Medical Dictation: Cloud Transcription and Patient Confidentiality

Dictation is how medicine documents itself. Discharge letters, surgical reports, findings, consultation notes: a consultant speaks, someone types, the record exists. Speech recognition has made that loop dramatically faster, and in a system short of medical secretaries that is not a nice-to-have.

At the same time, medical content sits under the strongest protection German law provides. Section 203 StGB makes the unauthorised disclosure of secrets entrusted to a physician a criminal offence, punishable by up to one year of imprisonment or a fine. A wrong architecture decision in the transcription pipeline does not merely breach the GDPR; it exposes the individuals involved to prosecution.

This article shows how modern cloud transcription and medical confidentiality can be reconciled in practice. It is written from the German position because that is the strictest in Europe, and because any clinic operating in the DACH region has to meet it regardless of where its vendor is based.

The legal starting point

Section 203 StGB: medical confidentiality

Section 203 (1) no. 1 StGB penalises anyone who without authorisation discloses another person's secret that became known to them as a physician, dentist, veterinarian, pharmacist or member of another healing profession. Protected is not only the diagnosis but everything learned in the treatment context: name, address, social situation, family background, financial circumstances.

"Disclosure" is read broadly. It occurs as soon as a specific third party gains knowledge, even if that third party is itself under a duty of confidentiality. Sending an audio file containing patient data to a transcription service is therefore already a disclosure, by the act of sending.

That single sentence is what most vendor evaluations miss. The question is not whether the vendor keeps the data safe. The question is whether the transfer to it was permitted at all.

Section 203 (4) StGB: the exception for external providers

A 2017 amendment created a lawful route for involving external providers.

In substance, subsections 3 and 4 provide that:

1. Professionals bound to secrecy may use assistants and other contributing persons, to the extent necessary for the proper exercise of the profession.
2. The contributing person must be bound to secrecy in writing, with an express notice of criminal liability under section 203 (4) StGB.
3. If the contributing person breaches the secret, that person is criminally liable themselves.

This is the legal lever that makes external transcription of medical data possible at all. Without the undertaking, every upload to an external provider is potentially an offence.

Article 9 GDPR: health data

In parallel, health data is a special category under Article 9 (1). Processing is prohibited unless an exception applies; for medical work the relevant one is Article 9 (2)(h), processing for the purposes of preventive medicine, diagnosis and care, provided it is carried out by professionals subject to an obligation of secrecy (Article 9 (3)).

That basis carries the clinical documentation. It also carries the involvement of a transcription provider, on condition that the provider is itself subject to a duty of secrecy and the contracts say so.

German hospital IT security law

Section 75c SGB V, introduced with the Hospital Future Act, has since 1 January 2022 required hospitals to take appropriate technical and organisational measures for IT security. The sector-specific standard B3S for hospital care is recognised as the minimum.

For cloud vendor selection this means a documented risk assessment for every external processor, ISO 27001 or comparable certification, encryption in transit and at rest, and defined incident-reporting and forensic readiness. A provider without that foundation is not qualified for clinical use, however convincing its website.

Where it goes wrong

The rushed upload from the secretariat. A medical typist under time pressure puts surgical dictation into a free online transcription service, in good faith, because the patient is waiting for the letter. Legally: the typist is criminally liable as a contributing person, the responsible physician may be liable if they knew or should have known about the practice, the hospital operator faces a GDPR fine, and professional consequences under the state medical association's rules follow on top. Supervisory authorities have imposed fines for exactly this pattern.

The temporary workaround during staff shortages. Many clinics fall back on external typing agencies, some of which use cloud speech recognition behind the scenes. Without a clean contract stack, meaning an agreement plus section 203 undertaking with the agency, and the same again between the agency and its recognition provider, you get an unsecured data chain where the offence can be committed at several nodes simultaneously.

Hallucination in findings. Underestimated in practice: generic speech models are not trained on medical terminology. They hallucinate on Latin anatomy, ICD codes and drug names. In the worst case a surgical report describes a different operation than the one performed, and the duty to correct it falls on the dictating physician. A provider built for clinical use has to support custom vocabulary for clinical terms and report word-level confidence so that uncertain passages can be checked deliberately rather than by re-reading everything.

Three clinical workflows

Discharge letter. A consultant dictates after the ward round. The file goes through the hospital dictation system to the transcription provider, and within minutes a draft exists for the physician to release. What makes it lawful: an agreement between clinic and provider, a section 203 (4) undertaking from the provider, individual confidentiality undertakings from every employee of the provider with access, deletion of the audio after successful transcription, and the transcript held only as long as the release step needs it.

Surgical report. These describe invasive procedures in detail, and accuracy is critical: a misheard drug name, a swapped left and right, a lost negation can all acquire legal weight later. Custom vocabulary for surgical terminology, word-level confidence so low-scoring words are flagged for review, and speaker separation between surgeon and assistant are not conveniences here.

Recorded consultation with consent. In psychiatry and psychotherapy, sessions are increasingly recorded with the patient's consent to document therapy content. On top of medical confidentiality sits the particular sensitivity of mental health data. A defined lifecycle is mandatory: recording, transcription, deletion of audio, storage of the transcript in the patient record, deletion of the transcript after the retention period.

The checklist

• Article 28 agreement with an explicit clause on processing health data under Article 9.
• Section 203 (4) StGB undertaking, in writing, with the notice of criminal liability, before the first processing.
• Individual undertakings from every employee of the processor who could reach patient data.
• Servers in Germany or the EEA only. For particularly sensitive fields, forensics or addiction medicine, prefer Germany.
• No US sub-processors in the audio path. No OpenAI Whisper API, no Google Speech-to-Text, no AWS Transcribe in the backend.
• ISO 27001 at the hosting provider, aligned with B3S for hospitals.
• Encryption, TLS 1.2 or higher in transit, AES-256 at rest.
• Custom vocabulary for clinical terminology and house-specific terms.
• Word-level confidence visible in the transcript.
• Audit log of every data access.
• Defined deletion periods for audio, immediately after transcription by default, and for transcripts.
• Insurance covering cyber and data protection incidents.

How DeepScript is set up for medical dictation

• Servers in Germany. Hetzner data centres in Falkenstein and Nuremberg, ISO 27001 certified. No US parent, so no CLOUD Act exposure.
• Own speech recognition. No third-party AI in the audio path.
• An agreement with the section 203 clause. The processor's undertaking under section 203 (4) StGB and the express notice of criminal liability are part of the standard agreement, signable on the website.
• Custom vocabulary for clinical terminology, department names and study identifiers.
• Word-level confidence and speaker separation in every tier, not as an upgrade.
• Configurable deletion, with audio removed immediately after successful transcription by default.
• Exports as TXT, JSON and DOCX for hospital information systems and dictation workflows.

Conclusion

Medical dictation through a cloud service is lawful. It is just not lawful by default: it requires the combination of a processing agreement, a section 203 undertaking with the liability notice, EU processing without US sub-processors, documented deletion and clinical vocabulary support.

Any one of those missing is not a paperwork problem. Section 203 StGB attaches to individuals, which means the exposure sits with the physician and the typist, not only with the operator.

The full documentation and the sub-processor list are in the Trust Center, the sector page for healthcare is here, and if the recordings come from Zoom or Teams the compliant pattern is in this article.