Your law firm is a HIPAA business associate when it handles protected health information (PHI) to do work for a covered entity. In that role, HIPAA’s security and breach rules apply to your firm directly.
Covered entities include health plans and most hospitals and doctors. You also need a signed business associate agreement (BAA) before a client shares PHI with you.
At CMIT Solutions, we help law firms build the security controls behind HIPAA compliance for law firms. This guide covers when HIPAA applies, a BAA checklist, and a PHI-handling scenario for personal injury and health-litigation practices.
Explore our IT support for law firms to protect client records and build the security controls HIPAA expects.
When your firm counts as a HIPAA business associate
Your firm becomes a business associate once it creates, receives, stores, or sends PHI while doing legal work for a covered entity. That covers work like defending a hospital or advising a health plan. Who you work for matters more than what records you hold.
HHS lists legal services as a business associate function. Its business associate guidance gives an attorney who works for a health plan as an example.
Legal views differ when a firm represents an injured person instead of a covered entity. Some firms apply HIPAA-level safeguards to every health record anyway.
Common situations and what to do first
Use this table to see where your matters likely fall.
| Situation | Likely status | What to do first |
| Defending a hospital, clinic, or health plan in a claim, with records sent by that client | Likely a business associate | Sign a BAA before any PHI is shared |
| Representing an injured person and requesting their records with a signed authorization | Generally not a business associate | Still apply HIPAA-level safeguards to every record |
| Defending an auto, liability, or workers’ compensation insurer | Generally not a business associate on that basis alone | Confirm whether any covered entity is sending your firm PHI |
| Working as in-house counsel on a hospital’s own staff | Not a business associate | Follow your employer’s HIPAA policies |
This table is general information, not legal advice. We help law firms match the right safeguards to each type of matter.
Covered entities, business associates, and subcontractors: who is who
Each party in a matter fits one of three roles, and the role decides who must sign what.
- Covered entities: Health plans, clearinghouses, and health care providers that send health data electronically. They need written assurances from your firm, usually a BAA, before they share PHI with you.
- Business associates: People or companies that handle PHI while working for a covered entity, like legal, billing, or IT services.
- Subcontractors: Vendors that handle PHI for your firm, such as cloud storage, e-discovery hosting, and IT support providers. They are business associates too, and your firm needs a BAA with each one before sharing PHI.
We help your firm map every vendor that touches PHI and keep track of the agreements each one needs.
What counts as protected health information at your firm
Under HIPAA, protected health information is identifiable health data that a covered entity or business associate creates, receives, stores, or sends. It relates to a person’s condition, care, or payment. A law firm handles PHI under HIPAA only when it works as a business associate for a covered entity.
When a firm is a business associate, the PHI it holds most often includes:
- Medical records: Hospital, clinic, and specialist files with treatment histories tied to a named person.
- Billing and insurance records: Claims, payments, and coverage details connected to a person’s care.
- Tests and exams: Scans, test results, injury photos, and independent medical exam reports.
- Expert and demand materials: Medical expert reports and demand letters that quote health details.
We guide firms in finding where this PHI lives, so the right protections follow the data.
The HIPAA rules that apply to your firm
Congress passed HIPAA in 1996, and HHS built four rules on top of it. As a business associate, your firm must follow the parts that apply to it.
- Privacy Rule: Limits how PHI is used and shared, calls for the minimum necessary for each task, and gives people rights to access, amend, and get an accounting of disclosures of their records.
- Security Rule: Requires administrative, physical, and technical safeguards for electronic PHI.
- Breach Notification Rule: Requires a business associate to tell the covered entity about a breach of unsecured PHI. The notice is due without unreasonable delay and no later than 60 days after discovery, or sooner if the BAA sets a shorter deadline.
- Enforcement Rule: Covers investigations, civil money penalties, and hearings.
The 2009 HITECH Act and the 2013 Omnibus Rule extended these duties directly to business associates. That means your firm can face penalties on its own.
We guide your firm in turning each rule into everyday IT practices that run quietly in the background.
If your firm also supports defense contractors or handles controlled unclassified information, our CMMC compliance services can help you meet those requirements too.
BAA checklist: what a HIPAA business associate agreement must include
A business associate agreement is the written contract that lets a covered entity share PHI with your firm. HHS publishes sample BAA provisions you can adapt, and it notes they are samples, not a substitute for a lawyer’s review.
