October 23, 2026 · 13 min read
PHI in Captions: When Live Captions Contain Health Data
PHI in captions, explained: when spoken words become protected health information, where it hides in live transcripts, and how to plan a safer captioning setup.
PHI means protected health information. It shows up in captions when someone says identifiable health details out loud and a tool turns those words into text. A name plus a diagnosis, an appointment time, or a bill can be enough. Captions are text, so they can be displayed, saved, exported, and shared. That is why PHI in live captions deserves a plan before the event, not after.
This guide explains what PHI is, how it ends up in a caption feed or transcript, and what you can do about it. It is written for clinics, churches with health ministries, universities, and event teams that sometimes hear health talk in the room.
TL;DR
- PHI is individually identifiable health information tied to a person’s health, care, or payment for care. Spoken words count, not just paper and databases.
- A name alone is not automatically PHI. A name next to a treatment detail can be.
- A transcript is not anonymous because it is text. De-identifying it takes a defined method, not a quick find-and-delete.
- Live Caption AI is an AI captioning tool. It does not offer HIPAA compliance or Business Associate Agreements, so do not plan to caption PHI-heavy conversations with it.
- Decide in advance what gets captioned, who sees it, and what gets saved.
Table of Contents
- What PHI means in plain language
- How PHI ends up in captions
- Why a text transcript is not automatically anonymous
- What this means for AI captioning tools
- A practical plan before you caption anything
- Our perspective
- Accuracy matters as much as privacy
- When Live Caption AI is a good fit
- Try it on a low-risk session first
- FAQ
- Sources
What PHI means in plain language
HHS describes PHI as individually identifiable health information about a person’s past, present, or future physical or mental health, the health care they receive, or payment for that care. It is protected when a covered entity or its business associate holds or transmits it. It counts in any form or medium: oral, paper, or electronic.
The oral part matters for captioning. Speech-to-text takes spoken words and makes them visible and storable. Anything said aloud can become a written record.
HHS gives medical records, laboratory reports, and hospital bills as examples. Identifying details alone are not necessarily PHI. The link between the identifier and the health information is what decides it.
Identifier plus health detail
HHS’s guidance makes this point clearly. A phone number or name in an ordinary public directory is not automatically PHI. The same identifier next to a statement that the person was treated at a clinic can be.
Think of it as two halves:
- Who: a name, address, phone number, record number, or another detail that points to one person.
- Health: a condition, treatment, appointment, test result, or bill.
When both halves land in the same caption line, you should treat it as PHI.
Who is bound by the rules
HIPAA’s Privacy Rule applies to covered entities, such as health plans, clearinghouses, and many health care providers. It also applies to their business associates. HHS explains that business associates are generally people or companies, other than workforce members, that a covered entity engages to carry out certain functions for it. A vendor that handles PHI for a clinic can fall into that group.
A church member sharing a prayer request is not a covered entity. A clinic hosting a patient education night is. The same sentence can be treated very differently depending on who says it and who holds it. If you are unsure which side you are on, ask your compliance officer or health privacy attorney.
How PHI ends up in captions
Most PHI in captions is not planned. It slips in. A speaker answers a question from the floor. A staff member reads out a name. A panelist tells a story about a patient.
| Situation | What gets said | Why it can be PHI |
|---|---|---|
| Patient education class | “Maria, your A1C came back high at last week’s visit.” | Name, date, and a test result together |
| Staff huddle shown on a screen | “Mr. Alvarez in room 12 missed his dose.” | Name, location, and care detail |
| Billing or insurance Q&A | “Your account number ends in 4471 and the balance is $380.” | Account number and payment for care |
| Support group or health ministry | “My brother was admitted to St. Luke’s on Tuesday.” | Relative, facility, and date, if the speaker is a covered entity’s workforce or the info came from a covered source |
| Public webinar | “A patient we treated last spring from Dayton…” | Smaller geographic detail plus a treatment story, possibly identifying in combination |
The last two rows show why context matters. Details that look harmless can identify someone when combined with other information people already have. HHS’s de-identification workshop materials explain that remaining details can identify a person alone or in combination with reasonably available information. So review the whole event, not one line.
Live display versus saved transcript
These are two different risks.
- The live feed. Anyone who can see the screen or scan the code can read the words as they are spoken. This is the same exposure as a person in the room hearing them.
- The saved transcript. Text can be copied, forwarded, uploaded, and kept for years. A one-time remark becomes a permanent file.
If PHI is spoken, ask both questions: who can see it live, and what is kept afterward.
Why a text transcript is not automatically anonymous
A common mistake is to treat a transcript as anonymous because it is only text. It is not. HHS recognizes two routes to de-identification:
- Safe Harbor: remove 18 types of identifiers. HHS lists them, including names, geographic subdivisions smaller than a state, dates linked to an individual, phone and email numbers, medical-record and account numbers, IP addresses, biometric identifiers, photographs, and other unique identifying characteristics. The full list is in HHS guidance.
- Expert Determination: a qualified statistical or scientific expert analyzes the data and documents that the risk of identification is very small.
Deleting a patient’s name is not de-identification. Do not label a raw event transcript “de-identified” unless you applied one of these methods. If you need that status for a document, involve your privacy officer.
What this means for AI captioning tools
An AI captioning tool converts speech to text in real time. For a privacy review, four questions matter most.
- Will PHI be spoken at all? The simplest control is to keep it out of the room, or out of the captioned part of the session.
- Where do the words go? Cloud services process audio and text on remote servers. Ask what is stored and for how long.
- Who can read the output? QR-code access means anyone with the code can read along. Treat the code like a key to the room.
