2.3 Confidentiality, NDAs, File Security & HIPAA
Key Takeaways
AAERT's Code tells members not to discuss remarks heard on or off the record with anyone and to keep all assignments strictly confidential.
FRCrP 6(e)(2)(B) binds court reporters, recording-device operators and anyone who transcribes recorded grand jury testimony to secrecy.
HIPAA applies to covered entities and their business associates; a transcriber hired by a covered entity to handle protected health information may be a business associate.
HIPAA permits covered entities to disclose protected health information in judicial proceedings under 45 C.F.R. § 164.512(e) with a court order or qualifying subpoena process.
A transcriber hears confessions, medical histories, trade secrets, the names of abused children and the bank account numbers of divorcing spouses. Blueprint knowledge area 10200 asks you to discuss maintaining confidentiality, describe nondisclosure agreements, protect job files and equipment, and explain how HIPAA applies to legal transcripts.
The confidentiality rules
AAERT's Code, Part II:
- II.A: "Preserve the confidentiality and ensure the security of information, oral or written. Do not discuss remarks heard on or off the record with anyone. Keep all assignments strictly confidential."
- II.B: For transcripts not intended for public distribution, "do not make public any part of the proceeding."
- II.C: Be helpful to parties, "but do not orally communicate any substance of the proceedings to any party or non-party."
NCRA's Code adds a duty to preserve the confidentiality and security of information "entrusted to the Member by any of the parties."
Confidentiality covers more than content. The fact that you are working on a case, the names of the people involved and even your delivery schedule can be sensitive. Do not confirm to a reporter, a relative or a curious friend that you are transcribing a particular case.
Proceedings with extra protection
| Proceeding | Source of secrecy | Transcriber impact |
|---|---|---|
| Federal grand jury | FRCrP 6(e)(2)(B) lists court reporters, operators of recording devices and "a person who transcribes recorded testimony" among those who must not disclose grand jury matters | Unauthorized disclosure can be punished as contempt of court |
| Sealed proceedings | Court order | Deliver only as the order directs; label and store separately |
| Juvenile, adoption and many family matters | State statutes and court rules | Often closed to the public; strict distribution rules |
| Protected (confidential) deposition testimony | Stipulated protective order | Mark designated pages and limit distribution (Chapter 11) |
| Mediation | Mediation confidentiality rules and agreements | Usually not recorded at all; if a settlement term is put on the record, handle it as confidential unless told otherwise |
Nondisclosure agreements (NDAs)
Agencies and many direct clients require transcribers, especially independent contractors, to sign an NDA. Typical terms:
- Scope: all audio, transcripts, exhibits, log notes and case information, plus anything learned while doing the work.
- Use restriction: use the material only to produce the transcript.
- No retention: return or securely delete files after delivery or at the end of a retention period.
- Security requirements: encryption, approved devices only, no public cloud or personal email.
- Subcontracting ban: you may not hand work to someone else without written permission.
- Duration: obligations usually survive after the engagement ends, often indefinitely.
- Breach consequences: termination, damages, and in some cases referral to the court.
An NDA adds contractual duties; it does not replace your ethical duty. Even without an NDA, AAERT's Code still applies.
Securing job files and equipment
Blueprint topic 10203 asks how to protect files and equipment from tampering, loss or theft.
| Risk | Controls |
|---|---|
| Loss or theft of a laptop | Full-disk encryption; strong password; automatic screen lock; never leave devices unattended in a car or café |
| Interception in transit | Use the client's secure portal or encrypted transfer, not ordinary email attachments; avoid public Wi-Fi or use a VPN |
| Unauthorized viewing at home | A private workspace; headphones rather than speakers; lock the screen when you step away |
| Tampering | Keep original audio unaltered; work from a copy; do not edit the source file |
| Accidental disclosure | Do not paste transcript text into public AI tools, translation sites or search engines. Research a single term or name without surrounding content. |
| Data loss | Encrypted backups; follow the client's retention and deletion schedule |
| Malware | Current operating system and antivirus updates; no unapproved software |
| End of job | Securely delete working copies when the retention period ends; confirm deletion if the client requires it |
On the CET practical exam, AAERT requires you to delete the transcript and all exam files while the proctor watches. That rule reflects the same principle.
HIPAA and legal transcripts
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule protects protected health information (PHI). Its rules bind covered entities (health plans, health care clearinghouses and health care providers that conduct certain electronic transactions) and their business associates, meaning outside persons or firms that handle PHI on a covered entity's behalf.
How that plays out for a CET:
- Court proceedings are full of medical information. Personal injury depositions, workers' compensation hearings, malpractice trials and competency hearings all contain PHI-type details.
- Court reporters and transcribers are not covered entities themselves. HIPAA does not turn every transcript into a HIPAA record. However, when a hospital, clinic or insurer hires you, or your agency, to transcribe proceedings that contain PHI, you may be acting as a business associate. You may then be asked to sign a business associate agreement (BAA) that requires HIPAA-level safeguards.
- Disclosure in litigation. Covered entities may disclose PHI in judicial and administrative proceedings under 45 C.F.R. § 164.512(e): in response to a court order, or to a subpoena or discovery request with satisfactory assurances (such as a qualified protective order). Medical records often enter a case this way, as exhibits you will see.
- Practical duty. Whether or not HIPAA technically applies, handle medical information with the same care as HIPAA requires. Use the minimum necessary, keep it secure, do not discuss it, and follow any protective order.
Federal filings also have redaction rules for personal identifiers such as Social Security numbers, birth dates and minors' names (FRCP 5.2 and FRCrP 49.1). The parties, not the transcriber, are responsible for requesting those redactions (Chapter 11).
A transcriber's cousin asks, "Off the record, was the witness in that hospital case lying?" What does AAERT's Code require?
Share an opinion only if the transcript has already been filed publicly
Decline to discuss it, because remarks heard on or off the record must not be discussed with anyone
Share the general gist without naming any parties
Answer, because personal opinions to family members are not covered by the Code
Which people does Federal Rule of Criminal Procedure 6(e)(2)(B) bind to grand jury secrecy?
Only grand jurors and the prosecutor
Only persons who have signed a nondisclosure agreement
Only federal employees, not private transcription contractors
Court reporters, recording-device operators, and persons who transcribe recorded testimony, among others
A hospital hires a transcription firm to transcribe recorded peer-review hearings that include patient information. How does HIPAA most likely affect the firm?
The firm may be acting as a business associate and can be asked to sign a business associate agreement
HIPAA never applies to anything a transcriber handles
The firm becomes a covered entity and must file HIPAA reports with the court
The firm must remove all medical terms from the transcript
Sections you finish are checked off in the contents.