HIPAA Compliance for Medical Record Review: What Legal Professionals Need to Know

By John Mahoney · April 2026 · 14 min read

Every medical malpractice case, personal injury claim, and workers' compensation dispute involves medical records. Those records contain protected health information — PHI — and the moment they land on your desk, you have legal obligations under HIPAA that carry real penalties if you get them wrong.

Most attorneys, paralegals, and legal nurse consultants understand that medical records are sensitive. Far fewer understand the specific HIPAA requirements that govern how they receive, store, share, and eventually destroy those records during the course of litigation. The consequences of noncompliance are not theoretical. The Office for Civil Rights has imposed penalties ranging from $100 per violation up to $2.07 million per violation category per year, with criminal penalties including prison time for willful misuse.

This guide covers what legal professionals need to know about HIPAA compliance when reviewing medical records for litigation — from the initial records request through case resolution and beyond.

Does HIPAA Apply to Law Firms and Legal Professionals?

This is the first question most legal professionals ask, and the answer is more nuanced than a simple yes or no. HIPAA directly regulates two categories of entities: covered entities (healthcare providers, health plans, and healthcare clearinghouses) and business associates (organizations that handle PHI on behalf of covered entities).

Law firms are generally not covered entities. However, a law firm becomes a business associate when it performs services for a covered entity that involve access to PHI. If your firm represents a hospital, physician practice, or health plan and accesses patient records as part of that representation, you are a business associate and must comply with the HIPAA Security Rule and Privacy Rule.

Plaintiff firms and independent LNCs

Plaintiff medical malpractice firms and independent legal nurse consultants typically receive medical records through authorized disclosures — the patient (your client) signs an authorization allowing the release of their records for litigation purposes. In this scenario, you are not technically a business associate of the healthcare provider. However, you still have significant obligations.

First, many state bar ethics rules impose confidentiality requirements that parallel HIPAA protections. Second, if records are obtained through court order or subpoena rather than patient authorization, additional rules apply under the HIPAA Privacy Rule at 45 CFR 164.512(e). Third, if you use any third-party service to process, store, or analyze those records — including cloud storage, AI tools, or outsourced review services — those vendors may need a Business Associate Agreement with you or with the original covered entity.

The practical reality

Regardless of whether HIPAA technically applies to your specific situation, treating all medical records as if they are subject to HIPAA protections is the safest approach. Doing so protects you from state law violations, ethical complaints, malpractice claims, and the reputational damage that comes from a data breach involving patient health information. Every recommendation in this guide reflects that standard.

Understanding Protected Health Information in Litigation

PHI is any information that relates to an individual's health condition, healthcare treatment, or payment for healthcare that can be linked to a specific person. In the context of medical record review for litigation, PHI includes virtually everything in the records you receive.

The 18 HIPAA identifiers

HIPAA identifies 18 specific data elements that make health information individually identifiable:

1. Names
2. Geographic data smaller than a state
3. Dates (except year) related to an individual
4. Phone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate or license numbers
12. Vehicle identifiers and serial numbers
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers
17. Full-face photographs
18. Any other unique identifying number or code

Medical records contain most of these identifiers. Patient names, dates of birth, medical record numbers, Social Security numbers, addresses, and phone numbers appear on virtually every page. This means the entire record — not just specific pages — constitutes PHI and must be handled accordingly.

The minimum necessary standard

HIPAA's minimum necessary standard requires that when you use or disclose PHI, you limit the information to the minimum amount necessary to accomplish the intended purpose. In litigation, this means you should request only the records relevant to the case, limit internal access to those records to staff who need them for case work, and avoid sharing complete medical histories when only specific treatment periods are at issue.

For plaintiff attorneys, this standard is somewhat relaxed when the patient has provided a broad authorization. But it becomes critically important when responding to discovery requests, sharing records with expert witnesses, or providing records to co-counsel. Over-disclosing PHI creates unnecessary risk.

Business Associate Agreements: When You Need One

A Business Associate Agreement is a contract required by HIPAA whenever a covered entity shares PHI with a third party that will handle that information on the covered entity's behalf. The BAA establishes what the business associate can and cannot do with the PHI, requires the business associate to implement appropriate safeguards, and creates liability for the business associate if they fail to protect the information.

When law firms need BAAs

You need a BAA in place with any vendor or service provider that will access, process, store, or transmit PHI from your cases. Common examples include:

• Cloud storage services — if you store medical records in Dropbox, Google Drive, OneDrive, or any cloud platform, you need a BAA with that provider
• AI and technology tools — any software that processes medical records must have a BAA in place before you upload a single page
• Copying and scanning services — if you send physical records to a vendor for scanning or copying, they need a BAA
• IT service providers — your managed IT provider, if they have access to systems containing medical records, should have a BAA
• Expert witnesses and consultants — when you share records with medical experts for case review, consider whether a BAA or confidentiality agreement is appropriate
• Outsourced review services — any records review, coding, or summarization service you use needs a BAA

What a BAA should contain

A compliant BAA must include: a description of the permitted uses and disclosures of PHI, a requirement that the business associate implement appropriate safeguards, a requirement to report any unauthorized use or disclosure (including breaches), a requirement to make PHI available for individual access requests, a requirement to return or destroy PHI at the end of the relationship, and authorization for the covered entity to terminate the agreement if the business associate violates its terms.

