HIPAA & research data
HIPAA-compliant transcription for research interviews: what to require
There is no such thing as a HIPAA-certified transcription service; HIPAA has no certification program. What makes a service compliant for research is a short list of commitments you can verify: a signed BAA, encryption in transit and at rest, trained staff under confidentiality agreements, data kept in the United States, de-identification when your protocol calls for it, and documentation your IRB can review. Landmark provides all six, and none of them changes the rate: transcription starts at $1.99 per audio minute with HIPAA-compliant handling and Safe Harbor de-identification included.
Key takeaways
- There is no HIPAA certification for vendors; "HIPAA certified" is marketing.
- What you can verify: a signed BAA, encryption in transit and at rest, trained staff under confidentiality agreements, U.S. data residency, de-identification, and documentation your IRB can read.
- HIPAA applies when the recordings or records come from a covered entity; otherwise the Common Rule and your IRB govern, and the same controls are still what reviewers ask about.
- Compliant handling should not carry a surcharge. At Landmark it is included: from $1.99 per audio minute with Safe Harbor de-identification at no extra charge.
The six requirements, and what to ask for
| Require | Why it matters | Ask the vendor for | At Landmark |
|---|---|---|---|
| A signed Business Associate Agreement (BAA) | If your recordings contain protected health information from a covered entity, HIPAA requires a BAA with any vendor that handles them. | Their BAA, or willingness to sign your institution’s template, before the first upload. | BAAs in place with many universities; your template is fine. |
| Encryption in transit and at rest | Recordings sent by email or stored on a shared drive are the most common way interview data leaks. | How files are uploaded, where they live, and whether both legs are encrypted. | Encrypted upload and storage on Landmark’s platform; no email transfer. |
| Trained staff under confidentiality agreements | The transcriptionist hears everything the participant said. Training and a signed agreement are what make that acceptable to an IRB. | Who has access, what training they complete, and what they sign. | Staff complete human subjects protection and HIPAA training and sign confidentiality agreements. |
| Data kept in the United States | Offshore transcription puts PHI under other jurisdictions and outside your BAA’s reach. | Where the work is done and where files are stored, in writing. | U.S. clients’ recordings never leave U.S. infrastructure and are handled only by U.S.-based staff. |
| De-identification when your protocol calls for it | Safe Harbor de-identification removes the 18 identifier categories so transcripts can be shared, coded and archived with less risk. | Whether they de-identify, by which standard, and what it costs. | Safe Harbor de-identification included at no extra charge. |
| Documentation your IRB can review | Reviewers approve what they can read: encryption, access, training, retention. | A security summary you can attach to the protocol. | IRB-ready security documentation on request; see the compliance page. |
How to verify a service: seven questions to ask before you sign
Ask these in writing and keep the answers with your protocol. A compliant vendor answers all seven without hedging.
1.Will you sign our institution’s BAA (or NDA) before the first file is uploaded?
A vendor that hesitates here is not a business associate; the agreement has to exist before PHI moves.
2.How do recordings get to you, and how are they stored?
The answer should be an encrypted upload to the vendor’s own platform and encrypted storage. Email attachments and shared drives are the common failure.
3.Who exactly will hear the recording, and what have they signed?
Named roles, training (HIPAA and human subjects protection) and a signed confidentiality agreement per person.
4.Where is the work done and where do the files live?
Offshore processing moves PHI outside the reach of your BAA and your IRB.
5.Can you de-identify transcripts, by which standard, and at what cost?
Safe Harbor, all 18 identifier categories, with a clear answer on whether identifiers are removed, replaced with placeholders, or left for your own coding.
6.What documentation can you give my IRB or IT security office?
A written security summary you can attach to the protocol, not a badge on a website.
7.How long do you keep recordings and transcripts, and how do I have them deleted?
Retention and deletion belong in your protocol; get the vendor’s practice in writing and quote it.
What the BAA should cover
- Permitted uses and disclosures of the PHI (transcription of your recordings, nothing else).
- Safeguards the vendor maintains: encryption, access controls, staff training.
- Breach notification: what the vendor must tell you, and how quickly.
- Subcontractors: whether any exist and that the same terms flow down to them.
- Return or destruction of PHI when the engagement ends.
