Why cloud transcription is a HIPAA problem
Under the HIPAA Privacy and Security Rules, any vendor that receives PHI on your behalf is a business associate. A transcription service that takes your audio upload is exactly that. So before you can use it you need a signed Business Associate Agreement, a review of the vendor's safeguards, a record of where the data is stored and for how long, and a plan for breach notification if they lose it.
That's manageable for a hospital system with a compliance department. For a private practice, a therapist or a small clinic it's a lot of process for a dictation, and it's ongoing: every vendor change, every policy update.
Cloud transcription
Audio uploaded to a vendor. BAA required. Vendor safeguards to review. Breach risk shared with a third party. Often US servers, sometimes subprocessors abroad.
Local transcription
Audio stays on the clinician’s computer. No vendor receives PHI, so no BAA for the content. Your existing device safeguards, disk encryption and access controls, are the whole picture.
This page describes the technical design. It is not legal advice; your compliance officer decides what your safeguards must look like.
What Scrieb does with PHI
- Recordings are written to a folder you choose on the local disk. Never uploaded.
- Transcription and speaker identification run on your CPU or GPU. No audio is sent anywhere for either step.
- Summaries are generated locally by a model running on the device.
- Nothing reaches our servers. Our backend receives an email address, a random device ID, the app version and a usage counter in seconds. No text, no audio.
- Nothing is used for training, analytics or telemetry. Analytics events carry event names and metadata only.
The full data-flow description, including subprocessors for billing and email, is on the Data Protection & Security page.
Safeguards checklist for a local setup
Because the content never leaves the device, the device is the security boundary. A short list that covers most audits:
| Safeguard | Where | Notes |
|---|---|---|
| Full-disk encryption | macOS FileVault / Windows BitLocker | Protects audio files and exports at rest |
| Database encryption | Scrieb Settings | Optional SQLCipher, 256-bit; key in the OS keychain |
| Access control | OS user accounts, screen lock | Only authorised staff can open the machine |
| Storage location | Scrieb Settings | Choose a folder inside your managed, backed-up, encrypted volume |
| Retention | Delete recordings in Scrieb | Deleting a recording removes transcript, timecodes and notes; optionally the audio file |
| Export handling | DOCX / PDF / TXT | Files go into your EHR or document system like any other note |
Where it's used
Therapy and counselling
Session recordings become notes with speaker labels. Nothing is uploaded, which is what clients are told in the consent form.
Clinical dictation
Dictate findings and letters on the workstation. The result goes into the chart as DOCX.
Case conferences and team meetings
Multi-speaker recordings with attribution, without a bot joining the call.
Research with patient data
Interviews and focus groups transcribed under the same device safeguards as the rest of the study data.
Pricing
One licence for Windows and Mac, no minute limits, speaker identification included. Free trial first.
Questions from compliance officers
- Is Scrieb HIPAA compliant?
- HIPAA compliance is a property of how a covered entity handles protected health information, not a certification a software product holds. What Scrieb does is remove the part that usually creates the risk: recordings, transcripts and summaries are processed and stored only on your computer and are never sent to us or to any third party. Whether your overall setup is compliant depends on your own safeguards, such as disk encryption and access controls.
- Do I need a Business Associate Agreement with Scrieb?
- A BAA is required when a vendor creates, receives, maintains or transmits PHI on your behalf. Scrieb never receives your recordings or transcripts, so for the clinical content there is nothing for a BAA to cover. Our backend sees only account data: your email address, a device identifier and a usage counter. If your compliance officer wants an agreement covering that account data anyway, contact us.
- Is the data encrypted at rest?
- Scrieb offers optional encryption of its local database with SQLCipher (256-bit), enabled in Settings, with the key stored in the operating system keychain. Audio files are standard files on disk and rely on your device's disk encryption, FileVault on macOS or BitLocker on Windows. For PHI, enable both.
- Does it work without an internet connection?
- Yes. After the one-time model download, transcription, speaker identification and summaries run offline. That includes networks where outbound traffic is blocked by policy.
- Can it tell the clinician from the patient?
- Yes. Speaker identification runs locally and labels each passage by speaker, which is what turns a session recording into a usable note.
- What about the summaries, are they generated in the cloud?
- No. The summarisation model also runs on your computer. Scrieb does not use OpenAI or any other hosted AI service for your content.