HIPAA
US law governing protected health information. Cloud notetakers handling clinical audio require a Business Associate Agreement; local-only flows do not.
HIPAA (the Health Insurance Portability and Accountability Act) governs the handling of Protected Health Information by Covered Entities (providers, payers, clearinghouses) and their Business Associates. Audio of a clinical encounter is PHI. Any third party that processes PHI on behalf of a Covered Entity must sign a Business Associate Agreement.
A cloud notetaker that ingests audio is a Business Associate by definition and needs a BAA. Many consumer-tier notetakers do not offer one. A local-only flow on the clinician's encrypted Mac is not a Business Associate transaction at all because there is no third party in the data path. Mac Note Taker plus Ollama keeps the workflow entirely inside the clinician's device; if cloud AI is required, routing through Azure OpenAI under an existing Microsoft BAA is the standard pattern.
Related terms
- GDPR ↗EU regulation governing personal-data processing. Recording a meeting requires a lawful basis and disclosure; local-only storage simplifies residency.
- End-to-end encryption (E2EE) ↗A property where only the communicating endpoints can read the content - the service operator cannot. Common in messaging, rarely true for meeting notetakers.
- On-device ↗Processing that happens entirely on the user's hardware - no cloud, no network round-trip, no third-party data processor.