Is Descript HIPAA-Compliant for Editing Patient Testimonial Videos?

Short answer: Don’t upload patient testimonial videos or other protected health information (PHI) to Descript under its publicly available terms. Descript’s Terms of Service prohibit content containing PHI. Its security and privacy materials describe safeguards and data practices, but those do not override that restriction or establish that Descript will handle PHI under a business associate agreement (BAA). Review the Descript Terms of Service and Descript security information before use.

A testimonial may contain PHI when it identifies a patient and reveals information about their health, care, or payment for care. A patient’s face, voice, name, diagnosis, treatment details, and the setting in which they speak may reveal that information. HHS explains what PHI is and when HIPAA authorization is required.

Does Descript sign a business associate agreement for HIPAA-regulated use?

Descript’s publicly available Terms of Service prohibit users from uploading or otherwise using content that contains PHI. The terms do not establish a HIPAA-regulated workflow or confirm that Descript offers a BAA for this use. As a result, you should not assume that a BAA is available or that ordinary account or enterprise security features make PHI use permitted. Check the current terms and obtain written confirmation from Descript before considering any arrangement involving PHI.

HIPAA generally requires a covered entity or business associate to have a compliant BAA with a cloud service provider that creates, receives, maintains, or transmits ePHI on its behalf. A BAA must set out permitted uses and disclosures and require appropriate safeguards; it does not make every use of PHI lawful. See HHS guidance on cloud services and ePHI and Descript’s current Terms of Service.

What patient testimonial data does Descript process and store?

Descript says it stores project information, including uploaded files, transcripts, and project metadata, on its servers to support editing, collaboration, and version history. Its privacy policy also describes collecting account and device information, such as names, email addresses, IP addresses, and usage logs. A patient testimonial can therefore involve more than the exported video: the source footage, audio, transcript, project, and related data may all matter.

Descript describes encryption in transit and at rest and lists cloud and other service providers involved in storage or particular features. Its privacy policy says personal data is retained as long as needed for the purposes collected and other legitimate business purposes, including legal or compliance obligations; it also says some information may remain in cached or archived copies. Review the Descript security information and Descript Privacy Policy for the current descriptions of storage, sharing, and retention.

Descript also says project content may be processed automatically to provide the service, and its terms describe possible access by Descript or third-party providers when using generative AI features. The privacy policy includes additional handling for AI Speakers and avatars. Avoid treating an exported or deleted copy as proof that every working copy, transcript, or associated record has been erased; check the applicable retention and deletion terms.

Which Descript features may expose protected health information?

Any workflow that uploads, stores, displays, transcribes, edits, or shares identifiable patient footage may involve PHI. This can include cloud-based transcription, transcript-based editing, captions, collaboration, project sharing, AI editing, and exporting or publishing a finished video. Descript’s Terms of Service prohibit PHI in content used with its service, so disabling one feature does not make uploading the underlying testimonial permissible under those terms.

Recording features may also capture incidental PHI, such as names on screens, appointment details, medical records, or other patients in the background. AI Speakers and avatar features raise additional considerations because Descript’s privacy materials describe voice and facial-data processing for those features. HHS notes that PHI can be visible, audible, or otherwise accessible in recorded video, and that masking a patient after filming does not replace prior authorization when PHI was accessible during filming. See HHS guidance on media access to PHI.

How do cloud transcription and AI processing affect patient privacy?

Cloud-based transcription can send audio or video to systems that process and store it to generate a transcript. That transcript may preserve names, diagnoses, treatment details, or other identifying information even if you later remove the corresponding material from the video. A provider using a cloud service to process or store ePHI on its behalf generally needs a BAA with that service provider and must meet applicable HIPAA requirements. See HHS cloud-service guidance.

AI features may involve additional processing or access by Descript or third-party providers, as described in Descript’s terms and privacy materials. Do not assume that an opt-out setting, encryption, or a claim that a provider does not train its models resolves the HIPAA requirements or Descript’s prohibition on PHI. For the current descriptions of processing and sharing, see the Terms of Service, Privacy Policy, and security information.

