HIPAA-friendly meeting transcription that runs on your own device

If you handle protected health information — a therapist, physician, counselor, or the client-side of counsel — most meeting-transcription tools put you in an awkward spot. The audio streams to a vendor's cloud, the transcript is stored under their terms, and the "who said what" runs on servers you don't control. To use them for PHI at all, you have to bring that vendor inside your compliance boundary as a business associate and sign a BAA. Daisy is built the other way around: the recording, the transcript, and the speaker labels are produced on your machine, so the PHI never has to leave it.

That single architectural fact changes the HIPAA math.

What "HIPAA-friendly" actually means (and doesn't)

First, the honest part: there is no such thing as "HIPAA-certified" software. HIPAA compliance is something a covered entity achieves through its own risk analysis and safeguards — not a badge a vendor can hand you. So Daisy doesn't claim to be "HIPAA compliant." What it can do is be configured to run in a HIPAA-friendly, PHI-secure way, and make each of your Security Rule safeguards easy to satisfy.

The HIPAA configuration guide maps every step to its exact 45 CFR Part 164 citation — access control, encryption at rest, audit controls, transmission security, and the rest — so your risk analysis has the paper trail it needs.

Why local-first changes who holds your PHI

The usual cloud transcription tool becomes your business associate the moment it processes PHI on its servers: it creates, receives, maintains, or transmits ePHI on your behalf, so you need a signed BAA and that vendor is now part of what you audit.

With Daisy's local configuration, none of that happens:

• Recording, transcription, and speaker identification run on your device. Nothing PHI-bearing reaches Small Bricktory.
• Small Bricktory is not your business associate, and no BAA with us is needed or offered — because we never touch the PHI.
• The only things Daisy ever sends us are a license check and an optional update check — never your meeting content.

Cloud transcription tools can be HIPAA-friendly by signing a BAA with you. But that BAA exists precisely because they hold your PHI. Daisy's local path removes the business associate from the picture entirely — there's nothing to sign and no third party to audit.

The AI step: local, or your own key

Transcription and speaker labels are always local and free. The one step that needs a language model — summaries, chapters, and analysis — is your choice:

• A local model (LM Studio or Ollama) keeps everything on your machine — zero transmission, fully offline. This is the fully PHI-secure setup.
• Your own cloud key sends only transcript text (never audio) directly from your machine to the provider you chose, under your account. If that involves PHI, sign a BAA with that provider — the major ones offer them. Daisy never proxies or receives that data.

The PHI-safe configuration, in five steps

1. Full-disk encryption on — BitLocker, FileVault, or LUKS.
2. Per-user OS accounts + auto-lock.
3. AI provider = a local model (or a cloud provider you hold a BAA with).
4. Back up your Daisy folder to an encrypted location.
5. Recording-consent notice in place for your jurisdiction.

The full walkthrough — each item tied to its Security Rule citation — is in the HIPAA & PHI configuration guide.

Who this is for

Solo and small practices that handle PHI and want meeting notes without inheriting a new cloud vendor: therapists and counselors documenting sessions, physicians capturing visit notes, and counsel handling privileged, sensitive conversations. If your rule of thumb is "the PHI shouldn't leave a machine I control," a local desktop app is the cleanest way to get there — and Daisy is one of the few meeting tools that fits inside your existing safeguards instead of adding to them.

Daisy is free for 30 days — no account, no card — so you can confirm the local configuration behaves exactly as described before you rely on it.