Configuring Daisy for HIPAA and PHI
Daisy is on-device software. Because recording, transcription, speaker labels, and search all run on your own machine, Daisy can be configured so that protected health information (PHI) never leaves your device — which keeps you, the covered entity, as the only party holding it.
The PHI-safe setup
Do these six, once, and Daisy sits inside your existing safeguards instead of adding a vendor to audit.
- Turn on full-disk encryption — BitLocker (Windows), FileVault (macOS), or LUKS (Linux).
- Use per-user OS accounts with auto-lock — one login per person, screen lock on.
- Set up the vault in passphrase mode — in the setup wizard, choose Passphrase, not "I trust this machine". The trust option auto-unlocks with the OS session and adds no authentication of its own.
- Set your AI provider to a local model (LM Studio or Ollama) for zero transmission — or a cloud provider you hold a BAA with.
- Back up your Daisy profile folder to an encrypted location.
- Put a recording-consent notice in place for your jurisdiction.
A few things to be clear about up front:
- There is no such thing as "HIPAA-certified" software. HIPAA compliance is something a covered entity achieves through its own risk analysis and safeguards. This guide maps Daisy to each Security Rule safeguard so that work is easy — it is not a certification.
- Small Bricktory is not your business associate. In the local configuration nothing PHI-bearing reaches us, so no Business Associate Agreement (BAA) with us is needed or offered. If you use a cloud AI provider, your BAA is directly with that provider.
- You remain responsible for your own HIPAA risk analysis. What follows helps you satisfy it; it does not replace it.
Citations below are to 45 CFR Part 164, Subpart C (the Security Rule). Specifications are marked (R) Required or (A) Addressable. "Addressable" does not mean optional — it means you implement it or document a reasonable, equivalent alternative.
Technical safeguards — §164.312
| Safeguard | HIPAA control (45 CFR) | Who | How |
|---|---|---|---|
| Unique user access | §164.312(a)(1), (a)(2)(i) (R) | You + OS | Give each user their own OS account; Daisy's library is per-OS-user. In passphrase mode (the PHI-safe setup above), the vault (keys + voiceprints) additionally requires its passphrase. |
| Encryption at rest | §164.312(a)(2)(iv) (A) | You + OS | Turn on full-disk encryption. Daisy's vault is always encrypted (Argon2id → AES-256-GCM); recordings and transcripts rely on disk encryption. |
| Automatic logoff | §164.312(a)(2)(iii) (A) | You + OS | OS screen lock / auto-lock. (App-level auto-lock is on the roadmap.) |
| Audit controls | §164.312(b) (R); §164.308(a)(1)(ii)(D) | Partial | Daisy writes local, rotated activity logs; OS-level auditing covers file access. Note this in your risk analysis. |
| Integrity | §164.312(c)(1), (c)(2) (R/A) | Daisy | Your data is local files you control; nothing is altered remotely — there is no remote. Back up the profile folder somewhere you trust. |
| Person or entity authentication | §164.312(d) (R) | You + Daisy | OS login authenticates the user; in passphrase mode the vault passphrase additionally gates keys and voiceprints. The "trust this machine" vault option does not satisfy this on its own — use passphrase mode for PHI. |
| Transmission security | §164.312(e)(1), (e)(2)(ii) (A) | Daisy, by config | Local model = zero transmission, fully offline. With a cloud model, transcript text goes over HTTPS directly from your machine to that provider under your key — one you hold a BAA with. Daisy never proxies it. |
Physical safeguards — §164.310
| Safeguard | HIPAA control (45 CFR) | Who | How |
|---|---|---|---|
| Facility / workstation access | §164.310(a)(1), (b), (c) (R) | You | The same controls as any workstation holding PHI — locked office, screen privacy, no shared logins. |
| Device & media controls | §164.310(d)(1); disposal (d)(2)(i) (R); backup (d)(2)(iv) (A) | You + Daisy | Daisy's data is one folder you chose — easy to locate, back up, migrate, and destroy. Deleting a meeting in-app removes its audio, transcript, summary, notes, and index. Disposal = normal encrypted-disk disposal. |
Administrative safeguards — §164.308
| Safeguard | HIPAA control (45 CFR) | Who | How |
|---|---|---|---|
| Risk analysis / management | §164.308(a)(1)(ii)(A), (B) (R) | You | Your obligation as covered entity. Daisy shrinks the surface: no vendor server and no third party holding PHI in the local configuration. |
| Business associate agreements | §164.308(b)(1) (R); §164.314(a) | Simplified | Local configuration: no business associate exists, so no BAA is needed. Cloud-model configuration: the BAA is between you and your chosen provider directly. |
| Workforce training / policies | §164.308(a)(5) (R); (a)(3) | You | Standard practice policies; nothing Daisy-specific beyond "use the PHI-safe configuration." |
| Contingency plan | §164.308(a)(7)(ii)(A)–(C) (R) | You + Daisy | Back up the profile folder (to an encrypted volume). Restoring = copying it back; your license reactivates offline. |
| Consent for recording | Outside the Security Rule — state wiretap law + Privacy Rule uses/disclosures | You | Recording consent is your duty under state law (all-party-consent states especially). Not something HIPAA's Security Rule governs. |
Bottom line
With the six-step configuration above, Daisy is one of the few meeting-AI tools that fits inside a covered entity's existing safeguards instead of adding a new business associate to audit.
See also our Terms of Service (PHI stance) and Privacy Policy.