For clinicians and their compliance people
A Business Associate Agreement is a contract with a vendor that handles your clients' health information. Safeclip doesn't receive session audio, transcripts or notes, so under HHS's guidance on software vendors there is nothing for one to cover. Here is the reasoning, where it stops, and what is still yours to do.
Our reading of public HHS guidance, not legal advice. If you have a compliance advisor, show them this page.
HHS answers this question directly in its HIPAA FAQ. A software company becomes a business associate when it has access to your clients' information, not because you use its software.
“The mere selling or providing of software to a covered entity does not give rise to a business associate relationship if the vendor does not have access to the protected health information of the covered entity. If the vendor does need access to the protected health information of the covered entity in order to provide its service, the vendor would be a business associate of the covered entity.”
“For example, a software company that hosts the software containing patient information on its own server or accesses patient information when troubleshooting the software function, is a business associate of a covered entity.”
Encryption alone doesn't get a cloud tool out of a BAA. HHS's cloud guidance says a cloud service provider (CSP) that stores health information is a business associate even when it can't read it:
“CSPs that provide cloud services to a covered entity or business associate that involve creating, receiving, or maintaining (e.g., to process and/or store) electronic protected health information (ePHI) meet the definition of a business associate, even if the CSP cannot view the ePHI because it is encrypted and the CSP does not have the decryption key.”
That is why cloud scribes sign BAAs: they host the recording or the note. Safeclip doesn't host either.
You don't have to take our word for any of it. Here is how to check it yourself with a network monitor.
“OCR does not endorse, certify, or recommend specific technology or products.”
Not every therapist is a covered entity in the first place. HHS lists psychologists and other providers as covered:
“...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.”
A cash-pay practice that never bills electronically may fall outside HIPAA. State privacy law and your ethics code still apply, and the checklist below is good practice either way.
Your notes are as safe as the computer they live on. Six things, for macOS, Windows and Linux. Most take a few minutes once.
If the computer is lost or stolen, encrypted data can’t be read without your password.
lsblk -f: an encrypted disk shows crypto_LUKS. Adding it later usually means reinstalling, so back up first.Encryption protects a computer that is off or locked. A password only you know, and a lock when you step away, keep it that way.
A backup is another copy of every session. Keep it as safe as the computer.
Most attacks use holes that already have a fix. Safeclip updates itself; the operating system is up to you.
A shared family laptop with one login shares your sessions too.
Audio you no longer keep can’t be lost or stolen. Transcripts and notes stay when the audio goes.
One more, if HIPAA applies to you: add this computer and Safeclip to your risk analysis, and write down when you delete audio. Then tell your clients what you do. The consent kit has the words →
Everything a locked-down work computer needs on one page: what Safeclip installs, where its data lives, the hosts to allow and how the installers are signed.
Download the IT one-pager (PDF)One page, US Letter. Updated October 19, 2026.
api.safeclip.ioUpdate checks, feedback; sign-in and license check only if you sign inhuggingface.co, *.huggingface.co, *.hf.coModel downloadsgithub.com, api.github.com, release-assets.githubusercontent.com, objects.githubusercontent.comUpdates, the local AI server, speaker-detection models, link-import tool, the natural voice if you add itffmpeg.martin-riedl.de, johnvansickle.comOnly if the bundled ffmpeg is missingAnd only when they apply:
Nothing listens on the network. Safeclip's local transcription and AI servers, and on Linux the server that plays recordings in its window, bind to 127.0.0.1.
~/Library/Application Support/io.safeclip.desktop%APPDATA%\io.safeclip.desktop~/.local/share/io.safeclip.desktopInstallers are on the download page. Questions from IT: z@safeclip.io.
No BAA doesn't mean no consent. Illinois, Maine and Colorado now require written consent before AI records or transcribes a therapy session. The consent kit has a script, a form paragraph and a client handout.
Consent kit·What leaves your computer·Security·Safeclip for therapists