FOR TEAMSWhisper for Business
FOR THERAPISTS AND CLINICIANS — READ AT SOURCE 8 SEPTEMBER 2026

HIPAA-Compliant Dictation Software in 2026

Start here, because it changes what you buy: no software is HIPAA compliant on its own. HIPAA binds you, not a product. What differs between these eight tools is where your patient audio goes and what each vendor will actually put in writing. We quote their own wording and we read every price at the source on 8 September 2026.

If you want notes drafted for you, a cloud tool with a signed BAA is the right purchase and we say which ones publish what. If you want to stop typing while keeping PHI on your own machine, Whisper transcribes on your computer and transmits nothing.

Try Whisper for your practiceJump to the comparison table

What "HIPAA compliant" means on a vendor page

It means the vendor believes it can act as your business associate. That is a real and useful thing. It is not a certification, there is no HIPAA certifying body, and it does not transfer your obligations to them. Three questions get you a straight answer from any vendor on this page:

  1. Will you sign a BAA on the plan I am buying? Not on an enterprise plan I cannot afford. Otter.ai lists HIPAA as an Enterprise add-on; Rev describes it on Unlimited.
  2. How long do you keep the audio? Freed says recordings are deleted once the note and quality checks are complete. Upheal says all recordings are deleted by default.
  3. Who are your sub-processors? Every cloud tool has them. The only way to have none is to not transmit the audio.

Where Whisper sits

Whisper runs the speech model on your own computer. No audio and no transcript is sent to us, so there is nothing for us to retain, no sub-processor in the transcription path, and no BAA to sign for that step. That does not make your practice compliant. It removes one supplier from the set of things you have to make compliant. You still have to secure the machine, and we say exactly that on our security page.

The comparison

ToolPublished priceWhere audio is processedPlatformsBest for
Whisper$29/year, first seat100% on-deviceMac, Windows, LinuxConfidential work, low yearly cost, whole-team rollout
Mentalyc$19.99–$119.99/mo soloCloudWebTherapists who want progress notes written for them
Upheal$1/session, capped at $69/monthCloudWebTherapists with an uneven caseload who want per-session billing
Blueprint$0.99/session or $69 per seat/monthCloudWebPractices already running an EHR they want to keep
Freed$39/mo Starter, $79/mo Core, $119/mo PremierCloudWeb, iOS, AndroidSolo clinicians who want an ambient scribe, not a dictation key
Heidi HealthNot publishedCloudWeb, iOS, AndroidClinics that want a free tier before committing
Otter.aiFree, $16.99 or $30 /user/monthCloudWeb, Mac, Windows, iOS, AndroidTeam meeting notes, not private dictation
Rev$25.49–$47.99 /seat/month, plus $1.99/min humanCloudWeb, Mac, Windows, iOS, AndroidCertified transcripts and human review, billed per file

Green tick: audio is processed on your own device. Amber: it depends on a setting or on the region. Red: audio is sent to the vendor's servers.

What each vendor publishes, in their words

Whisper

Published price:
$29/year, first seat — +$15/year for each additional seat, no subscription, no auto-renewal
Where audio is processed:
100% on-device
BAA / data agreement:
No BAA needed for the transcription step, because no audio or transcript is sent to us

Mentalyc

Published price:
$19.99–$119.99/mo solo — Mini $19.99, Basic $39.99, Pro $69.99, Super $119.99 monthly; $14.99/$29.99/$59.99/$99.99 billed annually. Team $59.99/seat/mo, $49.99 annually.
Where audio is processed:
Cloud
BAA / data agreement:
Shows HIPAA, PHIPA and SOC 2 Type 2 badges; references a BAA

Upheal

Published price:
$1/session, capped at $69/month — Group and Enterprise plans are quoted on request. 30-day free trial.
Where audio is processed:
Cloud
BAA / data agreement:
States "100% HIPAA compliant", "GDPR & DPA compliant", "SOC2 certified", "All recordings deleted by default"

Blueprint

Published price:
$0.99/session or $69 per seat/month — $0.99/session alongside your EHR, $69 per seat for unlimited sessions, $1.49/session on the all-in-one EHR. Enterprise: custom.
Where audio is processed:
Cloud
BAA / data agreement:
Links a BAA from the site footer

Freed

Published price:
$39/mo Starter, $79/mo Core, $119/mo Premier — Premier $104/mo billed annually. Starter is capped at 40 notes/month. Groups: custom.
Where audio is processed:
Cloud
BAA / data agreement:
States "HIPAA-compliant, SOC2 Type 1 & 2 certified, and HITECH-compliant"; org-wide BAA on group plans

