Nov 9, 2026

Article

Is a Medical Transcription API HIPAA Compliant? What a BAA Does and Doesn't Cover

1 min read

Is a medical transcription API HIPAA compliant? Not by itself. HIPAA's duties fall on organizations, meaning covered entities and their business associates, and no API can earn a government stamp, because HHS says it does not endorse or recognize private HIPAA certifications. What you can get is a vendor bound by a business associate agreement (BAA), data handling you have checked, and a product you built carefully. You need all three, and the third is your job.

Vendor pages tend to run four separate things together: HIPAA-eligible services, signed BAAs, zero data retention and security certifications. This article pulls them apart. For vendor comparisons, see the best HIPAA medical transcription APIs.

Sully sells a transcription API and wrote this article. This is not legal advice, so take the contract questions to your counsel.

Key Takeaways

"HIPAA compliant" isn't a product feature: It describes how organizations behave and what they have signed. HHS recognizes no private certification of it.
Keeping nothing doesn't remove the need for a BAA: A speech vendor that retains nothing still receives audio and creates a transcript, and those are two of the four verbs in the legal definition.
If you sell software to clinics, you're probably a business associate: Your speech vendor is then your subcontractor, and its BAA is yours to get. Breach notice windows stack to 180 days unless you shorten them.
Much of the exposure is in your own stack: Logs, webhook receivers, URLs, debug captures and test data all sit outside what a vendor's BAA can fix.

Four Things Vendors Blur

Term	Whose word is it	What it tells you	What it leaves open
HIPAA-eligible service	The vendor's	This service may handle PHI under the vendor's BAA	Whether you signed one, and what you connected to it
Signed BAA	HIPAA's	Permitted uses, safeguards, reporting and flow-down are contractual	Retention during the contract, audit rights, your own systems
Zero data retention	The vendor's	Some category of data isn't kept after some point	Which data, which endpoints, who qualifies, when the clock starts
Security certification	A private framework or auditor's	Someone outside assessed the controls in scope	Whether anyone is HIPAA compliant

HIPAA-eligible service

This is a vendor's list. AWS tells customers to keep PHI inside the eligible services named in its BAA, even though other services can run in the same account. Its list, updated 15 October 2026, includes Transcribe.

The failure mode follows from that design. The speech call is on the list, but the transcript then flows into an analytics or notification service that isn't. Nothing errors. Trace where the transcript goes after the response, not just where the audio goes.

Signed BAA

This one is law. A covered entity's assurances from a business associate must be documented in a written contract or similar arrangement, and the Security Rule says the same for ePHI. HHS's FAQ on using a cloud provider without a BAA puts the customer in violation.

Note what the signature doesn't do. The 2013 Omnibus Rule says a person becomes a business associate "by definition, not by the act of contracting". So skipping the paperwork doesn't keep a vendor out of HIPAA. It just leaves the vendor exposed and you in violation.

Zero data retention

Vendors use this term, but it doesn't appear in any of the HIPAA sections cited here. It's a good property with two traps.

The first trap is treating it as a replacement for a BAA. The definition of a business associate covers anyone who creates, receives, maintains or transmits PHI on someone's behalf, and retention is only one of those verbs. The conduit exception, the postal-service carve-out, is limited to transmission services and temporary storage incident to them. A speech API does more than carry audio, because it produces a transcript. Keeping nothing afterward doesn't turn that into transmission. That's a reading of the rule, not an HHS statement about speech APIs, so confirm it with counsel.

The second trap is that the term varies by endpoint. OpenAI's data controls guide currently lists no abuse monitoring retention for /v1/audio/transcriptions, but 30 days for /v1/realtime, and its Zero Data Retention control requires prior approval. That's one vendor with two speech endpoints and two different answers.

Also, any asynchronous API has to hold a result somewhere until you collect it. Ask when a retention claim starts counting.

Security certifications

HHS's position is plain. Its FAQ says the Security Rule doesn't require certification, that HHS doesn't endorse or recognize private ones, and that an outside certification doesn't stop HHS from later finding a violation. AWS says outright that cloud providers have no HIPAA certification to hold. Treat "HIPAA certified" on a vendor page as marketing.

SOC 2, HITRUST and ISO 27001 still earn their place. They can support the periodic evaluation HIPAA requires, and they beat a vendor's unsupported word. But they don't replace your own required risk analysis, and the question that matters is scope: is the endpoint you're calling covered by the report?

