Short answer: local dictation fits a HIPAA workflow when patient audio never leaves the Mac. In MetaWhisp's free local mode, OpenAI's Whisper large-v3 runs on your Mac's GPU and CPU, with no account, no telemetry and no time caps. Pro and bring-your-own-key features send data to cloud services, so keep PHI in local mode. Compliance still belongs to your practice, not to any app.
What Makes Dictation Software HIPAA-Compatible?
No app is HIPAA compliant on its own. HIPAA puts the duties on covered entities, like your practice, and on the business associates that handle protected health information (PHI) for them. Dictation software is HIPAA-compatible when it helps you meet those duties without adding a new place for PHI to go.
The cleanest way to do that is to keep PHI away from anyone else. Under 45 CFR 160.103, a vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate. Cloud dictation sends your voice, names and diagnoses included, to the vendor's servers. Local dictation turns speech into text on your own Mac, so no vendor receives the recording.
That's the case for local dictation in one line: it takes a vendor out of the data flow instead of adding a contract.
Why Do Cloud Dictation Tools Need a BAA?
Because the audio goes to them. 45 CFR 164.308(b) lets a covered entity allow a business associate to create, receive, maintain, or transmit electronic PHI only after it gets satisfactory assurances, documented in a written contract or other arrangement, that the vendor will safeguard it. For a dictation vendor, that contract is the business associate agreement (BAA).
A BAA doesn't make cloud dictation wrong. It makes it a managed relationship. Otter, for example, lists HIPAA compliance as an add-on for its Enterprise plan on its pricing page (checked September 2026). The work is ongoing: vetting the vendor, keeping the contract current, and knowing where recordings live.
Local processing skips that step for dictation, because the recording never leaves your machine. There's no vendor to vet for it and no contract to renew.
Where Does Your Audio Go in MetaWhisp?
In local mode, nowhere. MetaWhisp runs OpenAI's open-source Whisper large-v3 through WhisperKit on your Mac's GPU and CPU. Speech becomes text on the machine, and MetaWhisp pastes it into any app that accepts paste. Local mode is free and unlimited, needs no account, and sends no telemetry or analytics.
Four optional features change that. Pro switches transcription to cloud servers, running Whisper large-v3-turbo on Groq, each time the app starts. Cloud transcription on the free tier with your own Groq or OpenAI key sends the audio to that provider. Structured mode and translation can use your own OpenAI or Cerebras key, which sends the transcript text, never the audio, to that provider. Calls can also be transcribed on your own Deepgram or Gemini key, and both are cloud services.
For PHI, stay in local mode and give Structured mode the optional local model, which runs offline on the Mac, so the text stays on the machine too.
| MetaWhisp setting | What leaves your Mac | With PHI |
|---|---|---|
| Local mode (free) | Nothing | Fits a HIPAA workflow |
| Structured mode with the local model | Nothing | Fits a HIPAA workflow |
| Structured mode or translation with your own OpenAI or Cerebras key | Transcript text, to that provider | Only if a BAA with that provider covers it |
| Cloud transcription with your own Groq or OpenAI key | Audio, to that provider | Only if a BAA with that provider covers it |
| Pro cloud transcription | Audio, to cloud servers | Keep PHI out |
Local mode doesn't cover the rest of HIPAA for you. The technical safeguards in 45 CFR 164.312 include access control, audit controls, integrity, authentication and transmission security. Those stay with your practice, your Mac's settings and your EHR. What local dictation does is keep the dictation step from adding a transmission to secure.
How Can You Check That Dictation Stays on Your Mac?
Turn the network off and dictate. A tool that processes on the Mac keeps working; a cloud tool can't transcribe without a connection. Then confirm with three more checks:
- Watch the traffic. Open Activity Monitor, pick the Network tab, and watch the app's sent bytes while you dictate a long passage with the network back on.
- Find the model. On-device speech recognition needs a model on the disk. MetaWhisp's Whisper large-v3 is a one-time download of about 3.2 GB, after a small starter model.
- Read the privacy policy. Search it for upload, servers and training. Cloud features should be named plainly, not buried.
Pro tip: Run every check with a fake patient: an invented name, a made-up date of birth, a common drug. Real PHI shouldn't touch a tool until it passes.
How Accurate Is Local Whisper on Medical Terms?
For MetaWhisp, there's no figure to share: medical accuracy hasn't been benchmarked. A general accuracy figure tells you little about drug names, dosages and abbreviations, which is exactly where a wrong word does damage in a note.
What I can share is general accuracy. In my own test (2026), I ran the same audio through several dictation apps and measured word error rate (WER), the share of words each app gets wrong. MetaWhisp scored 3.7%. SuperWhisper, Wispr Flow and MacWhisper came in around 3.5%, Google around 5 to 7%, and Apple Dictation 11 to 14%.
So MetaWhisp didn't win that test. Its case for clinical notes is where the audio goes, not a better score. Test any tool on your own dictation before you trust it with a real note.
| App | Word error rate |
|---|---|
| MetaWhisp | 3.7% |
| SuperWhisper | ~3.5% |
| Wispr Flow | ~3.5% |
| MacWhisper | ~3.5% |
| Apple Dictation | 11-14% |
| ~5-7% |
Pro tip: Read your 50 most-dictated drug names aloud at your normal pace, with fake patient details around them, and check each one. Score misspellings separately from drugs that turn into ordinary words. The second kind reads like normal English, so it's the one a quick review misses.