A compliant BAA should cover each of these ten points:
- Permitted uses and disclosures: State exactly how your firm may use PHI, tied to the services you provide.
- No other use or sharing: Bar any use or disclosure beyond what the contract or the law allows.
- Safeguards: Require appropriate protections, including Security Rule safeguards for electronic PHI.
- Reporting: Require your firm to report improper uses or disclosures, security incidents, and breaches of unsecured PHI. Consider a stricter reporting timeline than the legal maximum.
- Help with patient rights: Describe how your firm will help the covered entity respond to patient requests for records, corrections, and disclosure lists.
- Delegated Privacy Rule duties: If your firm takes on a covered entity’s Privacy Rule duty, the contract should require the same standards.
- HHS access to records: Agree to make your internal practices, books, and records available to HHS to check compliance.
- Return or destruction: Return or destroy all PHI when the work ends, if feasible.
- Subcontractor terms: Require any subcontractor that handles PHI to accept the same restrictions and conditions.
- Termination for violation: Let the covered entity end the contract if your firm breaks a material term.
Each clause also raises a practical question for your IT setup, so ask these before anyone signs.
| BAA clause | Question to ask your IT and records team |
| Safeguards | Can we encrypt, log, and control access on every system where this PHI will sit? |
| Reporting | Can we spot an incident fast enough to meet the contract’s reporting timeline? |
| Patient rights | Can we find and send a person’s records quickly if the covered entity asks? |
| Return or destruction | Can we find and fully delete every copy, including backups and email, when the matter ends? |
| HHS access | Do we keep the documentation HHS could ask to see? |
We guide law firms in turning each clause into settings and routines that work every day.
PHI-handling scenario: how health data moves through a personal injury matter
This walkthrough is illustrative, not a real matter or a CMIT client. It shows where PHI enters, moves, and leaves a firm, and where a single lapse can cause data loss or downtime.
A typical injury or health-litigation matter moves through six stages:
- Intake: A new client signs a records release and shares details by email and an online form.
- Record requests: The team asks hospitals and clinics for records, and files arrive by fax, portal, and large PDF.
- Case building: Paralegals and experts review records, then write summaries and demand letters.
- Sharing: Records go to experts, co-counsel, opposing counsel, and the court.
- Active storage: Files sit on firm systems and devices for months or years.
- Closing: The matter ends, and records are returned, kept under policy, or destroyed.
| Stage | Where PHI is exposed | Control that closes the gap |
| Intake | Unencrypted email and web forms | Secure intake portal and encrypted email |
| Record requests | Downloads saved to personal or shared folders | One approved storage location with restricted access |
| Case building | Copies on personal laptops and phones | Managed, encrypted devices and role-based access |
| Sharing | Attachments sent to the wrong person | Encrypted transfer, recipient checks, and minimum necessary sharing |
| Active storage | Shared logins and no record of who opened a file | Individual logins and access logging |
| Closing | Old drives, backups, and email threads | A closing checklist that follows the BAA’s return or destroy terms |
A lost laptop shows why these controls matter. If it holds PHI and was properly encrypted, HHS treats the PHI as secured, and breach notices may not be required, unless the key was compromised or the data was readable while the laptop was unlocked.
If it was not properly encrypted, the Breach Notification Rule presumes the loss is a breach. The firm can avoid notice only by documenting that an exception applies or that a risk assessment shows a low probability of compromise.
Proper encryption may remove the notification duty, but only if it meets HHS standards and the keys stay protected. We help firms lock down each hand-off point with encryption, access controls, and 24/7 monitoring through our managed services.
Additional reading: document management for law firms
Estimate what IT downtime could cost your firm with our IT downtime calculator.
The safeguards that keep PHI secure
The Security Rule sorts safeguards into three types: administrative, physical, and technical. Administrative means policies and training. Physical means protecting devices and facilities. Technical means controlling who can reach electronic PHI. The rule is scalable, so firms choose measures that fit their size and risk.
| Safeguard type | What the Security Rule requires | Practical controls for a firm |
| Administrative | Security management, assigned responsibility, workforce training, and contingency planning | Written PHI policies, regular training, and tested recovery from backups |
| Physical | Facility access limits, workstation security, and device and media controls, including final disposal | A restricted-access server area, privacy screens, a device inventory, and wiping drives before reuse |
| Technical | Access control, audit controls, protection against improper changes, authentication, and transmission security | Role-based access, activity logs, multi-factor authentication, and encryption in transit and at rest |
HHS has proposed changes to the Security Rule, and we advise firms on updates as they develop. Our security-first approach layers 24/7 monitoring, ransomware protection, and proactive threat detection around these requirements.
