Configuring Daisy for HIPAA and PHI
Turn on Nerd Mode first. In the desktop app, open Settings → Display and turn on Nerd Mode. The vault passphrase and the LM Studio, Ollama and cloud provider settings in the steps below appear only with it on.
Daisy is on-device software. This guide covers the desktop app on Windows, macOS, and Linux, and Daisy for iPhone and iPad. Because recording, transcription, speaker labels, and search all run on your own devices, Daisy can be configured so that protected health information (PHI) never leaves your devices — which keeps you, the covered entity, as the only party holding it.
The PHI-safe setup on your computer
Do these six, once, and Daisy sits inside your existing safeguards instead of adding a vendor to audit.
- Turn on full-disk encryption — BitLocker (Windows), FileVault (macOS), or LUKS (Linux).
- Use per-user OS accounts with auto-lock — one login per person, screen lock on.
- Put the vault in passphrase mode — new profiles start in "trust this machine" mode, which auto-unlocks with the OS session and adds no authentication of its own. Open Settings → Profile → Vault and select Add a passphrase…; your existing keys are re-encrypted with no data loss.
- Set your AI provider to an on-device model — Daisy's built-in AI, or LM Studio or Ollama — for zero transmission, or a cloud provider you hold a BAA with.
- Back up your Daisy profile folder to an encrypted location.
- Put a recording-consent notice in place for your jurisdiction.
The PHI-safe setup on iPhone and iPad
Daisy for iPhone and iPad keeps recordings, transcripts, and voiceprints encrypted inside the app, and transcription and speaker labels run on the device. To use it with PHI:
- Set a device passcode. iPhone and iPad protect stored data with it.
- Turn on Require Face ID in Daisy's Settings. Daisy then asks for Face ID or your passcode when it opens and again after five minutes in the background.
- Keep the AI provider on the device. In Settings › AI provider, choose Gemma or Apple Intelligence, listed under Data stays on this iPhone. These need iPhone 15 Pro or later; on an earlier iPhone, summarizing means sending the transcript to a provider. A provider under Data leaves this iPhone receives each transcript when Daisy summarizes; choose one only if you hold a BAA with it.
- Set up a paired computer the same way. With Desktop Sync, recordings and notes move to your computer over your own Wi-Fi, encrypted, and deleting a recording on one device deletes it on the other. That computer holds PHI too, so give it the six-step setup above.
- Share with care. Share Audio and Share Transcript hand an unencrypted copy to the app or person you send it to.
- Plan for a lost or replaced device. Recordings open only on the iPhone or iPad that made them, including from a backup restored to a different device. A paired computer keeps its own copy. Use Find My or your organization's device management to erase a lost device.
The recording-consent notice applies on every device. The safeguard tables below describe the desktop app.
A few things to be clear about up front:
- There is no such thing as "HIPAA-certified" software. HIPAA compliance is something a covered entity achieves through its own risk analysis and safeguards. This guide maps Daisy to each Security Rule safeguard so that work is easy — it is not a certification.
- Small Bricktory is not your business associate. In the local configuration nothing PHI-bearing reaches us, so no Business Associate Agreement (BAA) with us is needed or offered. If you use a cloud AI provider, your BAA is directly with that provider.
- You remain responsible for your own HIPAA risk analysis. What follows helps you satisfy it; it does not replace it.
Citations below are to 45 CFR Part 164, Subpart C (the Security Rule). Specifications are marked (R) Required or (A) Addressable. "Addressable" does not mean optional — it means you implement it or document a reasonable, equivalent alternative.
Technical safeguards — §164.312
| Safeguard | HIPAA control (45 CFR) | Who | How |
|---|---|---|---|
| Unique user access | §164.312(a)(1), (a)(2)(i) (R) | You + OS | Give each user their own OS account; Daisy's library is per-OS-user. In passphrase mode (the PHI-safe setup above), the vault (keys + voiceprints) additionally requires its passphrase. |
| Encryption at rest | §164.312(a)(2)(iv) (A) | You + OS | Turn on full-disk encryption. Daisy's vault (API keys, voiceprints) is always encrypted; recordings and transcripts are plain files and rely on disk encryption. |
| Automatic logoff | §164.312(a)(2)(iii) (A) | You + OS | OS screen lock / auto-lock. In passphrase mode, Lock vault now in Settings → Profile locks Daisy until the passphrase is entered again. |
| Audit controls | §164.312(b) (R); §164.308(a)(1)(ii)(D) | Partial | Daisy writes local diagnostic logs, kept for 7 days, and keeps no record of who opened a meeting. OS-level auditing covers file access. Note this in your risk analysis. |
| Integrity | §164.312(c)(1), (c)(2) (R/A) | Daisy | Your data is local files you control. With Mobile Sync paired, your phone can add recordings and delete ones it sent, over your own network. Back up the profile folder somewhere you trust. |
| Person or entity authentication | §164.312(d) (R) | You + Daisy | OS login authenticates the user; in passphrase mode the vault passphrase additionally gates keys and voiceprints. The "trust this machine" vault option does not satisfy this on its own — use passphrase mode for PHI. |
| Transmission security | §164.312(e)(1), (e)(2)(ii) (A) | Daisy, by config | Local model = zero transmission, fully offline. With a cloud model, transcript text goes over HTTPS directly from your machine to that provider under your key — one you hold a BAA with. Daisy never proxies it. Mobile Sync, if you pair a phone, moves recordings over your local network, encrypted end to end between your devices. |
Physical safeguards — §164.310
| Safeguard | HIPAA control (45 CFR) | Who | How |
|---|---|---|---|
| Facility / workstation access | §164.310(a)(1), (b), (c) (R) | You | The same controls as any workstation holding PHI — locked office, screen privacy, no shared logins. |
| Device & media controls | §164.310(d)(1); disposal (d)(2)(i) (R); backup (d)(2)(iv) (A) | You + Daisy | Daisy's data is one folder you chose — easy to locate, back up, migrate, and destroy. Deleting a meeting in-app removes its audio, transcript, summary, notes, and index. Disposal = normal encrypted-disk disposal. |
Administrative safeguards — §164.308
| Safeguard | HIPAA control (45 CFR) | Who | How |
|---|---|---|---|
| Risk analysis / management | §164.308(a)(1)(ii)(A), (B) (R) | You | Your obligation as covered entity. Daisy shrinks the surface: no vendor server and no third party holding PHI in the local configuration. |
| Business associate agreements | §164.308(b)(1) (R); §164.314(a) | Simplified | Local configuration: no business associate exists, so no BAA is needed. Cloud-model configuration: the BAA is between you and your chosen provider directly. |
| Workforce training / policies | §164.308(a)(5) (R); (a)(3) | You | Standard practice policies; nothing Daisy-specific beyond "use the PHI-safe configuration." |
| Contingency plan | §164.308(a)(7)(ii)(A)–(C) (R) | You + Daisy | Back up the profile folder (to an encrypted volume). Restoring = copying it back. A replacement computer needs a one-time online license activation. |
| Consent for recording | Outside the Security Rule — state wiretap law + Privacy Rule uses/disclosures | You | Recording consent is your duty under state law (all-party-consent states especially). Not something HIPAA's Security Rule governs. |
Bottom line
With the six-step configuration above, Daisy is a meeting and voice notes recording AI tool that fits inside a covered entity's existing safeguards instead of adding a new business associate to audit.
See also our Terms of Service (PHI stance) and Privacy Policy.