HIPAA-minded setup

This guide is practical background, not legal advice.

JesRecap is designed to support your compliance process. It is not HIPAA certified — there is no such certification for software — and it cannot make an organisation compliant. What it does is keep the audio and the transcript on the machine that recorded them, which removes a vendor from the middle of your PHI.

PHI hides in meeting audio

Meeting recordings are messy by nature, and the messy parts are exactly the parts HIPAA cares about. In an hour of ordinary conversation you can easily capture:

• Patient names, dates of birth, and record numbers said out loud in a care review.
• Diagnoses, medications, and treatment plans discussed in a huddle.
• Insurance and billing details in a revenue-cycle call.
• Identifiable detail in an "anonymous" case discussion — the combination of ward, date, and condition is often enough.
• Staff health information, mentioned in passing, which is its own problem.

You cannot reliably plan around this. Assume any recorded clinical or operational meeting contains PHI, and design the workflow for that case.

Why the BAA question changes shape

A business associate is, broadly, a person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity. That is what puts a cloud transcription service in scope: you upload the audio, they receive it, store it, run models on it, and you need a signed business associate agreement plus assurance about their subcontractors, their retention, and their security.

JesRecap does not receive the audio or the transcript. Capture happens through the operating system's audio APIs, transcription runs against a model file already on the disk, and the output is written to local storage. There is no upload path for meeting content in the product, so for the transcription of that content there is nothing for us to maintain or transmit on your behalf.

Two things follow, and both matter:

• The vendor question mostly disappears for transcription. No third party holds the recording, so there is no BAA to negotiate for it and no subcontractor chain to inherit.
• Your own obligations get sharper, not smaller. The PHI is sitting on an endpoint you own. Access controls, encryption, audit practice, workforce training, retention, and breach procedures are all yours, and the laptop is now in scope for all of them.

We hold licence data — the email you buy with, the licence key, and a device fingerprint used to enforce the two-device limit. That is buyer information, not patient information. Have your privacy office look at it in that light. If you want written confirmation of what we do and do not receive, ask us at support@jesrecap.com.

The one place PHI can still leave: by default, JesRecap's meeting actions copy a prompt with the transcript included so you can paste it into an AI assistant. If you paste PHI into a third-party AI, that vendor is receiving PHI and needs a business associate agreement — or you should not paste it. There is no cloud AI inside JesRecap, so that decision, and the responsibility, stays with you.

Or close that gap entirely: switch on AI notes on this device and the summary or action items are written by a model running on the same machine, saved with the meeting. The PHI never leaves the endpoint, so no business associate agreement is needed for the summarising step. The setting is off until you enable it, and enabling it fetches the model once (about 1.3 GB); after that it needs no network.

Setup checklist

1. Encrypt the disk

FileVault on macOS, BitLocker on Windows, verified as on rather than assumed. Encryption at rest is the single control that turns a lost laptop from an incident into a much smaller incident. If devices are managed, enforce it by policy and check the reported status.

2. Separate operating-system users

JesRecap stores meetings under the user's own application-support directory, so per-user OS accounts give you real separation for free. That means: no shared logins on shared workstations, one account per person, standard (non-admin) accounts for daily use, and no "front desk" account that six people know the password to. If a workstation must be shared, decide deliberately that it is not a recording device.

3. Lock the screen and set a short timeout

A password-protected screen lock after a few minutes idle, and a habit of locking on standing up. Recording sessions happen in rooms where other people walk past.

4. Know where the data lives

You cannot govern what you cannot locate. JesRecap keeps everything under one directory per user:

Both source tracks are kept so you can re-transcribe a meeting later. That is useful, and it means audio persists until you delete it.

5. Decide retention before the first recording

Write a rule and apply it: how long recordings are kept, who deletes them, and what happens when someone leaves. A workable pattern is to keep the transcript for as long as the clinical or operational purpose requires, and delete the WAV files as soon as the transcript has been reviewed. Deleting the meeting in the library removes it from that machine; remember your backups hold copies too.

6. Bring backups into the plan

Time Machine, File History, or a managed backup agent will pick up the meetings folder. Either encrypt the backup destination and treat it as PHI storage, or exclude the folder deliberately and accept that recordings are not recoverable. Choose on purpose — the default is usually "backed up, unencrypted, offsite".

7. Control exports

Exports are the moment data moves: Markdown, plain text, JSON archive, SRT/VTT captions, and WAV audio. Decide where exports are allowed to go — the EHR, an approved internal share, nothing else — and specifically rule out personal cloud drives, personal email, and consumer chat apps.

8. Grant only the permissions needed

On macOS, JesRecap uses the system Audio Capture permission plus microphone access; the operating system shows a recording indicator, which is a feature, not a nuisance. On Windows, system audio is captured through WASAPI loopback. No recording bot joins the meeting, so there is no extra participant in the room and no meeting-platform integration to authorise.

9. Train the people who press record

Two rules cover most of it: say that you are recording before you start, and stop recording when the conversation moves to something that should not be captured. Add the workflow to your existing workforce training rather than treating it as a separate policy nobody reads.

10. Know your incident path

If a recording device is lost or accessed improperly, that is your breach assessment to run, with encryption status as a central fact. There is no vendor to notify and no vendor notification to wait for — which is faster, and entirely on you.

Consent and notice

HIPAA is not the only rule in play. State recording laws vary, and several require every party to consent before a conversation is recorded. Patient-facing recordings raise trust questions well beyond the legal minimum. Practical approach: state clearly at the start that you are recording and why, note it in the meeting record, offer a straightforward way to decline, and do not record when anyone objects. Recording a patient encounter should follow your organisation's own consent process, in writing where that is the norm.

What this guide does not claim

JesRecap is not certified, audited, or guaranteed compliant, and we will not tell you otherwise. It is preview software from a small independent developer. What we can state factually is where the data goes: the meeting audio and transcript stay on the device, and the only network calls are a one-time model download and licence activation. Take that fact to your privacy officer and let them do their job with it.