HIPAA Compliance & Healthcare Use

Last updated: October 13, 2026

Available on: Mac, Windows, iOS, Android. BAA signing is available on Mac, Windows and iOS; downloading an individual signed copy requires Mac or Windows. Organization controls depend on your plan and admin permissions.

To dictate protected health information (PHI), turn off Flow's data-sharing controls, sign the applicable Business Associate Agreement (BAA), and keep your signed copy as documentation.

Configure dictation for PHI

In Settings → Data & Privacy, confirm both settings are off before dictating PHI.

Setting

For PHI

What it controls

Improve the model for everyone

Off

Whether Notetaker and dictation content — audio, transcripts and edits — may be used to improve Wispr's models.

Dictation cloud storage (Cloud Sync on iOS)

Off

Stores dictation transcripts, audio and history on Wispr servers for cross-device access.

Improve the model for everyone is on by default for Free and Pro. Turning either setting off does not erase history already stored.

An applicable signed BAA locks both controls off, and organization policies can lock them too; check each control's explanation. An organization model-improvement restriction alone does not mean cloud storage is off — check it separately. On iOS, model improvement displays Off when HIPAA or organization rules prevent changes.

Warning: Do not include PHI in support feedback. Typed in-app feedback is a deliberate support submission and is not stripped by these settings or a BAA; diagnostic logs or accessibility reports may be attached, and general feedback logs are not filtered.

Sign a BAA

Reading and signing require an internet connection. Review the agreement that applies to your account or legal entity before signing. I Agree is unavailable until you enter a legal name and while signing is in progress; on iOS, spaces alone do not count.

Individual account — Mac or Windows

The agreement opens in your web browser.

  1. Open Settings → Data & Privacy.

  2. Select View and accept beside Enable HIPAA.

  3. Review the linked agreement.

  4. Enter your legal name.

  5. Select I Agree.

After signing, the row shows HIPAA enabled.

Individual account — iOS

The agreement appears inside the app.

Warning: Signing on iOS cannot be undone in the app — iOS has no revoke action.

  1. Open Settings → Data & Privacy.

  2. Tap the HIPAA row.

  3. Review the agreement.

  4. Enter your legal name.

  5. Tap I Agree.

After signing, the subtitle beneath HIPAA becomes View Business Associate Agreement.

Organization

Growth and Enterprise both include a standard HIPAA BAA. Members of organizations with active billing cannot sign personal BAAs and should ask their admin.

  1. Open the admin portal's organization settings, or use the portal button under Org-wide HIPAA when shown on desktop.

  2. Review the organization's agreement as an authorized administrator.

  3. Sign the organization's BAA in the portal.

Note: Android has no BAA signing or revocation flow, but signed-agreement and organization restrictions appear there as locked settings. While BAA status is unknown, the model-improvement choice can remain editable; audio sharing stays blocked until that status is known.

Obtain your signed agreement

Wispr does not countersign BAAs. The BAA is a click-through agreement; the signed copy with its Signature Record is the documentation to provide. MSA redlines or custom signed documentation require our highest-tier Enterprise plan and go through your sales representative.

Individuals — desktop download

Download signed BAA requires a signed BAA, a recorded signer name and an individual (non-enterprise) account. A desktop layout that offers only an Enable HIPAA/HIPAA enabled row with View and accept/Revoke has no download option.

  1. Open Settings → Data & Privacy while connected to the internet.

  2. Select Download signed BAA.

The file is named HIPAA-BAA-signed.pdf. A failed download saves no partial file — retry after restoring connectivity.

The PDF appends a Signature Record with the signer's name, account email and signing date and time. This is a reference record, not a legal certificate or Wispr countersignature, and the PDF may not match the agreement text at signing.

Organizations — portal copy

Enterprise accounts use Org-wide HIPAA portal options rather than the individual download button. Members request a copy from an admin.

iOS — read the agreement

iOS can reopen the agreement for reading but has no download option.

Organization enforcement

  • Growth: Improve the model for everyone is locked off organization-wide — neither admins nor users can turn it on. Dictation cloud storage and Notetaker retention remain individual settings.

  • Enterprise: Improve the model for everyone is locked off organization-wide, and admins can enforce Dictation cloud storage and Notetaker transcript-retention policies. The free IT Admin role is Enterprise-only, and Wispr-managed locks require support to change.

Warning: Organization policies stay enforced during connection problems. On iOS, when an organization account's settings cannot be confirmed, Improve the model for everyone and Dictation Cloud Storage are forced off and automatic transcript deletion is forced on until the settings resolve. This does not apply to unaffiliated individual accounts.

What a signed BAA changes

  • Notetaker (Mac and Windows): A personal or organization BAA blocks recording and meeting sync, and meeting audio is never uploaded. Recording is also unavailable before account settings load, and your plan, subscription or an admin disabling Notetaker can separately prevent access.

  • Notes (iOS): Accounts with a BAA or privacy mode can still use note cloud sync, AI summaries, manual sync and Spotlight/Siri note features; sync requires being signed in and online.

Changing BAA coverage

Important: Review How to Revoke a HIPAA/BAA Agreement or contact support before changing agreement coverage.

Revoking removes the agreement's settings locks and Notetaker block without changing your stored model-improvement or cloud-storage choices. Settings left off stay off; if cloud storage was already on but blocked by the BAA, syncing can resume immediately unless another policy blocks it.

  • Personal BAA: A personal BAA dialog can offer View signed BAA and Revoke BAA, while desktop Notetaker blocks offer Open Settings.

  • Organization BAA: Admins use Open Admin Portal to manage revocation for the team; members must contact their admin.

  • Personal BAA signed before joining an organization: Only that member can revoke it — an admin revoking the organization BAA cannot clear it, and the remaining personal BAA can continue restricting the member.

Revocation retains the agreement record, and signing again creates a new agreement. On desktop, successful revocation immediately removes the downloadable copy; a failed request, or signing in or out during it, leaves protections unchanged.

Still need help?

  • Missing download button or download still failing: Contact support with your platform, account type and what you tried.

  • Compliance or plan questions: Contact your account representative about your organization's use, disabled portal controls, plan requirements or compliance documentation under NDA.