Monday morning, a paralegal downloads 80 pages of treatment notes from a client portal, sends the packet to an adjuster, and then notices another client's records are sitting in the file. The mistake isn't theoretical. A personal injury firm may collect records from multiple providers, route them through outside vendors, summarize them with AI, store them in cloud systems, and attach them to demand-letter workflows before anyone checks whether the right information went to the right recipient.
That's why learning how to be HIPAA compliant as a PI firm requires more than adopting a privacy policy or collecting a business associate agreement. Your firm needs an operating program that controls who can access medical records, how vendors handle them, how staff transmit them, and what happens when something goes wrong. The roadmap below focuses on the work a managing partner can assign this quarter, including safeguards, risk analysis, vendor diligence, training, audit logging, breach response, and a practical 90-day implementation plan.
Why HIPAA Compliance Matters More for PI Firms in 2026
Personal injury firms often handle PHI at a scale and speed that creates unusual exposure. Intake teams request records from several providers, case managers download and rename files, attorneys review treatment histories, and demand packages move between the firm, clients, medical providers, insurers, co-counsel, and litigation vendors. Each handoff creates an opportunity for misdelivery, unauthorized access, incomplete deletion, or an undocumented workaround.
The regulatory consequences are substantial. HHS says that, since enforcement of the HIPAA Privacy Rule began for most covered entities on April 14, 2003, its Office for Civil Rights has received over 374,321 HIPAA complaints and initiated over 1,193 compliance reviews. OCR has settled or imposed civil money penalties in 152 cases totaling $144,878,972. Those figures show why a firm should treat PHI governance as an executive responsibility, not a task delegated entirely to a busy paralegal. HHS enforcement highlights provides the federal figures.
A failure can also affect the underlying case. If the firm cannot establish that records were obtained, stored, and disclosed through a controlled process, opposing counsel may challenge the reliability or handling of the materials. A privacy incident can trigger client dissatisfaction, insurer scrutiny, professional-liability concerns, and a difficult explanation to the managing partner.
Managing partner rule: Treat every medical-record workflow as a controlled information system, even when the work happens inside an ordinary email thread.
Start by mapping where PHI enters the firm and where it leaves. Include intake forms, provider portals, copier storage, laptops, shared drives, case-management software, AI tools, cloud fax services, demand-letter platforms, and backup systems. For paper devices and retired hardware, a master NIST data sanitization resource can help your team define a defensible disposal process. The rest of the program should connect those assets to assigned safeguards, written evidence, and recurring review.
What OCR's 2025 Enforcement Push Means for Your Firm
The central lesson from the 2025 enforcement picture is straightforward: OCR wants organizations to prove that they understood their risks and acted on them. The 2025 tally described in the available enforcement analysis found that 76% of enforcement actions included a penalty for a risk-analysis failure. The same enforcement pattern also cited access controls, monitoring, breach notification, and timely access issues. HIPAA Journal's 2025 enforcement analysis explains that risk analysis failures dominated the cited actions.
For a PI firm, that focus maps directly onto ordinary operations. A staff member may email a demand package without verifying the recipient. A case manager may upload charts to a consumer-grade cloud folder. An attorney may paste treatment notes into an AI application without confirming how prompts, files, or model outputs are retained. Each practice creates a risk that should appear in the firm's analysis, along with an owner, a mitigation, and evidence that the mitigation operates.
The enforcement framework also creates direct financial exposure. The 2025 penalty structure uses tiers based on the organization's level of culpability, and the HITECH amendment cycle affects the applicable maximums. Because the supplied verified data does not establish the individual tier amounts or annual caps listed in the proposed comparison, the firm shouldn't rely on unverified figures in an internal compliance presentation.
