative is simpler. Use dictation software that processes audio on the local machine. No transmission, no Business Associate Agreement needed for the dictation layer, no third party holding patient audio.

This guide explains what HIPAA requires when you use medical dictation software, how cloud and on-device tools differ on the compliance question, and what to ask before choosing.

What makes medical dictation software HIPAA-relevant?

HIPAA applies to covered entities (healthcare providers, health plans, and clearinghouses) and their Business Associates. A Business Associate is any vendor that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered entity.

Medical dictation sits directly on this line. When you dictate a radiology report, the audio contains PHI: findings linked to a specific patient, often including name, date of birth, study indication, and clinical history. If that audio leaves your institution’s infrastructure and reaches a vendor’s server, the vendor is handling PHI on your behalf. Under HIPAA, that requires a signed Business Associate Agreement.

Every major cloud dictation vendor handles this by offering a BAA. Dragon Medical One, PowerScribe One, Augnito, and Dolbey Fusion Narrate all position themselves as HIPAA-compliant cloud services and will sign a BAA. This is the standard model and it works for most practices.

But the BAA path is not the only path.

How does cloud dictation create HIPAA compliance overhead?

Signing a BAA is the start of the obligation, not the end. Cloud medical dictation creates ongoing compliance work.

Vendor posture becomes your posture. When patient audio flows to a cloud vendor’s servers, your compliance picture partly depends on theirs. A vendor breach becomes your notification and response obligation. A change in their sub-processor list requires you to review what has changed. For most large practices this is manageable, but it is not zero cost.

Audit trail for every transmission. PHI flowing from your institution to a cloud server creates an audit record for that transmission. In departments running multiple cloud vendors, tracking these flows adds administrative overhead.

Network dependency. Cloud dictation requires reliable internet connectivity, typically two to four megabits per provider per direction. In reading rooms on VPN-only access, government networks with outbound audio restrictions, or hospital environments with strict data-flow policies, cloud dictation may not be viable at all.

Sub-processor chains. Cloud HIPAA compliance often involves sub-processors: Microsoft Azure for Nuance products, nVoq for Dolbey. The BAA extends through those relationships, but the chain is longer than a single vendor agreement.

None of these are disqualifying. They are overhead that on-device dictation avoids.

Does on-device dictation remove the PHI transmission problem?

Yes. When audio is captured locally, processed by a speech model running on the local machine, and converted to text without leaving the device, there is no PHI transmission to a third party.

On-device dictation means the dictation vendor never receives patient audio. If the vendor never receives PHI, there is no Business Associate relationship in that function to manage. You do not need a BAA for a vendor that does not touch your data.

This does not make HIPAA disappear from your environment. The EHR, PACS, and RIS where the dictated text lands still need to comply. But you have removed one link from the chain. The dictation tool is not a Business Associate because it processes audio locally and never transmits it.

For practices in restricted network environments, government facilities, or institutions with strict outbound data policies, on-device dictation is often the only viable path. For everyone else, it is the simpler compliance posture.

What do the main cloud dictation tools offer for HIPAA?

Dragon Medical One (Microsoft): Processes audio on Microsoft Azure. Microsoft maintains one of the most mature HIPAA compliance programmes in the cloud industry and will sign a Business Associate Agreement covering Dragon Medical One. For practices already in the Microsoft healthcare ecosystem, this is a well-worn path. Audio does travel to Azure for every dictation. Dragon Medical One has won Best in KLAS for clinical speech recognition six consecutive years (2021-2026).

PowerScribe One (Microsoft): Same Azure infrastructure as Dragon Medical One, with the same BAA path. PowerScribe 360, the on-premise predecessor, reaches end-of-support August 31, 2026, and full end-of-life August 31, 2027. PowerScribe 360 customers who do not migrate will lose vendor support well before HIPAA coverage becomes the concern, but the migration creates a decision point worth addressing now. The PowerScribe alternatives guide covers the full landscape for anyone scoping that move.

