The short answer
Software is not HIPAA compliant on its own, and that includes Fraze. HHS says the HIPAA Rules “apply to covered entities”, and that certain provisions “also apply directly to business associates of covered entities”. Asked which cloud providers offer HIPAA compliant services, HHS answers that its Office for Civil Rights “does not endorse, certify, or recommend specific technology or products.”
Fraze is not certified, approved or HIPAA compliant, and using it does not make anyone compliant. Inkvi LLC, the company behind Fraze, does not sign business associate agreements. Fraze saves finished transcripts on your computer as unencrypted files.
This page is not legal advice. Whether any tool can be used with patient information is a question for your own compliance officer or lawyer, not for a software vendor.
What HHS says
On who the rules cover, HHS writes that the HIPAA Rules “apply to covered entities”, which it lists as health plans, health care clearinghouses, and health care providers who transmit health information in electronic form in connection with a covered transaction. It adds that certain provisions “also apply directly to business associates of covered entities”.
On products, the HHS guidance on cloud computing asks “Which CSPs offer HIPAA-compliant cloud services?” and answers in one line: “OCR does not endorse, certify, or recommend specific technology or products.” OCR is the HHS Office for Civil Rights, and CSP stands for cloud service provider.
On business associates, HHS describes one as, generally, a person or organization that performs certain functions on behalf of a covered entity “that involve creating, receiving, maintaining, or transmitting PHI”, or that provides certain services to a covered entity that involve the disclosure of PHI. PHI is protected health information. Its list of examples includes: “Independent medical transcriptionist, or the vendor of an app, that provides transcription services to a physician.”
On security, the HHS summary of the Security Rule says regulated entities must ensure the “confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit”, and that “the Security Rule does not dictate the specific security measures that a regulated entity must use.” The same summary says it covers the rule currently in effect, that changes have been proposed, and that regulated entities “should not rely on this summary as a source of legal information or advice.”
These are quotations, not an explanation of how the rules apply to you. For that, read the HHS pages listed below and ask your own compliance officer or lawyer.
What Fraze does with audio and text
Fraze shows live captions and live translated captions. Speech recognition and translation both run on your computer, and after the first download of language files it works with the network off. No audio and no transcript text is sent to Inkvi LLC or to anyone else.
A finished session is saved as a plain JSON file in the app's data folder and appears in a history list inside the app, where you can copy it, save it as text or delete it. Fraze does not encrypt these files. Anyone who can open that folder on the computer can read them.
The app does use the network. A free account is required, so it signs in against getfraze.app and checks there whether your plan is paid. Release builds also send anonymous usage statistics and crash reports unless you turn off one switch in Settings, under Privacy. Usage statistics stop at once, and crash reports stop the next time Fraze starts. Neither ever contains audio, transcript text or custom vocabulary. The app also downloads language files once, checks for updates, and sends feedback only when you write some. The full list of connections is on the home page.
What Fraze does not do
- Inkvi LLC does not sign business associate agreements.
- Fraze has no certification or approval for healthcare use.
- No speaker labels. The transcript does not say who said which line.
- No summaries, no clinical notes, no problem lists, no coding.
- No link to an EHR. Nothing is written into a chart.
- Live only. You cannot upload a recording or an audio file.
Questions
Is there such a thing as HIPAA compliant transcription software?
Not as a property of the software. HHS says the HIPAA Rules apply to covered entities and their business associates, and that its Office for Civil Rights “does not endorse, certify, or recommend specific technology or products.” Fraze is not HIPAA compliant or certified either.
Does Fraze sign a business associate agreement?
No. Inkvi LLC, the company behind Fraze, does not sign business associate agreements. If your organization requires a signed agreement from a vendor, Fraze cannot provide one. Whether an agreement is required in your situation is a question for your own lawyer.
Can I use Fraze to transcribe patient conversations?
That is a decision for your compliance officer or lawyer, not for a software vendor, and nothing on this page is legal advice. Fraze is not certified, approved or HIPAA compliant. Inkvi LLC does not sign business associate agreements, and Fraze saves transcripts on the computer as unencrypted files.
Where are the transcripts stored, and can I delete them?
On the computer that made them, as plain JSON files in the app's data folder, listed in a history inside the app. You can copy one, save it as text, or delete it. Fraze does not encrypt them.