HIPAA-Friendly Dictation on Windows:
Local Whisper, No Cloud Upload

The HIPAA dictation problem, stated plainly

Clinical documentation eats clinician time. Voice dictation cuts that time in half or more. The catch is that nearly every modern dictation tool is cloud-based, which means patient audio (and therefore protected health information, or PHI) is uploaded to a vendor's servers, processed there, and retained for some period. For HIPAA-regulated workflows, that creates a chain of obligations: data flow review, Business Associate Agreement, breach notification policy, vendor audit, and ongoing risk assessment. Most cloud dictation tools can be made to fit, but the paperwork load is real and the risk surface is non-trivial.

The cleaner solution is to never let PHI leave the device. If the audio never crosses the wire, the cloud-transmission category of risk does not apply, and most of the compliance overhead that comes with it does not apply either. This is the architectural angle StarWhisper is built around: a local-first Windows dictation app powered by Whisper, where the transcription engine runs on your CPU or NVIDIA GPU and the audio never touches a server.

This page lays out what local-only means in practice, what the application can and cannot claim, and what your compliance team will want to verify. The goal is not to talk you into a decision; it is to give you accurate information to bring back to the people in your practice who are responsible for that decision.

What "HIPAA-friendly" honestly means (and does not mean)

The phrase "HIPAA-compliant software" is often used loosely. To be precise: HIPAA is a US federal regulation that applies to covered entities (health plans, healthcare clearinghouses, and most healthcare providers) and their business associates. It applies to organizations and the workflows they operate, not to applications in isolation. There is no HIPAA certification body that certifies software products. Anyone who tells you their product is "HIPAA-certified" is either using shorthand for "has been deployed in HIPAA workflows" or is being imprecise.

What software can be is HIPAA-friendly: architected and configured so that it fits naturally into a HIPAA-compliant workflow. Some properties make this easier:

• Local-only data flow, so PHI never leaves the covered entity's controlled environment
• Encryption support at rest (delegated to Windows BitLocker or equivalent)
• Audit logging at the application or OS level
• Configurable access controls
• Clear documentation of any optional cloud features and how to disable them

StarWhisper's local-only architecture covers the first point directly. The remaining points are workflow-level concerns that combine your OS configuration, your EHR, your endpoint policy, and your practice's compliance program. StarWhisper is one piece of the picture, not the whole picture.

How the audio flow works, step by step

For Local Mode, which is the only mode appropriate for PHI workflows:

• You press the configured push-to-talk hotkey.
• Windows captures audio from your microphone driver and sends it directly to the StarWhisper process running on your local machine.
• The Whisper model, which lives in your StarWhisper installation directory, processes the audio buffer in memory on your CPU or NVIDIA GPU.
• The model produces text, which is typed into whatever Windows text field has focus (your EHR, your notes app, your chart).
• The audio buffer is discarded.

At no point in this flow does audio or text touch a network socket bound to a remote address. The StarWhisper process does not contact any StarWhisper server, OpenAI server, or any third-party transcription service during transcription. The application does make occasional outbound calls for license verification and update checks, both of which can be reviewed in your network logs and do not contain PHI.

Cloud Mode, when enabled, changes step three: instead of running Whisper locally, the audio is sent to the OpenAI Whisper API. This is not appropriate for PHI workflows and is disabled by default. For HIPAA-regulated deployments, leave it disabled and consider using the administrator configuration to lock it off entirely (see Setup, below).

EHR and clinical software compatibility

Because StarWhisper types at the OS level rather than through an EHR-specific integration, compatibility is broad. The application has been used with:

"Works as keyboard input" means that pressing the hotkey, dictating, and releasing pastes the transcribed text wherever your cursor is at that moment. There is no separate EHR plugin or configuration. This is similar to how built-in Windows speech recognition behaves, except the engine is Whisper and the audio stays local.

For more focused vertical guides, see voice to text for doctors and voice to text for therapists, which cover specialty-specific workflows in more depth.

Why local Whisper compares well against Dragon Medical and cloud alternatives

The traditional clinical dictation market is dominated by Dragon Medical (Nuance / Microsoft), which moved to a cloud-first product (Dragon Medical One) several years ago. Cloud-based clinical dictation has real advantages for institutional buyers (centralized management, voice-profile sync), but it also creates the same PHI-flow concerns described above and carries enterprise pricing.

• Dragon Medical One: cloud, subscription, typically several hundred dollars per user per year, with BAA support and enterprise integrations.
• 3M M*Modal: cloud, enterprise pricing, EHR-integrated.
• Various AI scribe products (Abridge, Suki, DeepScribe, Nuance DAX): cloud, enterprise pricing, in some cases including LLM-based note generation from ambient audio.
• Generic cloud dictation (Otter, Rev, Notta): not specifically clinical, but used by some smaller practices.

StarWhisper does not try to compete with these on enterprise integration. It competes on architecture: a local-first tool that costs $10 per month, works in any application that accepts keyboard input, and keeps audio on your device. For a solo practitioner, a small therapy practice, or a clinician who wants a private dictation tool for their own notes, the architectural fit and the price point matter. For a hospital-scale deployment with centralized voice profile management and ambient scribe needs, the institutional products are still the better fit.

Setup for a HIPAA-sensitive deployment

For individual clinicians:

• Install StarWhisper from the download page or the Microsoft Store.
• On first run, confirm the transcription mode is Local Mode (Settings -> Transcription mode). Local Mode is the default.
• Verify that Cloud Mode is disabled.
• Configure a push-to-talk hotkey that does not collide with your EHR shortcuts.
• Confirm with your practice's compliance program before dictating PHI.

For practice IT or compliance administrators managing fleet deployments:

• Use the administrator configuration to disable Cloud Mode at install time and hide the toggle from end users.
• Verify that your Windows endpoint configuration includes BitLocker disk encryption, screen-lock policy, and audit logging consistent with your security policy.
• Review the application's outbound network connections (license check, update check) to confirm they do not carry PHI and that they fit your egress policy.
• Document the dictation workflow in your HIPAA risk assessment, including the local-only data flow.
• Train staff that Cloud Mode must remain disabled for any workflow involving PHI.

For practice-specific guidance, your compliance counsel is the right authority. The information on this page is descriptive, not legal advice.

Related reading on private clinical dictation

For broader context on HIPAA-compliant dictation software and how to evaluate vendors, see the HIPAA-compliant dictation software FAQ. For specialty workflows, the voice to text for doctors and voice to text for therapists pages cover physician and behavioral health flows respectively. For an operational reference on medical scribing, see voice to text for medical scribes.