2025 HIPAA Penalty Tiers at a Glance
| Tier | Culpability | Min per Violation | Max per Violation | Annual Cap |
|---|---|---|---|---|
| Tier 1 | Unknown to the firm, with reasonable prevention expected | Verify current amount | Verify current amount | Verify current amount |
| Tier 2 | Reasonable cause, not willful neglect | Verify current amount | Verify current amount | Verify current amount |
| Tier 3 | Willful neglect, corrected within the required period | Verify current amount | Verify current amount | Verify current amount |
| Tier 4 | Willful neglect, not corrected | Verify current amount | Verify current amount | Verify current amount |
The responsible move is not to memorize a penalty table. It's to create a risk-analysis file that demonstrates active governance. HHS describes a practical cycle that includes defining scope, gathering data, identifying threats and vulnerabilities, assessing safeguards, estimating likelihood and impact, calculating risk, selecting security measures, and reassessing controls as the environment changes. HHS risk-analysis guidance should anchor the firm's methodology.
Safeguards Mapped to a Personal Injury Workflow
HIPAA's Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards for ePHI. NIST SP 800-66 Rev. 2 connects those requirements to practical control families, including access control, authentication, audit logging, integrity protection, transmission security, and contingency planning. HHS Security Rule guidance gives the legal framework. Your job is to assign each safeguard to a real step in the case lifecycle.
Administrative safeguards
At intake, establish written workforce-security rules. Define who may request records, who can download them, who approves outside disclosures, and what staff must do when a recipient address looks wrong. The policy should include sanctions for misdirected records and a documented escalation path, not just a general statement that employees should “protect privacy.”
For records review, assign access by job function. Intake staff may need to upload a client's authorization and track requests, while a case manager may need the treatment chronology but not every matter in the firm. Set a contingency plan for a ransomware event or unavailable case-management system. That plan should identify alternate communication channels, recovery priorities, decision-makers, and the procedure for preserving case deadlines.
Physical safeguards
Paper charts still create risk. Store them in a restricted room, use clean-desk rules, and prohibit unattended records in conference rooms, printers, vehicles, and deposition bags. Laptops used at depositions or medical examinations should use device encryption and strong authentication, and staff should report loss immediately.
Technical safeguards
Configure unique user IDs in the case-management platform. Use role-based permissions, automatic logoff, encryption in transit and at rest, and audit logs that show who accessed, changed, downloaded, or shared a record. Protect credentials used for provider portals with multifactor authentication where available, and use a secure email method when transmitting records to co-counsel, insurers, or demand recipients.
A documented workflow can prevent staff from improvising. Resources such as HIPAA-compliant document management guidance can help your operations team compare the controls in its current platform with the controls the workflow requires.
Running a Defensible Risk Analysis and Risk Management Cycle
A risk analysis becomes useful when it produces an evidence file someone else can understand. Don't submit a one-page statement that says the firm has “low risk.” Build a register that shows what you reviewed, which threats you considered, how you rated them, what you changed, and who owns the remaining work.
Build the analysis in four phases
Phase one, inventory. List every application, device, vendor, portal, storage location, workflow, and backup that creates, receives, maintains, or transmits PHI. Include case-management software, shared drives, copier hard drives, cloud fax, e-signature tools, records retrieval vendors, AI redaction or summarization platforms, email, laptops, removable media, and paper files.
Phase two, assess threats. Write scenarios in PI-firm language. Examples include a demand package sent to the wrong adjuster, a stolen paralegal laptop, a former employee retaining access, a compromised intake portal, an AI vendor using uploaded records outside the agreed purpose, or a bulk export from a shared folder.
Phase three, score risk. Rate likelihood and impact using a consistent method. Explain why the firm selected each rating, identify affected systems and records, and distinguish existing safeguards from proposed safeguards. A threat register without rationale won't show how the firm made its decisions.
Phase four, remediate. Tie every high-priority risk to a corrective action, owner, due date, status, and evidence. Corrective actions might include changing permissions, replacing a shared account, enabling logging, revising a vendor agreement, encrypting storage, or training a specific team.
Preserve the proof
Keep the inventory export, interview notes, scoring criteria, threat catalog, remediation register, control decisions, signed executive summary, and follow-up review. The artifact matters because OCR evaluates whether the organization conducted and acted on a meaningful analysis, not whether someone claims a review occurred.