- Is the vendor a business associate? If the vendor would handle PHI on your behalf, HIPAA expects the proper agreements and safeguards. Ask for them in writing before you go live.
If you are comparing options for patient-facing settings, our post on what HIPAA requires of a captioning vendor walks through the questions to ask.
A practical plan before you caption anything
Use this checklist for any session where health talk might come up.
- Define the purpose. Is this a public talk, a class, a worship service, or a patient encounter? Patient encounters carry the highest PHI risk.
- Script the sensitive parts out. Use first names only where possible, or none. Keep patient stories general. Move individual questions to a private conversation after the session.
- Brief the speaker. Tell them captions are visible to everyone who scans the code. Ask them to avoid names plus health details.
- Brief the moderator. For Q&A, have the moderator repeat or rephrase audience questions without identifiers.
- Control access. Share the QR code only with the intended audience. Do not post it publicly if the session may touch sensitive topics.
- Decide on saving. If you do not need a transcript, do not save one. If you do, store it where your organization stores other sensitive records, and limit who can open it.
- Review before sharing. Read the transcript with the whole event context in mind before posting, emailing, or using it in a summary.
- Know your escalation path. If PHI was displayed or saved by mistake, tell your privacy officer promptly. Your organization’s policy decides what happens next.
Our perspective
We built Live Caption AI so a speaker can run captions from a phone or laptop, and attendees can read them on their own phones by scanning a QR code. No app to install. No account to create. No hardware to rent. No stenographer to book.
That convenience is why we are direct about the limits. Live Caption AI is an AI captioning tool. It is not a certified or human-reviewed service. It does not offer HIPAA compliance, Business Associate Agreements, or SOC 2. If your session will involve identifiable patient information, a general-purpose captioning app is the wrong tool, and we would rather you know that now.
What we do offer is a design that limits what is kept. Session audio is never stored. Transcripts can be saved and exported as TXT, SRT, JSON, or PDF, but that is the speaker’s choice. If you do not save one, there is nothing to leak later.
We also think most PHI in captions is a speaking problem, not a software problem. A short briefing and a moderator who rephrases questions remove most of the risk. Good habits go further than any setting.
For health topics we have a Medical vocabulary model, and Custom Terms let you add up to 100 names, places, and terms before going live. These help with accuracy on drug names and procedures. They do not change the privacy rules above. Better accuracy means the words are shown correctly. It does not make them safe to show.
— Ryan
Accuracy matters as much as privacy
Captions exist so people who are deaf or hard of hearing can follow along. The ADA’s effective communication guidance lists real-time captioning as an auxiliary aid or service for people who are deaf, hard of hearing, or deaf-blind. It also says the communication must be effective for the specific person and situation.
That has two consequences for health-adjacent events.
- Test the terms. Run a short sample with the names, scripture, drug names, or medical terms your speakers will use. Check speaker changes and noisy-room conditions too. Do not assume automated captions are enough.
- Have a fallback. If accuracy or terminology demands exceed what automation can do, another aid may be needed. A person who requests a qualified interpreter or a human captioner should not be turned away because you bought software.
An AI captioning tool can be part of an organization’s effective-communication plan. It does not make an organization ADA-compliant on its own, and it is not ADA-certified. Our ADA effective communication toolkit lays out how to build that plan.
When Live Caption AI is a good fit
Health-related words are not always PHI. Many events sit comfortably outside the Privacy Rule, as long as nobody is identified alongside health details.
- A church service with a prayer time that mentions illness in general terms
- A university lecture on anatomy or pharmacology, with no patient identifiers
- A public health talk by a speaker presenting statistics and general guidance
- A finance or earnings call for a healthcare company, using public information
- A multilingual community health fair presentation without individual cases
For those, the Medical, Worship & Ministry, and Finance & Earnings models help with vocabulary. Translation is available into one of 29 languages per session. Viewers can switch between the original and the translation.
For clinical encounters, patient intake, or any session where staff discuss named patients, plan on a different solution. Ask your privacy officer which vendors meet your obligations.
Try it on a low-risk session first
If you run community events, classes, or services and want captions on every phone in the room, start with a session that has no patient information. See how the QR code flow works. Test your Custom Terms. Check the accuracy with your own speakers.
The Professional plan is $19.99 a month with unlimited captioning. There is also a Free plan, and the Business plan starts from $199 a month. See plans and pricing, or read about captioning for professional settings.
FAQ
What does PHI stand for in captions?
PHI stands for protected health information. In captions, it means any spoken words that identify a person and relate to their health, care, or payment for care. If a speaker says a name and a treatment detail, the caption can carry PHI.
Is a name in a caption always PHI?
No. HHS guidance says identifying information alone is not necessarily PHI unless it is connected to health information. A name in an ordinary context is not PHI. A name linked to a visit, diagnosis, or bill can be.
Does deleting names make a transcript de-identified?
No. HHS recognizes Safe Harbor, which removes 18 identifier types, and Expert Determination by a qualified expert. Removing only names does not meet either. Have your privacy officer review the method before you call a transcript de-identified.
Can I use Live Caption AI for patient conversations?
We do not recommend it. Live Caption AI does not offer HIPAA compliance or Business Associate Agreements. It suits sessions where no identifiable patient information is spoken, such as classes, services, public talks, and general health presentations.
Does Live Caption AI store session audio?
No. Session audio is never stored. Speakers can choose to save a transcript and export it as TXT, SRT, JSON, or PDF. Treat any saved transcript with the same care as other sensitive files.
Sources
- HHS: Guidance Regarding Methods for De-identification of Protected Health Information
- HHS: Workshop on the HIPAA Privacy Rule’s De-Identification Standard
- HHS: Business Associates
- ADA.gov: ADA Requirements, Effective Communication