What a BAA Does and Doesn't Cover

Under 45 CFR 164.504(e), a BAA must:

Set the permitted uses of PHI. A business associate may use PHI only as its contract permits or as required by law, so the model training question is answered in this clause.
Require appropriate safeguards and Security Rule compliance.
Require reporting of uses the contract doesn't allow, including breaches.
Bind subcontractors to the same restrictions.
Open the vendor's relevant books to HHS.
Require return or destruction of PHI at termination, if feasible.

The gaps are more useful to know:

Retention during the contract. The required return-or-destroy duty applies at termination. A 30-day or zero-day window exists only if someone writes it down.
Your right to audit. HHS answers this one "no": the rules don't expressly make a cloud business associate document its practices for customers or submit to their audits. If you want evidence, get it in the contract.
Everything not named. A BAA can be scoped by service, plan or account. A beta endpoint or a developer's trial key may sit outside it.
Your own systems. HHS's cloud guidance says you and the vendor should each confirm in writing, in the BAA or another document, how each of you will meet the Security Rule. A vendor's BAA doesn't reach your logging pipeline.

One change could affect this. HHS's January 2025 Security Rule proposal would require written verification of a business associate's technical safeguards at least every 12 months, and 24-hour notice when a business associate activates its contingency plan. It isn't law. As of 3 November 2026, the Federal Register lists only the proposal under its regulation number, and the latest Unified Agenda entry available places it under long-term actions with a July 2027 target. Ask vendors whether they could meet those terms, but don't plan as if they apply today.

Does a Medical Speech-to-Text API Support a BAA? Check Which Party It's Written For

Many do. The question most pages skip is who the BAA is written for, because your position decides who signs.

You are	Your HIPAA role	The speech vendor is	Who signs with the vendor
A hospital or practice building in-house	Covered entity	Your business associate	You
A software company selling to clinics	Business associate	Your subcontractor, and also a business associate	You, not the clinic
A consumer app not acting for a covered entity	Possibly outside HIPAA	Depends on your facts	Ask counsel. Other health privacy laws can still apply.

Medical transcription API BAA chain from clinic to software company and speech vendor, with breach notice limits

The second row is the one most pages miss. The rules define a subcontractor as someone a business associate delegates work to, and count a subcontractor handling PHI as a business associate. The clinic doesn't need assurances from your subcontractor, so that obligation is yours. Your customer's BAA also has to require you to bind subcontractors to the same restrictions.

Three practical problems follow.

The template may not fit you. Deepgram's compliance page describes its BAA offer in terms of customers who qualify as covered entities. Get the answer in writing for your entity type.

Your promises must fit inside the vendor's. If your customer contract promises no secondary use and deletion within a set window, the vendor's paper has to allow both. Read the two documents side by side before you sign the customer.

Breach clocks add up. A business associate has up to 60 calendar days after discovery to notify the party above it, and a covered entity has up to 60 days to notify individuals. HHS describes the notice passing up the chain link by link. Run the outer limits for a three-party chain:

Day 0: the speech vendor discovers a breach.
Day 60: the vendor tells you.
Day 120: you tell the clinic.
Day 180: the clinic tells patients.

That's 60 + 60 + 60 = 180 days of legal maximum. The standard is "without unreasonable delay", so the outer limit isn't a safe target, and an agent's knowledge can start a clock earlier. But the rules alone don't give you a short number. Write one into each contract, and make the vendor's window shorter than the one you promised your customer.

Where PHI Hides Outside the Audio

A vendor's BAA can't fix any of these:

Application logs. Middleware that logs response bodies writes full transcripts to your log vendor, which may then need a BAA of its own. You do need audit controls that record system activity, so don't log nothing. Log IDs, account, status and timing, and leave out content.
Retained transcripts. Count the copies: your database, queues, dead-letter queues, caches, analytics exports, backups and the vendor's copy. Each needs an owner and an expiry.
Webhook payloads. Sully's docs say terminal events include the same public transcription object in data. Whichever vendor you use, check the payload and assume a transcript may be in it. Then your receiver, its gateway logs and its retry queue all handle PHI. Don't paste live payloads into a third-party request inspector.
Tokens in URLs. Browser WebSockets can't set custom headers, so browser streaming usually means a token in the query string. OWASP lists browser history, referrer headers and web logs as places query strings get exposed. Keep tokens short-lived and scrub query strings from access logs. Sully's streaming docs say never to put a permanent key in a URL, and their examples set expiresIn: 300.
Vocabulary in URLs. This one is easy to miss. Sully's word_boost is a streaming query parameter, and other APIs may pass vocabulary the same way. Boost a list built from one patient's chart and you've written that patient's medications, or name, into a URL. Build lists per specialty or per customer instead. The same goes for file names like smith-john-visit.wav.
Debug recordings. Capture flags left on after an incident, crash reports with audio buffers, support tickets with attachments and clips shared in chat all count. Keep capture off by default, with expiry and access logging when it's on.
Real patient audio in testing. Testing on your own recordings is the best way to measure drug-name accuracy, but a new trial key with no BAA behind it is the wrong place for a real visit. Your customer's BAA also has to permit that use. Deleting names from a transcript doesn't settle it, because Safe Harbor de-identification lists voice prints among its identifiers, along with URLs and IP addresses, and visits are full of spoken names and dates. Use consented or synthetic audio until the contract is signed.