The 2025 enforcement pattern makes incomplete documentation especially dangerous. Common gaps include assets omitted from the inventory, no threat catalog for ordinary workflows, no remediation timeline, and no evidence that leadership reviewed unresolved risks. Finish the analysis, then run risk management as a continuing cycle. Monitor controls, close assigned actions, and reassess after a new system, vendor, workflow, incident, or material operational change.
Business Associate Agreements and AI Vendor Diligence
A business associate agreement is not boilerplate to file after procurement. It defines how a vendor may handle PHI, what safeguards the vendor must maintain, how incidents move back to the firm, and what happens when the relationship ends.
Before a vendor receives PHI, identify whether it creates, receives, maintains, or transmits PHI on the firm's behalf. That analysis can apply to medical-record retrieval companies, transcription services, cloud fax providers, e-signature platforms, document-management systems, and AI tools that process treatment records. Obtain the signed BAA before uploading data, and record the agreement in a vendor inventory with renewal and review dates.
Review the agreement line by line
Confirm that the BAA addresses:
- Required safeguards: The vendor's administrative, physical, and technical commitments should be specific enough to compare with the firm's risk analysis.
- Breach reporting: The agreement should establish a workable process for notice, cooperation, evidence preservation, and investigation.
- Subcontractors: Require appropriate obligations to flow down to vendors and sub-processors that touch PHI.
- Termination: Specify data return, deletion, retention limits, and assistance with transition or incident response.
- Verification: Seek usable assurance, such as security documentation, audit rights, or independent reports, rather than accepting a general marketing statement.
Use a structured vendor security assessment for every material provider. Ask who can access the data, how access is approved, how credentials are removed, and how the vendor detects and investigates unusual activity.
Add AI-specific questions
An AI vendor deserves a deeper review because the firm may not see how uploaded records move through the service. Ask:
- Where are files and derived outputs stored and processed?
- Are prompts, documents, or generated summaries used to improve a model?
- What retention period applies, and can the firm request deletion?
- Which sub-processors handle the data?
- Does the vendor maintain independent security reports, such as SOC 2 or HITRUST documentation?
- Has the vendor experienced a breach or security incident, and how would it notify the firm?
- How does the platform enforce user permissions, logging, encryption, and tenant separation?
- What does “de-identification” mean in the product, and what data remains identifiable?
A BAA alone doesn't make a vendor safe. Re-review the vendor inventory at least annually and whenever a provider changes its data practices, sub-processors, product architecture, or AI training terms.
Training, Access Controls, and Audit Logging That Actually Stick
Annual slide decks create a record of attendance. They rarely create dependable behavior. A PI firm needs a year-round program that reflects the messages and mistakes staff encounter during records intake, review, and demand preparation.
Train for the work people perform
Give intake personnel instruction on portal downloads, client authorizations, file naming, recipient verification, and escalation. Give paralegals practical examples involving misdirected attachments, fake medical-record portals, suspicious referral messages, and unauthorized cloud sharing. Give attorneys guidance on approved AI tools, prompt handling, demand-package review, and disclosure decisions.
Deliver role-based modules at hire and on a recurring schedule. Run phishing exercises that resemble the firm's actual email patterns, then document each employee's completion date, assessment result, and attestation. Training records should show who completed what, rather than merely stating that the firm held a presentation.
Remove access when work changes
Use least-privilege access so a paralegal sees assigned matters instead of the entire client database. Build access changes into the personnel process. When someone changes roles or leaves, remove access promptly, recover devices, disable portal credentials, and review recent activity.
Perform periodic user-access reviews with a manager's signature. The review should identify the account, role, systems, permission level, reviewer, date, and required correction. A spreadsheet is acceptable if it's complete and maintained.
Review the evidence
Enable audit logging in the case-management system, cloud storage, provider portals, and other systems that expose PHI. Send logs to a security-information and event-management platform when practical. If the firm doesn't have one, preserve logs in a protected, tamper-resistant location and review them for unusual activity, including after-hours access, repeated failed logins, unexpected downloads, and bulk exports.