Heidi Health

Published price:
Not published
Where audio is processed:
Cloud
BAA / data agreement:
Publishes separate HIPAA and GDPR compliance pages

Otter.ai

Published price:
Free, $16.99 or $30 /user/month — Pro $16.99/user/month, $8.33 billed annually. Business $30/user/month, $19.99 annually. Enterprise on request.
Where audio is processed:
Cloud
BAA / data agreement:
Lists "HIPAA compliance (add-on)" on the Enterprise plan only

Rev

Published price:
$25.49–$47.99 /seat/month, plus $1.99/min human — Free 45 AI minutes/month. Essentials $25.49/seat/month, Pro $47.99/seat/month, Unlimited custom. Human transcription "$1.99 /min."; legal rough draft "$2.25 /page", legal premium transcript "$2.50 /page".
Where audio is processed:
Cloud
BAA / data agreement:
Describes itself as "CJIS- and HIPAA-compliant" on the Unlimited plan

What a practice pays for Whisper

What a team actually pays

$29 for the first seat, $15 for each additional seat, per year. No subscription, no auto-renewal.

SeatsTotal per year
1 seat$29
5 seats$89
10 seats$164
25 seats$389
50 seats$764
Choose your seat count

Questions clinicians actually ask

Is any dictation software actually HIPAA compliant?

No product is HIPAA compliant by itself. HIPAA binds the covered entity and its business associates, so compliance is a property of your whole practice: your devices, your access controls, your training, your agreements. What a vendor can do is either support that workflow or complicate it. The honest distinction is architectural. If a tool sends Protected Health Information to a server, that vendor is a business associate and you need a signed BAA. If a tool transcribes entirely on your own machine, no PHI is transmitted and there is no business associate in the transcription path at all.

Which of these tools will sign a BAA?

Read the exact wording, because it varies more than the marketing does. Freed states it is "HIPAA-compliant, SOC2 Type 1 & 2 certified, and HITECH-compliant" and offers an org-wide BAA on group plans. Mentalyc shows HIPAA, PHIPA and SOC 2 Type 2 badges and references a BAA. Upheal states "100% HIPAA compliant" and "All recordings deleted by default". Blueprint links a BAA from its footer. Otter.ai lists HIPAA only as an add-on on the Enterprise plan. Rev describes CJIS and HIPAA compliance on the Unlimited plan. Whisper does not need one for the transcription step, because nothing is sent to us.

What is the cheapest HIPAA-minded option for a solo therapist?

It depends on whether you want notes written for you or simply want to stop typing. Per-session pricing is the cheapest entry for note writing: Blueprint publishes $0.99 per session alongside your EHR, and Upheal publishes $1 per session capped at $69 per month. Mentalyc starts at $19.99 per month. If you only want fast, private dictation into whatever you already use, Whisper is $29 a year and there is no monthly line at all.

Do these tools record my client sessions?

The note-writing tools do, because that is how they work. Mentalyc, Upheal, Blueprint, Freed and Heidi Health listen to the session to draft the note, which means a recording exists and goes to a server, at least briefly. Freed states that audio is deleted after the note is generated. Upheal states that all recordings are deleted by default. Dictation software is different: it transcribes what you deliberately speak into it, usually after the session, and Whisper does that on your own machine without recording a session at all.

Can I use dictation software if my client has not consented to recording?

Dictating your own notes is not the same act as recording a client, and the two attract different consent questions. That said, the answer depends on your jurisdiction, your professional body, and your own informed-consent process, and we are a software vendor rather than your regulator. The architectural point we can make is narrow: with an on-device tool, no third party ever holds the audio, so the question stays between you and your client instead of becoming a question about a vendor.

What is the three-year cost difference?

A solo therapist on Mentalyc Pro at $69.99 per month pays $2,519 over three years. On Upheal's cap of $69 per month, $2,484. On Freed Core at $79, $2,844. Whisper is $29 a year, so $87 over three years. Those tools do more than dictation, and for many clinicians the note writing is worth it. But if what you actually needed was fast private typing, the subscription is buying you something you were not going to use.

What we could not verify

These vendors publish no price we could read at the source. We print the gap rather than fill it with someone else's estimate.

  • Heidi Health — The pricing page lists five plans (Free, Clinician, Practice, Evidence, Enterprise) and shows no price for any of them.

Sources

Every figure above is copied from the vendor's own page on the date shown. Nothing is estimated, and nothing is taken from a review site.

PHI that never leaves your computer

$29 for the first seat, $15 for each additional seat, per year. No auto-renewal.

Get WhisperHow Whisper fits a HIPAA workflow