Is There a HIPAA-Compliant AI for Writing Clinical Notes?

BLUF: There is no AI that is automatically "HIPAA compliant" for writing clinical notes, because HIPAA governs how protected health information (PHI) is handled rather than certifying a product. You can reach compliance two ways: use a cloud AI vendor that will sign a Business Associate Agreement (BAA) and configure it correctly, or keep PHI entirely on your own device with local AI so no third party ever processes it. For most individual clinicians, the on-device route is the simplest path to a genuinely private, low-risk workflow.

What "HIPAA-compliant AI for writing clinical notes" really means

HIPAA is a rule about safeguards, access, and accountability for PHI; it does not certify software. An AI tool becomes part of a compliant workflow only when the people and systems around it meet HIPAA's administrative, physical, and technical safeguards. So the honest question is not "is this app HIPAA compliant?" but "does this app let me handle patient data the way HIPAA requires?" Any vendor that touches PHI on your behalf is a business associate and needs a signed BAA.

Is ChatGPT or Claude HIPAA-compliant for clinical notes?

By default, the consumer versions of ChatGPT and Claude are not suitable for PHI, because the providers do not sign a BAA for those tiers and may retain prompts. Some enterprise and API products from these vendors will execute a BAA and offer zero-retention options, but that requires the right contract, account configuration, and internal policy before you paste anything identifiable. Until that BAA is signed and verified, entering a patient's name, dates, or condition into a consumer chatbot is a disclosure risk.

The most reliable answer: keep PHI on-device

The cleanest way to avoid the BAA problem entirely is to never send PHI off your machine. Local AI models run directly on your computer, so the text you select or draft is processed on-device and nothing is transmitted to an outside server. With no third party in the loop, there is no business associate to contract with for the model itself; you still own the safeguards like encryption and access control, but the data never travels. This is why on-device tools are the most defensible option for solo and small-practice clinicians.

What about AI scribes that record the visit?

Ambient AI scribes that record and transcribe a patient encounter send audio and a transcript to a vendor's servers, so they are squarely business associates and must operate under a signed BAA. These products can be part of a compliant workflow, but only with the contract, audit logging, and patient-consent practices that HIPAA expects. If you would rather not add another vendor relationship, an on-device approach where you draft the note yourself and let local AI polish it keeps the recording question off the table entirely.

What to verify before using any AI for clinical documentation

Confirm whether the tool sends data to a server or keeps it local, and read the data-retention and training policy in writing. If anything leaves your device, get a signed BAA first and turn off model-training on your inputs. Make sure the Mac itself is compliant: FileVault encryption, a strong password, auto-lock, and no shared accounts. Finally, follow your organization's own policy, since it may be stricter than HIPAA's baseline.

Where a tool like Nugumi fits

Nugumi is a Mac menu-bar assistant that can rewrite and polish a draft note you have already written, or explain a confusing passage in plain words, which helps when you want a clinical note to read clearly and professionally without changing its meaning. It can run fully on-device through local Ollama, so when you choose that setup nothing you select leaves your computer. Note that Nugumi is a general writing assistant, not an EHR or a medical-scribe product, and it does not sign BAAs; the privacy guarantee comes from running the model locally. You can download it free during the beta.

A practical private setup on a Mac

Pair a local model with on-device tooling so your patient data and your draft never reach the internet. Install a local model runner, then use an assistant that can talk to it to polish and clarify your notes. For the broader pattern, see a private AI writing assistant that works offline and how to set up a local LLM for writing on a Mac. The result is a workflow where PHI stays on your hardware while you still get help making notes clear, accurate, and easy to read.