Why Health Tech Teams Are Afraid of AI Meeting Notes

And how on-device processing changes the equation

The Elephant in the Room

“Health tech teams not using AI meeting notes… Is it fear of HIPAA & data privacy regulation?” — @taylorsenecal_

She’s right to ask. While the rest of the tech world embraces AI-powered meeting tools, health tech remains cautious. And for good reason.

HIPAA civil penalties are tiered and can reach seven figures a year for violations of a single requirement. A single recorded conversation containing Protected Health Information (PHI) uploaded to a third-party cloud could trigger a breach notification, an OCR investigation, and a PR disaster.

So teams stick to manual notes. Or skip documentation entirely.

It’s Not Paranoia — It Already Happened

In late 2024, an Otter.ai bot attended a virtual meeting in place of the doctor who had been invited. While participants discussed private patient information, the unnoticed bot recorded everything.

The bot wasn’t malicious. It was a calendar sync gone wrong. But the result was the same: PHI captured by a third-party service without consent.

This isn’t an edge case. It’s the inevitable result of cloud-based meeting bots that:

Join calls automatically
Upload audio to external servers
Store transcripts indefinitely
Process data in jurisdictions you don’t control

The Cloud Problem

Here’s what happens when you use a typical AI meeting notes tool:

Audio leaves your device → uploaded to vendor’s cloud
Transcription happens on their servers → they have access to your content
Data stored in their infrastructure → subject to their security practices, their jurisdiction, their subpoenas

For health tech, this creates an impossible compliance burden:

You need a BAA (Business Associate Agreement) with every vendor
You need to audit their SOC 2, HIPAA compliance, data residency
You need to trust that their “delete” actually deletes
You need to explain to your compliance team why patient discussions live on someone else’s servers

Most teams decide it’s not worth it. They go back to pen and paper.

What If the Audio Never Left?

On-device processing flips the architecture:

Audio captured locally → recordings stay on your Mac
Transcription runs on your hardware → using local ML models
Summaries run where you choose → with Local Models selected, on your Mac too; a cloud AI provider, if you pick one, receives transcript excerpts and, for chat, your question with related topics, action items and meeting titles and dates

With Local Models selected and iCloud sync off (the default), there is no cloud copy of your meeting library. If you turn sync on, meeting content is stored in your iCloud account as encrypted data, while metadata such as meeting dates and durations is not encrypted. What’s left to protect is the Mac itself: Summit does not separately encrypt its local database or recordings, so FileVault and a locked macOS account matter.

That removes some questions from a compliance review, such as why meeting audio is sitting in an AWS bucket in Virginia, but not all of them. Summit is a meeting notes app, not a medical scribe, and is not certified for HIPAA or any other healthcare regulation. Whether a cloud AI provider needs a BAA, which meetings may be recorded, and whether patient information may come up in them are questions for your compliance team.

Your notes. Your device. Your data.

The New Standard for Regulated Industries

Health tech isn’t the only sector with this problem:

Legal teams can’t risk client privileged conversations in the cloud
Finance faces SEC and FINRA scrutiny on communication records
Government contractors have FedRAMP and ITAR concerns

On-device meeting notes aren’t just a privacy feature — they’re becoming part of how regulated teams answer compliance questions.

Try It

Summit transcribes on your Mac, and with Local Models selected it summarizes there too. No meeting bots joining your calls. Before recording in a healthcare setting, see what to check first.

Get Summit →

Your conversations are yours. Keep them that way.