Red flags in vendor selection

If a technology vendor that will process medical records cannot or will not provide a BAA, do not use that vendor. Period. This applies to AI tools, cloud storage, transcription services, and any other technology that will touch PHI. A vendor that claims HIPAA compliance but will not sign a BAA is not actually HIPAA compliant. The BAA is not optional — it is a regulatory requirement.

Physical and Technical Safeguards for Medical Records

HIPAA requires three categories of safeguards: administrative, physical, and technical. For legal professionals reviewing medical records, the most relevant requirements fall into the physical and technical categories.

Physical safeguards

Physical paper records must be stored in locked file cabinets or secure rooms with access limited to authorized personnel. Workstations where records are viewed should be positioned so screens are not visible to unauthorized persons. Records should never be left unattended on desks, in conference rooms, or in vehicles. When physical records are transported, they should be in sealed, opaque containers. And when records are no longer needed, they must be disposed of through cross-cut shredding or a certified destruction service.

Technical safeguards for electronic records

Electronic PHI (ePHI) requires more extensive protections:

• Encryption in transit — all electronic transmission of medical records must use encryption. This means TLS 1.2 or higher for web-based transfers and encrypted email (not standard email) for sending records
• Encryption at rest — stored records must be encrypted on your devices and servers. AES-256 is the current standard
• Access controls — each person who accesses electronic medical records should have a unique user ID. Shared logins violate HIPAA
• Audit controls — you must be able to track who accessed medical records, when, and what they did. This means logging and audit trail capabilities on any system that stores PHI
• Automatic logoff — systems containing PHI should automatically lock after a period of inactivity
• Device security — laptops, tablets, and phones that access medical records must have full-disk encryption, strong passwords or biometric authentication, and remote wipe capability

Email and file sharing

Standard email is not HIPAA compliant for sending medical records. Unencrypted email transmits data in plain text across multiple servers, any of which could be compromised. If you must send medical records electronically, use encrypted email services, secure file sharing platforms with BAAs, or encrypted client portals. Never send medical records as unencrypted email attachments, even to your own client.

Using AI Tools for Medical Record Review: HIPAA Considerations

AI-powered medical record review tools are becoming essential for efficient case management. However, not all AI tools are created equal when it comes to HIPAA compliance. Before you upload a single page of medical records to any AI platform, verify the following.

Data processing and storage

Understand where your data goes when you upload it. Does the platform process records on US-based servers? Is data encrypted both in transit and at rest? Are records stored temporarily for processing or retained indefinitely? Can you delete your data at any time? These are not optional considerations — they are regulatory requirements.

Model training policies

This is a critical and often overlooked issue. Many AI platforms use uploaded data to train and improve their models. If your client's medical records are being used to train an AI model, that information is being retained, processed, and potentially incorporated into the model's outputs for other users. This is a clear HIPAA violation if done without proper authorization. Verify in writing that the vendor does not use uploaded medical records for model training, fine-tuning, or any purpose other than providing the service you are paying for.

Subprocessor transparency

AI platforms often use subprocessors — third-party services for computing, storage, or specific processing tasks. Each subprocessor that touches PHI must also be HIPAA compliant and covered by appropriate agreements. Ask your vendor for a list of subprocessors and verify their compliance status.

The consumer AI trap

Consumer AI tools like general-purpose chatbots are not HIPAA compliant and must never be used to process medical records. Do not paste medical record contents into ChatGPT, Google Gemini, or any consumer AI platform. Do not upload medical records to any platform that does not have a signed BAA. The convenience is not worth the regulatory risk. Purpose-built medical-legal AI platforms with proper compliance infrastructure are the only appropriate option.

Breach Notification Requirements

Despite best efforts, breaches happen. A breach under HIPAA is any unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of that information. If your firm experiences a breach involving medical records, you have specific notification obligations.

What constitutes a breach

Common breach scenarios in legal settings include: a laptop containing unencrypted medical records is stolen, medical records are sent to the wrong recipient via email, a staff member accesses records for a case they are not assigned to, a cloud storage account containing records is compromised, physical records are lost during transport, and records are left in an unsecured location accessible to unauthorized persons.

Notification timeline

HIPAA requires notification of affected individuals without unreasonable delay and no later than 60 days after discovery of the breach. If the breach affects 500 or more individuals, you must also notify the HHS Secretary and prominent media outlets serving the affected area. For breaches affecting fewer than 500 individuals, you must log the breach and report it to HHS annually.

Risk assessment

Not every unauthorized disclosure is a reportable breach. HIPAA allows a risk assessment considering four factors: the nature and extent of PHI involved, who gained unauthorized access, whether the PHI was actually viewed or acquired, and the extent to which risk has been mitigated. If you can demonstrate a low probability that the PHI was compromised, notification may not be required. Document this risk assessment thoroughly.