Keep three artifacts ready for inspection: the training roster, the access-review record, and the log-review memo. Data access controls guidance can help your technology lead translate least privilege and review obligations into system settings.
Breach Response, Notification, and Documentation
A suspected PHI incident is an investigation, not an email cleanup exercise. The first person who notices a problem should know how to stop further exposure and reach the incident lead without waiting for a committee meeting.
Contain the event immediately
Stop unauthorized access, revoke exposed credentials, isolate a compromised device, and prevent additional messages or downloads. Preserve the affected laptop, phone, email account, portal records, and logs. Don't delete the original message or wipe the device before the investigation team has preserved the evidence.
Record the basics while they're fresh:
- Discovery: Who found the incident, when, and how?
- Systems: Which email account, portal, drive, device, or vendor was involved?
- Records: What PHI may have been exposed, and whose information was included?
- Recipients: Who received, accessed, or may have acquired the information?
- Actions: What did the firm do to contain, investigate, recover, and prevent recurrence?
- Decisions: Who approved the notification determination, and what evidence supported it?
Assess whether notification is required
The firm should assess the nature and extent of the PHI, the unauthorized person or recipient, whether the information was acquired or viewed, and the degree to which the risk was mitigated. Don't label an event harmless because the recipient says they deleted an email. Obtain evidence, document the inquiry, and involve qualified privacy counsel when the facts or legal analysis are uncertain.
If the event meets the applicable breach standard, notify affected individuals without unreasonable delay and no later than 60 days after discovery. The firm must also evaluate reporting to HHS and, when required, the media. The Breach Notification Rule should guide the legal team's assessment and reporting process.
Do not wait for perfect information before beginning the investigation. Set an internal decision schedule, identify missing facts, and update the record as evidence arrives. Documentation should include the risk assessment, notification decision, dates, recipients, copies of notices, delivery evidence, agency filings, and remediation.
Incident lead instruction: Contain first, preserve evidence second, determine scope third, and document every decision as the facts develop.
A short tabletop exercise will expose gaps faster than another policy rewrite. Schedule a 45-minute session around three scenarios: a compromised intake portal, medical records emailed to the wrong address, and a lost laptop. Assign one incident lead, a technology contact, a managing-partner decision-maker, and a communications owner. Discuss who can revoke access, who contacts the vendor, who preserves logs, who evaluates notification, and who communicates with the client.
For questions about assigning responsibility during an incident, firms can consult guidance on who calls legal in a breach. The firm still needs its own written escalation tree, because a vendor's response plan won't identify your client relationship, case deadlines, or professional obligations.
This video can supplement a tabletop discussion, but it shouldn't replace a firm-specific exercise.
Execute the first 90 days
Days 1 through 30: Appoint a privacy lead and inventory where PHI enters, moves, and leaves the firm. Map intake, provider portals, records review, demand-letter preparation, email, devices, backups, and vendors. Confirm that each vendor handling PHI has a signed BAA, then assign an owner to every identified gap.
Days 31 through 60: Complete the risk analysis and risk register. Rank threats by likelihood and impact, document safeguards, revise policies, and address high-risk issues such as shared accounts, unencrypted storage, missing access reviews, incomplete logs, or unapproved AI tools. Run the breach tabletop and test the decision process for the 60-day notification requirement.
Days 61 through 90: Deliver role-based training, configure session timeouts, conduct access reviews, confirm backup restoration, verify disposal procedures, and collect current vendor assurance. Give the managing partner a concise package containing the risk register, remediation timeline, training report, and tabletop findings.
Repeat the analysis at least annually and whenever the firm adopts a new system, materially changes a workflow, or experiences an incident. Compliance isn't perfect paperwork. It's an operating program that reduces avoidable exposure and gives the firm evidence of reasonable, deliberate action.
Ares offers PI firms a HIPAA-compliant platform for organizing medical records and producing structured case insights and demand-letter drafts, with controls that include business associate agreements, encryption, role-based access, and audit logging. Visit Ares to evaluate whether its medical-record workflow fits your firm's 90-day compliance and operations plan.