Cloud and Local Dictation, Side by Side
Cloud clinical dictation wins on specialization. Microsoft describes Dragon Medical One as speech-driven clinical documentation, with automatic punctuation, voice commands and dictation into the application of your choice. If your notes are dense with terminology, that focus can matter more than where the audio is processed.
The price is a vendor relationship: a BAA, vendor reviews, and trust in someone else's systems. Local dictation removes that relationship for the transcription step, and the free local mode has no per-seat bill. In exchange, you get a general-purpose model whose clinical accuracy MetaWhisp hasn't benchmarked.
My recommendation: choose one approach for PHI and write it into your risk analysis. Running a cloud tool for some notes and a local tool for others makes it easy to dictate PHI into the wrong one. Pick the setup you can explain to an auditor in one sentence.
| Aspect | Cloud clinical dictation | MetaWhisp local mode |
|---|---|---|
| Where speech becomes text | The vendor's servers | Your Mac |
| Business associate agreement | Needed with the vendor | Not needed for dictation |
| Medical vocabulary | Built for clinical documentation | Not benchmarked |
| Price | Ask the vendor | Free, no time caps |
Setting Up MetaWhisp for a HIPAA Workflow
Five steps take you from download to a setup you can document.
- Install and download the model. Get MetaWhisp from the download page. It runs on macOS 14 or later on Apple silicon (M1 or newer). A small starter model installs first, then the full Whisper large-v3, a one-time download of about 3.2 GB. Allow microphone access when macOS asks.
- Stay in local mode. It's free, unlimited and needs no account. Don't use Pro for PHI: with Pro, the app switches transcription to the cloud each time it starts. And don't add a Groq or OpenAI key for cloud transcription.
- Keep text modes offline. Raw, the default, and Clean both run on the Mac. For Structured mode, pick the optional local model instead of an OpenAI or Cerebras key. The text modes page explains all three.
- Run the airplane-mode test. Tap Right Command, dictate a note about a fake patient with the network off, then tap again. MetaWhisp pastes the text into any app that accepts paste, so check that it lands in your EHR's note field.
- Turn on FileVault and write it down. On Apple silicon your data is encrypted automatically, and FileVault adds a login-password requirement before anyone can decrypt it. Record the whole setup in the risk analysis that 45 CFR 164.308 requires.
Encryption matters on the worst day too. HIPAA's breach rules turn on whether PHI was unsecured, which 45 CFR 164.402 defines by whether it was made unreadable with methods HHS specifies. Ask your compliance lead whether your Mac's setup meets that bar.
Frequently Asked Questions
Does MetaWhisp meet HIPAA requirements?
No app meets HIPAA for you; compliance belongs to your practice. MetaWhisp's local mode is HIPAA-compatible: audio never leaves the Mac, there's no account, and there's no telemetry. That lets it fit a HIPAA workflow next to your own safeguards, policies and risk analysis.
Do I need a BAA to use MetaWhisp?
Not for local mode, because MetaWhisp never receives your audio or transcripts there. That changes with Pro, which moves transcription to the cloud, and with your own Groq, OpenAI, Cerebras, Deepgram or Gemini key, which sends data to that provider. Keep PHI in local mode and out of Pro; with your own key, send PHI only to a provider whose BAA covers it.
Does MetaWhisp work offline?
Yes, in local mode. After the one-time download of the Whisper large-v3 model, about 3.2 GB, dictation runs on your Mac's GPU and CPU with no internet connection. Pro works differently: it switches transcription to the cloud each time the app starts.
How accurate is MetaWhisp with medical terms?
Unknown: medical accuracy hasn't been benchmarked, so there's no figure to share. In my own general test (2026), with the same audio for every app, MetaWhisp had a 3.7% word error rate. Test your own drug names and abbreviations with fake patient data before you rely on it.
What happens if my Mac is stolen?
On a Mac with Apple silicon, data is encrypted automatically, and FileVault adds a login-password requirement before anyone can decrypt it. HIPAA's breach rules turn on whether PHI was unsecured, so ask your compliance lead whether your encryption setup meets the methods HHS specifies.
Can I use MetaWhisp during telehealth visits?
You can dictate the note after the visit in local mode, which keeps it on the Mac. MetaWhisp can also transcribe calls, labeling your side Me and the other side Them. Recording a patient raises consent rules that vary by state, so follow your practice's policy before you record.
Can MetaWhisp transcribe recorded patient interviews?
No. MetaWhisp transcribes live speech, dictation and calls, and doesn't open audio files. For an existing recording you'd need another tool, and if that tool uploads the file, the same BAA questions apply.
Which Macs can run MetaWhisp?
Macs with Apple silicon, M1 or newer, on macOS 14 or later. Local mode is free with no time caps and no account. There's no iOS app yet.
About the Author
I'm Andrew Dyuzhov, and I build MetaWhisp, so weigh my view of it accordingly. I'm a marketer and builder with ADHD, not a lawyer, doctor or ML researcher. I put MetaWhisp together with AI coding tools on top of OpenAI's open-source Whisper, and I dictate every day in Russian and English. The accuracy numbers here come from my own test. This article maps where audio goes; it isn't legal advice.