State breach notification laws

Most states have their own breach notification requirements that may be more stringent than HIPAA. Some states require notification within 30 days rather than 60. Others have broader definitions of what constitutes a breach. You must comply with both HIPAA and the applicable state law, whichever is more protective.

HIPAA Compliance Checklist for Legal Professionals

Use this checklist to evaluate your current compliance posture when handling medical records for litigation.

Common HIPAA Mistakes in Legal Settings

Understanding where firms most frequently fall short helps you identify and correct vulnerabilities in your own practice.

Sending records via unencrypted email

This remains the most common violation. Attorneys and staff routinely email medical records as PDF attachments using standard email, which transmits data without encryption. Every one of those emails is a potential HIPAA violation. Implement encrypted email or a secure client portal and enforce its use for all communications containing medical records.

Using consumer cloud storage without a BAA

Free tiers of Dropbox, Google Drive, and similar services do not come with BAAs. If you are storing medical records in consumer cloud storage, you are likely out of compliance. Upgrade to a business tier that includes a BAA, or use a HIPAA-compliant document management system.

No training for staff who handle records

HIPAA requires training for all workforce members who handle PHI. In a law firm, this includes attorneys, paralegals, legal assistants, IT staff, and anyone else who might access medical records. Training should cover what PHI is, how to handle it, what to do if a breach is suspected, and the firm's specific policies. Training should be conducted annually and documented.

Inadequate disposal procedures

When a case is resolved and records are no longer needed, they must be properly destroyed. Paper records require cross-cut shredding. Electronic records require secure deletion that prevents recovery. Simply deleting a file or throwing paper records in the trash is not compliant disposal.

Overlooking remote work vulnerabilities

Remote work has created new compliance challenges. Staff accessing medical records from home networks, personal devices, and shared workspaces introduce risks that did not exist in a traditional office setting. Ensure your remote work policies address: VPN requirements for accessing firm systems, prohibition on storing PHI on personal devices without encryption, secure home office requirements, and procedures for working with records in shared or public spaces.

HIPAA Penalties and Enforcement

HIPAA penalties are structured in four tiers based on the level of culpability.

These are per-violation penalties. A single breach involving thousands of patient records can generate penalties in the millions. Criminal penalties, enforced by the Department of Justice, can include fines up to $250,000 and imprisonment up to 10 years for offenses committed with intent to sell PHI or use it for personal gain.

Beyond federal penalties, state attorneys general can bring civil actions under HIPAA, and many states have their own health information privacy laws with independent penalty structures. The legal and financial exposure from a HIPAA violation is substantial enough that compliance should be treated as a core business requirement, not an optional best practice.

Building a HIPAA-Compliant Records Review Workflow

Here is a practical workflow for handling medical records that maintains HIPAA compliance at every step.

Step 1: Secure records receipt

Receive records through encrypted channels only. Set up a secure file transfer portal for providers, or use encrypted email. Never request that records be sent to personal email accounts or consumer file sharing links. Log the receipt of records including: the date received, the source, the number of pages, and the case they are assigned to.

Step 2: Access-controlled storage

Store records in an encrypted, access-controlled system. Each team member should have individual credentials. Access should be limited to staff assigned to the case. Implement audit logging so you can track who accessed which records and when.

Step 3: Compliant processing

If you use AI tools, outsourced review services, or any third-party technology to process records, verify that a signed BAA is in place before uploading any records. Use only HIPAA-compliant platforms with documented security measures. Keep records of which tools processed which records for which cases.

Step 4: Controlled sharing

When sharing records with expert witnesses, co-counsel, or other parties, use encrypted transmission methods. Include only the minimum necessary records for the recipient's purpose. Consider confidentiality agreements in addition to any required BAAs. Track all disclosures of records to third parties.

Step 5: Secure retention and destruction

After case resolution, retain records only for the period required by your state's document retention rules and malpractice statute of limitations. When the retention period expires, destroy records using compliant methods: cross-cut shredding for paper, secure deletion for electronic files. Document the destruction including date, method, and the person who performed it.

HIPAA and the Future of Legal Technology

The intersection of HIPAA compliance and legal technology is evolving rapidly. AI tools, cloud platforms, and collaborative software are transforming how legal professionals work with medical records. This creates both opportunities and risks.

The opportunity is clear: technology that processes medical records faster and more accurately while maintaining HIPAA compliance makes legal professionals more effective. The risk is equally clear: technology adopted without proper compliance vetting exposes firms to regulatory penalties, malpractice claims, and reputational damage.

The firms that will thrive are those that adopt technology strategically — selecting HIPAA-compliant tools that enhance efficiency without creating compliance gaps. The firms that will struggle are those that either resist technology entirely (and fall behind on efficiency) or adopt consumer tools without proper compliance safeguards (and face the regulatory consequences).

HIPAA compliance is not a barrier to technology adoption. It is a framework for adopting technology responsibly. The best medical-legal technology platforms are built with HIPAA compliance as a foundation, not an afterthought. When you select tools that meet compliance requirements from the start, you gain the efficiency benefits of technology without the compliance risks.

Questions about HIPAA compliance for your medical record review workflow? Contact us at [email protected] or (856) 979-6525