Being HIPAA compliant means operating administrative, physical, and technical safeguards for electronic protected health information every day, not holding a certificate a vendor handed you at signup. That framework rests on a Security Rule finalized in 2003 and substantially updated in 2013, and it applies through your contracts, access controls, and incident response long after you buy software.
Most buying advice starts with the wrong question. Partners ask whether a tool is HIPAA compliant, see a badge on a pricing page, and treat the inquiry as closed. For a plaintiff firm, that shortcut is dangerous because your duties don't transfer to the vendor. You still decide who sees a record, how much of it they see, how long you keep it, and what happens when something goes wrong. That's the shared responsibility boundary this article keeps returning to.
Why Calling Something HIPAA Compliant Can Mislead You
Start by unlearning the shopping language. What is HIPAA compliant isn't a product category, because HIPAA doesn't certify software the way a seal certifies an appliance. The law sets duties for organizations that handle protected health information, or PHI, and those duties live in policies, contracts, training, and system settings you control as much as in any vendor's data center.
The image below maps that misconception and what should replace it.
HHS describes compliance as a regulatory framework rather than a single certification or technology label, with the Security Rule requiring safeguards that preserve confidentiality, integrity, and availability of electronic PHI, as set out in HHS guidance on the HIPAA Security Rule laws and regulations. Read those three words slowly. Confidentiality means unauthorized people can't get in. Integrity means the record hasn't been altered. Availability means your team can still reach it when a deposition or filing deadline arrives. Encryption helps with the first goal. It does not, by itself, deliver the other two.
Why the badge feels reassuring
Vendor marketing collapses a multi-year obligation into a checkbox because checkboxes sell. A firm under caseload pressure wants certainty, so "HIPAA compliant" reads like a warranty. It isn't. A vendor can offer encryption, access logging, and a signed agreement, and your firm can still create exposure by giving every staff member access to every matter, forwarding records to personal email, or keeping records indefinitely after a case closes.
Practical rule: Treat any compliance claim as the start of diligence, not the end of it. Ask what the vendor does, then ask what your firm must still do.
That distinction matters outside health care too. Owners in other regulated settings run into the same confusion between buying a tool and operating a program, which is why a guide for Houston business owners on compliance management can be useful background for separating software features from organizational accountability. For PI firms, the translation is simple. You don't purchase compliance. You operate it, matter by matter, user by user, and you need evidence that you did.
The Three Rules Every Firm Needs to Understand
Three rules do most of the work in daily practice. You don't need to memorize citations. You need to know which rule answers which question when a paralegal is holding a hospital portal download at 4 p.m.
The diagram below separates the three rules before we walk through them in workflow terms.
Privacy Rule and the question of use
The Privacy Rule asks who may use or disclose PHI and for what purpose. In a PI file, that shows up as the minimum necessary idea. A demand letter needs diagnoses, treatment, and causation facts that support damages. It rarely needs an unrelated decade of history, and an expert retained for orthopedic causation rarely needs unrelated behavioral health notes. Before your team shares anything, it should ask whether the recipient needs that slice of the record for the task at hand. If your staff is still fuzzy on what counts as PHI in the first place, start with what PHI means in healthcare records and train from real examples in your own files.
Security Rule and the question of protection
The Security Rule narrows to electronic PHI, or ePHI, and asks how you protect it. That's the rule behind unique logins, role based access, audit logs, secure transmission, backups, and workforce procedures. It also updated through the 2013 Omnibus Final Rule, which incorporated changes required by the Health Information Technology for Economic and Clinical Health Act. Think of it as the operating system for every portal, drive, and AI tool that touches a record.
This short video gives a plain language overview you can share with non lawyer staff before a training session.
Breach Notification Rule and the question of response
The Breach Notification Rule asks what you do after unsecured PHI is compromised. HHS explains that business associates must identify and respond to suspected incidents, mitigate harmful effects where practicable, and document incidents and outcomes under HHS breach notification guidance for professionals. The key word is unsecured. Properly encrypted data that an outsider cannot read presents a different notification question from readable records on a lost laptop. Your team shouldn't guess at that distinction during a crisis. It should follow a written process that names who investigates and who decides.
Who Has to Follow HIPAA in a PI Case
Roles drive duties, so map the cast before you argue about safeguards. Covered entities include health plans, health care clearinghouses, and qualifying health care providers that transmit information electronically in standardized transactions. The hospital that treated your client after a crash, the imaging center that billed the plan, and the insurer processing the claim sit in that category.