- Your right to review the vendor’s practices, and your institution’s template where it has one.
Warning signs
- A "HIPAA certified" badge, seal or certificate number. No such certification exists.
- No BAA offered, or a BAA only for "enterprise" tiers while research recordings go through a consumer upload.
- Files accepted by email, or a shared-drive link as the delivery method.
- Transcription performed offshore, or an inability to say where the files are stored.
- A consumer AI tool as the workflow, with no agreement covering how your audio is used.
Does HIPAA even apply to your study?
HIPAA governs covered entities (providers, health plans, clearinghouses) and their business associates. Many university studies are governed by the Common Rule and your IRB rather than by HIPAA, and interviews about health topics are not automatically protected health information. The practical test: if the recordings or records come from a covered entity, such as a university medical center or a clinic partner, treat the data as PHI and require a BAA. If you are not sure, your IRB or privacy office decides, not the vendor. Either way, the five other requirements above are what an IRB will ask about, so they are worth requiring for any recorded interview, HIPAA or not.
What Landmark signs and provides
- BAA or NDA, on your institution’s template if you prefer. Landmark has BAAs in place with many universities.
- Encrypted upload and storage on the Landmark platform, handled only by U.S.-based staff; recordings and transcripts for U.S. clients never leave U.S. infrastructure.
- Trained, bound staff: human subjects protection and HIPAA training, plus signed confidentiality agreements.
- Safe Harbor de-identification of all 18 identifier categories, included at no extra charge.
- IRB-ready security documentation you can attach to a protocol. How to get a vendor through IRB review is on the IRB approval guide.
- Human transcription at 99%+ accuracy, from $1.99 per audio minute for one-on-one interviews and from $2.69 for focus groups, in 3–5 business days.
Questions researchers ask
- Is there such a thing as a HIPAA-certified transcription service?
- No. HIPAA has no certification program for vendors, so "HIPAA certified" is a marketing phrase, not a credential. What you can verify is whether a service will sign a Business Associate Agreement, encrypts recordings in transit and at rest, limits access to trained staff under confidentiality agreements, keeps data in the United States, de-identifies transcripts when your protocol requires it, and gives you documentation your IRB can review.
- Will Landmark sign a BAA for university research?
- Yes. Landmark has Business Associate Agreements in place with many universities and research institutions and can work from your institution’s template. If your study handles protected health information from a covered entity, ask for the BAA before the first file is uploaded.
- Who hears my recordings, and where are they stored?
- Recordings and transcripts for U.S. clients stay on U.S. infrastructure and are handled only by U.S.-based staff who have completed human subjects protection and HIPAA training and signed confidentiality agreements. Files are transferred and stored encrypted on Landmark’s platform, never sent by email.
- Do you de-identify transcripts?
- Yes. HIPAA Safe Harbor de-identification, removing all 18 identifier categories, is included at no extra charge with transcription. Tell us at upload whether you want identifiers removed, replaced with placeholders, or left in for your own coding.
- My IRB wants documentation of the vendor’s security. What can you give me?
- IRB-ready security documentation describing encryption, access controls, staff training and confidentiality agreements, plus the BAA or NDA itself. Landmark’s practices have been reviewed in IRB and university IT security reviews before; see the compliance page for what to request.
- What should a BAA with a transcription vendor include?
- Permitted uses of the protected health information (transcribing your recordings and nothing else), the safeguards the vendor maintains, breach-notification duties and timing, whether subcontractors are used and that the same terms bind them, return or destruction of PHI when the work ends, and your right to review the vendor’s practices. Most universities have their own template; Landmark signs on yours if you prefer.
- Does HIPAA require the transcription to be done in the United States?
- Not in so many words, but a BAA is hard to enforce and a breach hard to investigate once files are processed abroad, which is why IRBs and privacy offices ask where the work is done and where the files live. Landmark handles U.S. clients’ recordings and transcripts only on U.S. infrastructure and only by U.S.-based staff.
- Does HIPAA-compliant handling cost extra?
- No. Every transcription plan includes secure, HIPAA-compliant file handling and Safe Harbor de-identification. Transcription starts at $1.99 per audio minute for one-on-one interviews and $2.69 for focus groups and recordings with three or more speakers; speaker identification and timestamps are optional add-ons priced with your quote.