Medical dictation without the cloud
Every dictation vendor selling to clinicians answers the privacy question the same way: with a policy. There is a stronger answer available, and almost nobody offers it.
Ask a medical dictation company what happens to your audio and you will get a well-drafted paragraph. It is encrypted in transit. It is encrypted at rest. It is deleted after thirty days, or ninety, or on request. They are SOC 2 Type II certified. They will sign a Business Associate Agreement.
All of that can be true and all of it is still a promise about what someone else does with your patient's information after they receive it. Every one of those sentences describes a control on data that has already left your building.
There is a category of guarantee that does not depend on anyone keeping their word: the audio is never transmitted. Not encrypted in transit — not in transit. No request is made, so there is no server, no retention window, no subprocessor list, and nothing to breach.
What “HIPAA-ready” actually means
The phrase does a lot of quiet work in this market, so it is worth being precise about it, including where Walkie sits.
HIPAA does not certify software. There is no government body that inspects a dictation app and stamps it compliant. Compliance is a property of a covered entity's whole practice — its policies, its training, its contracts — not a badge a vendor earns. Any tool advertising itself as “HIPAA certified” is describing something that does not exist.
A BAA adds legal safeguards; it does not stop a transfer. When a vendor signs a Business Associate Agreement they take on contractual obligations around the protected health information you send them. That is valuable and is required for many cloud uses of ePHI. The PHI still goes to that provider. A BAA establishes permitted uses and safeguards; it does not make the transfer local or settle every compliance question.
Zero Data Retention does not replace a BAA. Walkie has enabled Groq Zero Data Retention for cloud inference and does not store a cloud dictation clip after processing. Cloud Mode can still sync the resulting text to your account, and the provider sees content while it processes the request. Walkie does not sign BAAs.
That last sentence is the one most vendors would leave out. It matters: if your compliance officer requires a BAA for every system that touches PHI, Walkie's Cloud Mode will not satisfy that requirement. The rest of this article explains what On-Device Mode changes; your organization still decides whether the workflow fits its policies.
The third answer
Walkie runs dictation two ways, and the difference is the entire point of this article.
Cloud Mode
Audio goes to Groq for transcription. With AI Polish on, the transcript and relevant context also go to Groq for cleanup. This can be faster and produce text that needs less editing. Groq Zero Data Retention is enabled, and Walkie does not use this content for model training. The content still crosses a provider boundary.
On-Device Mode
The speech model runs on your computer. Dictation audio and text stay there for speech processing, including optional local AI Polish. Model downloads and Walkie's signed app-continuity check can still make separate network requests without speech content. Local history and a recovery WAV after a failed take may remain on the computer.
On-Device Mode removes the cloud speech provider from the dictation path. Your organization still needs to review how the computer stores and protects local history and recovery files, and how Walkie fits its own policies. It removes one third-party processing question, not every compliance question.
On-Device Mode dictation is unlimited and free forever, on every plan, with no account required. The privacy tier is not the expensive tier.
What on-device costs you
Being honest about this is the only way the rest of the article stays credible. On-device transcription is worse than cloud transcription in specific, predictable ways:
- Punctuation is basic. You will get sentences, but the cloud model is noticeably better at commas, paragraphs, and knowing when a list is a list.
- Filler words stay in. The cloud pass strips the “um”s and false starts. On-device does not.
- No app-aware formatting. Cloud Mode adapts the output to where it is going. On-device gives you the text.
- It uses your machine. A larger, more accurate model costs you memory and a beat of latency. You pick the tradeoff from several models.
Comparing on-device tools for clinical notes? See our guide to local dictation apps.
Your custom dictionary works in both modes — corrections are applied locally after transcription — so drug names, colleagues' names, and the abbreviations your specialty actually uses come out right either way. In practice that closes most of the accuracy gap that matters clinically.
Dictate the note; think hard about recording the visit
These are different features with genuinely different privacy properties, and conflating them is how people get surprised.
Dictation in On-Device Mode is the airtight case described above. Nothing is stored beyond your local history, which you can clear.
Meeting recording is stored, by design. A searchable archive of past conversations is, definitionally, a stored archive. Walkie's recordings and transcripts live in your account until you delete them — and deletion is permanent, covering the rows, the audio, and the cloud copy. On a Mac with Apple Intelligence, Walkie can capture and summarise a meeting entirely on-device, which keeps the content local. Recorded hours are metered the same either way, so choosing on-device capture is a privacy decision and never a cheaper one.
Walkie records your computer's audio, which means it captures everyone on a call without appearing in the participant list. Whether you may record a patient encounter is a legal question that varies by jurisdiction and usually turns on consent. For most clinical work, the right pattern is to dictate the note afterwards rather than record the patient.
A short decision rule
Use On-Device Mode when the words themselves are the protected thing: clinical notes, therapy session write-ups, anything naming a patient and a diagnosis in the same sentence. Use Cloud Mode for the writing where polish matters more than secrecy — internal drafts, admin email, the third rewrite of a policy document.
You switch between them whenever you like. It is a per-moment privacy choice, not a plan you are locked into, and both modes exist on the free tier and on every paid tier.
Questions
Walkie is HIPAA-ready: cloud requests run under Zero Data Retention and nothing is ever used to train AI models. It is not HIPAA-certified and Walkie does not sign Business Associate Agreements. For work that requires a BAA, use On-Device Mode — it makes no network request, so there is no business associate involved.
Not in On-Device Mode. The speech model runs locally and makes no network request, so the audio has nowhere to go. In Cloud Mode audio is sent for transcription under Zero Data Retention and discarded when the response returns.
Meetings are stored by design — a searchable archive is a stored archive — so recordings and transcripts live in your account until you delete them. Walkie can capture and summarise a meeting entirely on-device on a Mac with Apple Intelligence. For visits, most clinicians should dictate the note rather than record the patient.
For dictation, yes. On-Device Mode dictation is unlimited and free forever with no account required, which covers clinical notes, letters, and portal replies. Cloud Mode, Read Aloud, and meeting recording have their own limits on the free plan.