Business associates are different. They're the organizations that create, receive, maintain, or transmit PHI for a covered entity. A record retrieval company pulling charts from providers, a billing service handling claims data, or a cloud vendor storing ePHI for a clinic fits that definition. When that relationship exists, the parties generally need a written Business Associate Agreement, or BAA, specifying permitted uses and disclosures and requiring appropriate safeguards, as described in HHS guidance on business associate contracts.
Where a law firm fits
PI lawyers get confused, and the confusion is understandable. A firm receiving records under a client's authorization to pursue the client's own claim is not automatically acting the same way as a firm hired by a hospital to review records on the hospital's behalf. The question is function, not job title. Are you handling PHI for a covered entity or another business associate, or are you representing the individual whose records they are?
That answer changes your contracting and safeguard duties. It doesn't make careless handling acceptable in either scenario. Client confidentiality, state privacy law, court orders, and your own engagement terms still constrain you, and a client's trust doesn't survive a sloppy disclosure just because HIPAA technically pointed at someone else.
Consider two common setups:
- Client authorized review: Your client signs an authorization, a provider sends records, and your paralegal reviews them to build the claim. Focus on permitted scope, secure storage, and limited internal access.
- Work performed for a covered entity: A provider or insurer engages your firm and you handle PHI on its behalf. Expect business associate analysis, a BAA, and documented safeguards.
- Vendor processing for you: An AI summarization tool ingests records you control. Its status depends on the chain of relationships, so don't assume someone else already sorted the paperwork.
Subcontractors extend the chain. If your vendor uses another company to host, transcribe, or process records, that downstream company may also handle PHI for a business associate. Ask for the full chain in writing. A gap two layers down is still a gap in your client's file.
How Safeguards Show Up in a Real Case File
Follow one rear end collision file from intake to demand and the safeguard categories stop sounding abstract. Your intake specialist collects authorizations, a provider portal releases emergency department notes and imaging, and your paralegal uploads several hundred pages for chronology review. Every hand off in that sequence is a control point.
The flowchart below tags each step in that journey.
Administrative safeguards are the management decisions. Who is assigned to this matter, who approved access, what training did they complete, and what happens when a paralegal leaves the firm on Friday? In practice, that means a documented risk analysis, named responsibility for security decisions, workforce clearance procedures, and periodic review of who still needs access. If a departed employee's login works on Monday, your administrative safeguards failed no matter how strong your encryption is.
Physical safeguards cover the places and devices where records live. Locked file rooms still matter for paper, but so do workstation rules for the hybrid paralegal reviewing records at home. Can a family member see that screen? Is the laptop encrypted and inventoried? Are old drives wiped before disposal instead of tossed in an office move? These aren't glamorous questions. They're the ones investigators ask.
Technical safeguards in the tools you already use
Technical safeguards are the system level protections your vendors and IT team configure. A credible setup combines encryption in transit and at rest with least privilege role based access, strong authentication, tenant isolation, secure deletion, backups, vulnerability management, and continuous audit review. For a concrete sense of how legal technology vendors describe those controls, compare your current stack against examples of how protects case data in a matter focused system, then ask your own providers for the same specifics.
Watch the demand drafting step closely. An attorney pulls only the treatment facts needed for the letter, an AI tool generates a chronology, and the audit log should show who uploaded the source records, who viewed the summary, and who exported it. When records go to a retained expert, they should travel through a secure portal with an expiration, not as an unprotected email attachment. If a control is missing at any step, name the gap in writing and assign an owner and a date. Undocumented good intentions don't survive scrutiny.
Why a Vendor Saying HIPAA Compliant Is Not the Whole Story
Now confront the myth directly. A vendor's security page can be accurate and still leave your firm exposed, because compliance depends on legal roles, permitted uses, contracts, and operating practices, not features alone. HHS states that using a cloud service provider to maintain or process ePHI without a BAA violates the HIPAA Rules, even when the provider offers security controls, in HHS answers on business associates and cloud services. HHS also identifies AI vendors handling patient portal PHI as potential business associates. An AI badge doesn't answer the BAA question. The contract does.
The checklist image below frames the gap and the verification steps.
What a BAA does and doesn't do
A BAA allocates responsibilities. It defines permitted uses, requires safeguards, restricts independent use of the information, and sets breach reporting duties. It doesn't absolve your firm. You still control user permissions, minimum necessary sharing, retention, and whether staff paste PHI into tools that were never approved. Think of the BAA as a fence line, not a force field.
A signed BAA with weak internal practices is paperwork over an open door. Regulators and clients will look at both.
Run this diligence before any system touches client records. A structured vendor security assessment for law firm tools helps you keep the questions consistent across vendors instead of improvising each sales call.