Augnito: Offers a cloud product and an on-premises option. The cloud version sends audio to Augnito’s servers; enterprise agreements include HIPAA coverage via BAA. The on-prem option keeps audio in-house but requires additional IT infrastructure.

Dolbey Fusion Narrate: Uses the nVoq cloud speech engine. Dolbey signs BAAs and positions the product as HIPAA-compliant. Audio travels to nVoq’s servers. Fusion Narrate Dx is the separate on-premises radiology variant.

All four work in HIPAA-covered practices today through the BAA mechanism. The question is whether that compliance path fits your institution’s policies and risk tolerance.

What should you look for in HIPAA-compliant dictation software?

Three practical filters cover most of the decision.

Does audio leave the machine? This is the simplest question. On-device processing means no PHI transmission to a vendor. Cloud processing means you need to evaluate the vendor’s BAA and compliance posture. Both are acceptable; they carry different obligations.

For cloud tools: is a BAA available, and who are the sub-processors? Reputable medical dictation vendors will sign a HIPAA Business Associate Agreement without hesitation. Get clarity on which entities are covered and whether sub-processors like Azure or nVoq are named in the agreement. A BAA that does not address the sub-processor leaves a gap.

Does the tool work in your specific network environment? Cloud dictation needs reliable outbound internet access. If your reading rooms sit behind a VPN, a government firewall, or a hospital network that restricts audio streaming, confirm that the cloud solution can reach its servers in every environment you work. On-device dictation has no network requirement after setup.

For the radiology-specific questions: accuracy out of the box, vocabulary depth, Mac compatibility, and how the tool fits across the PACS and EHR systems you use. The medical dictation software buyer’s guide covers those comparisons in detail.

Is RadMyk HIPAA-friendly?

RadMyk processes audio entirely on the radiologist’s machine. The speech model runs locally on macOS (Apple Silicon) and Windows. Audio does not travel to RadMyk’s servers, is not processed in any cloud service, and is not stored anywhere outside the local device.

Because RadMyk never receives patient audio, there is no PHI transmission to manage in the dictation path. The tool does not function as a Business Associate for dictation purposes, so no BAA with RadMyk is needed for that function. Healthcare organisations should confirm with their own compliance counsel how this applies to their specific policies, but the architecture is clear: patient audio stays in the room.

That is a different claim from “RadMyk is HIPAA certified.” HIPAA is a law that applies to covered entities and their associates, not a software certification. What RadMyk offers is privacy by architecture. The audio is processed locally, the vendor never receives it, and the compliance picture for the dictation layer simplifies accordingly.

RadMyk is a one-time purchase. No subscription, no renewal. Accuracy is 96.1% word accuracy out of the box, measured on radiology vocabulary on the public benchmark. The tool transcribes at roughly 220 words per minute and types at the cursor in any app: RIS and PACS report fields, EHR text boxes, browser-based reporting tools, Microsoft Word, and Citrix or remote desktop sessions. It works offline after setup.

Radiology trainees can use RadMyk free for their entire training period. Practicing radiologists get a 28-day free trial with no credit card required. See RadMyk’s pricing and trial options.

Cloud or on-device: which fits your practice?

Choose a cloud dictation tool with a BAA when: your institution already manages cloud vendor agreements, you need deep EHR integration or portable cloud profiles that follow you across devices, or you want features like ambient AI notes and structured report templates. Dragon Medical One, Augnito, and Dolbey are all legitimate options with proper HIPAA coverage.

Choose on-device dictation when: your institution prohibits outbound audio transmission, you work in a restricted network environment, you want to reduce the number of Business Associates managing patient data, or you prefer the architecture where patient audio stays on the machine because there is nowhere else for it to go.

RadMyk was built for the second case. One-time purchase, local processing, any app.

Voice-to-text is a basic tool of the trade, not a premium you rent forever.