What safeguards are needed before editing patient testimonials?

First, do not upload PHI to Descript unless its applicable terms have changed and you have confirmed in writing that the intended HIPAA-regulated use is permitted, including the necessary BAA. If you need to edit identifiable patient footage, use a workflow and vendors approved by your organization’s privacy and security officers. A patient authorization does not replace a required BAA with a service provider.

Before using a compliant workflow, document your risk analysis and risk management measures; limit access through appropriate access controls; train authorized staff; and establish rules for storage, sharing, retention, deletion, incident response, and final publication. The HIPAA Security Rule requires safeguards for ePHI, including access controls and measures to address security risks. HHS outlines examples of Security Rule safeguards.

Obtain and document a valid patient authorization when required for the testimonial’s use or disclosure, particularly when using it for marketing. The authorization should clearly explain what information will be used, who will use or disclose it, who may receive it, the purpose, and its expiration or expiration event. Do not make treatment conditional on agreeing to a marketing authorization. See HHS authorization guidance and HHS guidance on recorded media.

What are the limitations of using Descript for HIPAA-covered content?

The central limitation is contractual: Descript’s publicly available Terms of Service prohibit content containing PHI. Although Descript describes security measures such as encryption and access-related protections, security features alone do not create HIPAA compliance or amend the terms. Its privacy and security materials also describe cloud storage, project data, and processing by service providers, so you should evaluate the complete data flow rather than just the final video file.

Accordingly, don’t use Descript for identifiable patient testimonial footage under its current public terms. If Descript later confirms a permitted HIPAA arrangement in writing, verify the scope of the BAA, covered features and subprocessors, retention and deletion commitments, access controls, and your organization’s own policies before uploading anything. HHS does not certify or endorse individual products as “HIPAA compliant”; covered entities remain responsible for their own compliance. See HHS guidance on business associates and cloud providers.

Conclusion: Descript’s publicly available terms prohibit PHI, so it should not be used to edit identifiable patient testimonial videos unless the vendor formally changes or supersedes those terms and confirms a HIPAA-permitted arrangement. Use a BAA-covered workflow, apply appropriate safeguards, and obtain the required patient authorization before testimonial use or disclosure.

FAQs

Can Descript sign a business associate agreement for patient testimonial videos?

Descript’s publicly available terms prohibit content containing PHI, and its public materials do not establish that it offers a BAA for patient testimonial editing. Ask Descript for written confirmation of its current position and do not upload PHI unless the applicable contract and terms expressly permit the use. HIPAA generally requires a BAA when a cloud service provider handles ePHI on behalf of a covered entity or business associate; see HHS guidance.

Does editing a video in Descript make it HIPAA compliant?

No. Editing software or a particular workflow does not by itself establish HIPAA compliance. You must consider the vendor’s terms, any required BAA, the handling of source media and transcripts, your organization’s risk analysis and safeguards, and the authorization for the intended use or disclosure. Descript’s current public terms prohibit content containing PHI.

Can Descript's transcription or AI features process protected health information?

Descript’s transcription and AI features process uploaded media or project inputs, but its Terms of Service prohibit content containing PHI. Do not submit identifiable patient audio, video, or transcripts to those features under the publicly available terms. A BAA and a HIPAA-compliant workflow would be necessary where a vendor handles ePHI on behalf of a covered entity, but they would not override Descript’s stated prohibition without written contractual permission.

What patient consent is required before editing a testimonial video?

When a covered entity uses or discloses PHI for marketing, it generally needs a valid HIPAA authorization that describes the information, purpose, people or entities involved, recipient, and expiration or expiration event. For filming or recording where PHI is accessible, obtain the required written authorization before access or recording; blurring the patient afterward does not substitute for prior authorization in that situation. The authorization must not improperly be made a condition of treatment. See HHS authorization guidance and HHS media guidance.