- Inventory every system receiving PHI: Include email, e fax, transcription, record retrieval, cloud storage, and AI summarization, not just your case management platform.
- Confirm BAAs and subcontractor coverage: Get signed copies, check dates, and ask who else hosts or processes the data downstream.
- Define model training use in writing: PHI shouldn't be reused for unrelated model training unless expressly authorized. Silence isn't consent.
- Set deletion and export rules: Know how you retrieve your data at exit and how the vendor proves deletion afterward.
- Verify auditability: You should be able to see ingestion, access, generation, and export events without begging support for logs.
Transcription is a useful test case because firms often adopt it casually. Dictated case notes can contain diagnoses and treatment plans, so reviewing a secure medical transcription guide before rollout forces the right questions about retention, access, and subcontractors. Apply that same skepticism to every AI feature your existing vendors switch on. A new summarize button inside a familiar tool can create a new data flow your old BAA never contemplated.
What Happens When Compliance Fails
Controls fail at well run organizations, so maturity shows in response quality. The obligations depend on whether PHI was unsecured, how many people were affected, and who held the data when the incident occurred. Your playbook should answer those questions under pressure, not improvise them.
The scale isn't theoretical. HHS recorded 663 notifications involving breaches affecting at least 500 individuals in its 2024 report, a 9% decrease from 2023, and the 2025 healthcare breach report identified 128 incidents reported by business associates, figures summarized through HHS breach reporting resources. Vendor side events routinely become client facing problems for the firms and providers connected to them.
HIPAA Breach Notification Timelines at a Glance
| Incident Scope | Who Must Notify | Deadline | Recipient |
|---|---|---|---|
| Breach of unsecured PHI affecting 500 or more individuals | Covered entity, with business associate notifying the covered entity first | Without unreasonable delay and no later than 60 calendar days after discovery | HHS, affected individuals, and sometimes media |
| Breach affecting fewer than 500 individuals | Covered entity | Within 60 days after the end of the calendar year of discovery | HHS |
| Suspected security incident at a business associate | Business associate | Without unreasonable delay under its incident duties and contract terms | Covered entity |
Contracts often shorten those windows, so read your BAAs before an incident. A vendor that waits the full statutory period may leave you no time to investigate, notify clients, or meet court obligations. For a deeper walkthrough of sequencing, see data breach notification requirements for firms handling PHI and compare it against your current vendor terms.
For PI practices, the damage extends past notification letters. An incident can freeze access to records before a mediation, corrupt source files behind an AI generated summary, or raise chain of custody questions about what changed and when. Your response plan should preserve evidence, protect immutable audit logs, test backups, and decide whether summaries must be regenerated from clean source files. Name decision makers now, including who calls forensic help, who talks to clients, and who handles active claim deadlines while systems are down. Speed matters, but documented, defensible speed matters more.
A Practical Compliance Checklist for Your Firm
You can run this checklist this week without hiring anyone. Pull your vendor list, your BAAs, and one recently closed file, then work down the list and write down gaps instead of debating them from memory.
- Inventory your systems: List every tool that receives, stores, or transmits medical records, including personal workarounds staff admit to using.
- Review every BAA: Confirm signatures, permitted uses, subcontractor coverage, breach notice timeframes, and termination and deletion language.
- Audit access permissions: Remove former employees, narrow matter access to assigned team members, and require strong authentication everywhere.
- Check retention and deletion: Define how long records and AI outputs stay after a case closes, then verify your systems enforce it.
- Ask the training question: Get a written answer from each AI vendor on whether your PHI trains models for anyone else.
- Test your incident playbook: Name decision makers, confirm backup restoration works, and rehearse who notifies whom.
- Inspect audit logging: Pick one file and reconstruct who uploaded, viewed, summarized, and exported it from logs alone.
If you can't reconstruct that last file's journey, you've found your first project. Fix logging and access before you shop for new tools, because new tools layered on weak governance just move faster in the wrong direction.
Treat the checklist as a recurring calendar item, not a one time cleanup. Vendors add features, staff turn over, and new matter types bring new record flows. What is HIPAA compliant for your firm, in the end, is whatever you can demonstrate with contracts, settings, logs, and trained people on the day someone asks. Build that evidence as you work, and the answer takes care of itself.
If your team is reviewing medical records and drafting demands by hand, Ares offers an AI powered platform built for personal injury firms that organizes records into case ready summaries and demand drafts within a HIPAA compliant environment with BAAs and enterprise grade security controls. Visit Ares to see how structured chronologies and audit friendly workflows can fit the diligence framework you've just built, and bring your checklist questions to the conversation.