Questions to Ask a Vendor

Send these in writing. A badge page isn't an answer.

Who signs: Will you sign a BAA with us as a business associate, using a subcontractor form? Please send the template.
Coverage: Which endpoints, models and regions does it cover, including streaming and anything in beta?
Activation: Is it switched on by plan, account flag or per-request parameter? What happens to requests sent before that?
Default retention: For audio, transcripts, vocabulary lists, metadata and logs, what's kept, for how long, and from what starting point?
Zero retention: If you claim it, what's the exact scope? Is it the default or by approval? Where is it in the contract?
Training: Can our data be used to train, tune or evaluate models? Which clause says so? Is any opt-out set per request or per account? (Deepgram's per-request opt-out shows why this matters.)
Subprocessors: Who touches PHI below you, is there a BAA with each, and how do we hear about changes?
Staff access: Can your people see our content for support? Is that logged, and can we review the logs?
Notice: How many days do you have to report a security incident or breach to us?
Deletion: How do we delete data, does that reach backups, and how long does it take? What happens at termination?
Audit evidence: Which reports can we see, what period do they cover, and is this API in scope?
Your outputs: What's in your webhook payloads and error messages, and what do you redact from your own logs?

How Sully Fits

Sully's position:

BAA. The trust page says Sully operates as a HIPAA Business Associate, "executing BAAs with every covered entity". The Whisper alternatives article says Sully signs a BAA by default. Sully also signs BAAs with software companies building on the API, who are usually business associates themselves. Have the agreement signed before you send PHI.
Retention. The API page lists Zero Data Retention with the line "Nothing stored after processing". Sully deletes the audio, transcript, and input and output tokens after processing. The transcription API has a DELETE endpoint that returns 204.
Training. The API page says Sully doesn't use or train on your data, and the trust page says PHI isn't used to train models.
Subprocessors. Ask Sully's security team for the vendor and sub-processor list, and check that each one handling PHI is covered.
Infrastructure and audits. The trust page says Sully runs on AWS HIPAA-eligible services with signed BAAs for in-scope components. The API page lists ISO 27001, HIPAA, HITRUST and SOC 2 Type II. Ask what's in scope, as you would with anyone.
Incidents. The trust page refers to HIPAA-mandated notification timelines. Given the 180-day arithmetic, ask for a number of days in your contract.

Another option can be better. If your PHI already sits under an AWS BAA and your audio fits Amazon Transcribe Medical's limits, using a service on AWS's eligible list means one fewer vendor to paper.

Frequently Asked Questions

Is a medical transcription API HIPAA compliant if the vendor signs a BAA?

Not on that basis alone. A BAA is required, but your own safeguards, risk analysis and data flows still count. It covers the vendor's obligations, not your logs or how you built your product.

Does a speech-to-text API need a BAA if it doesn't store any data?

Very likely, yes. The definition of a business associate includes creating and receiving PHI, not just maintaining it, and the conduit exception is limited to transmission services. Confirm your facts with counsel.

Is there an official HIPAA certification for speech APIs?

No. HHS says it doesn't endorse or recognize private certifications of Security Rule compliance.

Who signs the BAA with the speech vendor if we build software for clinics?

Usually you do. The clinic signs with you, and you sign with the vendor, your subcontractor.

Can I test a transcription API with real patient recordings?

Only with a BAA in place with that vendor and permission under your customer contracts. Otherwise use consented or synthetic audio.

Has the 2025 HIPAA Security Rule proposal been finalized?

Not as of 3 November 2026. The Federal Register shows a proposed rule only, and the latest Unified Agenda entry available targets July 2027.

If you're evaluating Sully, get the contract answers first: start with the trust page, then the API page and the transcription docs. Run real audio once the BAA is signed.