We add employee training and secure offsite backups for recovery.
HIPAA compliance checklist for your law firm
Use these eight steps to build a HIPAA program that fits your firm’s size and caseload:
- Confirm your role: Decide with your counsel whether each client matter makes your firm a business associate.
- Map where PHI lives: List every system, device, and vendor that stores or sends PHI.
- Complete a risk analysis: Assess the risks to electronic PHI, then record the measures you choose.
- Sign the right agreements: Put a BAA in place with each covered entity client and each vendor that handles PHI.
- Name a security lead: Assign one person to own your HIPAA policies and procedures.
- Write and train: Adopt written policies, train all staff, and set clear consequences for violations.
- Prepare for incidents: Plan how you will detect, report, and document incidents and restore data from backups.
- Review on a schedule: Recheck your risks and safeguards regularly and whenever your technology changes.
We guide law firms through each step, from mapping PHI to testing backups, so the program keeps working as your practice grows.
Additional reading: law firm compliance
Find out where your security stands today with a custom cybersecurity score built for your business.
What HIPAA noncompliance can cost your firm
HHS can impose civil money penalties on a business associate, and in some cases criminal penalties. These can follow from unauthorized uses or disclosures of PHI, or from failing to safeguard electronic PHI. The amount depends on how much fault HHS finds, and HHS adjusts amounts yearly for inflation.
A breach can also disrupt operations, hurt client trust, and create professional conduct concerns.
- No signed BAA: Handling PHI before the agreement is in place.
- No risk analysis: Skipping the required review of risks to electronic PHI.
- Weak device and media controls: Letting PHI sit on unmanaged laptops, phones, or drives, or reusing hardware without wiping it.
- Access that never ends: Leaving shared logins or former staff with access to client records.
- Late breach reporting: Missing the deadline to tell the covered entity.
We help firms close each of these gaps early, with layered protection and strategic guidance that keeps pace with new threats.
HIPAA security does not have to be complicated
We guide law firms through the IT side of HIPAA so your team can stay focused on clients and cases. We are locally owned and operated, with more than 25 years of experience, responsive local support that includes on-site help, and a nationwide network of over 900 IT experts.
We help you find where PHI lives, build layered, security-first protection around it, and advise you as a trusted technology partner so your firm can grow with confidence. Your own counsel advises on the law, and we guide the technology that supports it.
Our Optyx case study profiles an optical retail chain with 13 storefronts, in-house doctors, and a unified EMR system, where HIPAA compliance across all stores is a core need. We provide ongoing support and worked with their team to optimize internet service at every location, backup providers included, so critical systems stay reachable.
Call us at (800) 399-2648 or book a HIPAA security review to protect the health data your firm handles every day.
FAQs
Does HIPAA apply to paper records and spoken information at a law firm?
Yes, when the firm is a business associate. HIPAA’s Privacy Rule and Breach Notification Rule cover protected health information (PHI) in any form, including paper files and spoken words. The Security Rule covers only electronic PHI, but firms should still lock paper files and limit conversations about client health details.
Who can sign a records request for a minor, an incapacitated adult, or a deceased client under HIPAA?
A personal representative can sign, meaning someone with legal authority under state or other law to act for the client. That is usually a parent for a minor, a court-appointed guardian for an adult, or an executor for a deceased client. HIPAA protects records for 50 years after death.
Can a law firm get medical records with a subpoena and no patient authorization?
Sometimes. HIPAA lets a hospital release records without patient authorization if a court orders it, or if a subpoena comes with written assurances that the patient was notified and the time to object passed, or that a qualified protective order was sought. State laws may add stricter requirements.
Can a law firm use AI tools like ChatGPT to summarize medical records?
Yes, with safeguards. If a law firm acts as a HIPAA business associate, it needs a business associate agreement (BAA) with any AI vendor that handles protected health information. Firms that are not business associates may not need one under HIPAA, but confidentiality, contract, and professional conduct duties still apply.
How long must a law firm keep HIPAA policies and compliance records?
Six years. The HIPAA Security Rule requires business associates to keep required policies, procedures, and assessment records for six years from when each was created or last in effect, whichever is later. Client case files follow a separate schedule, so check your state bar rules and your agreements.
