When a personal injury client hands over a stack of medical records, they are trusting your firm with some of the most sensitive information a person can share. That trust carries legal weight. As AI-powered document tools become standard equipment for small law firms, the question of HIPAA compliance is no longer a back-office concern — it sits at the center of every technology decision you make.
This post walks through what HIPAA actually requires of law firms, the specific risks that arise when you feed protected health information (PHI) into AI platforms, and the practical steps you should take before adopting any new tool. It also addresses how to think about AI document tool pricing alongside other case technology costs — because the cost conversation and the compliance conversation belong in the same room.
Why HIPAA May Apply to Your Law Firm — and Why That Matters for AI
There is a common misconception that HIPAA only applies to hospitals, insurers, and healthcare providers. Law firms that receive, store, or transmit PHI on behalf of a covered entity — or that handle medical records as part of personal injury, workers' compensation, or employment litigation — may qualify as business associates under HIPAA, depending on the specific nature of the engagement. Whether that classification applies to your firm is a fact-specific legal determination. Consult qualified HIPAA counsel to assess your obligations before drawing any conclusions.
If your firm is determined to be operating as a business associate, your obligations under HIPAA may include safeguarding PHI against unauthorized access, use, or disclosure; executing a Business Associate Agreement (BAA) with vendors that handle PHI on your behalf; and ensuring that subcontractors meet equivalent standards. The precise scope and content of those obligations depends on your specific circumstances, and nothing in this post should be read as legal advice.
The subcontractor point is where AI adoption gets complicated. When you upload a client's medical chronology to an AI platform, that platform may become a subcontractor handling PHI. If the vendor does not sign a BAA with your firm, and your firm has business associate obligations, you may be exposed to compliance risk regardless of how carefully your own staff handles the data.
The Business Associate Agreement Is a Critical Threshold
Before uploading a single medical record to any AI tool, confirm whether the vendor will execute a BAA. A BAA specifies how the vendor may use PHI, what security standards they must meet, how they will notify you of a breach, and what happens to PHI when the relationship ends.
Some consumer-grade AI tools — including widely used general-purpose chatbots — explicitly state in their terms of service that they are not intended for protected health information and will not sign BAAs. If your firm has business associate obligations, using those tools with client medical records may create compliance exposure.
The Specific Risks of AI Document Tools in PI and Employment Cases
Personal injury and employment law practices are among the highest-volume consumers of PHI in the legal industry. A single motor vehicle accident case can generate hundreds of pages of emergency room records, surgical notes, physical therapy logs, pharmacy records, and independent medical examination reports. Employment cases involving workplace injuries or disability discrimination add another layer of sensitive health information.
When you introduce AI into this workflow, the exposure points multiply:
Data Storage and Residency
Where does the AI vendor store your uploaded documents? Are they stored on servers in the United States? Are they encrypted at rest and in transit? Can the vendor's employees access your files? These questions are not hypothetical — they are the substance of a HIPAA security risk assessment. Ask vendors these questions directly and get written answers before uploading any PHI.
Model Training on Your Data
Some AI platforms use uploaded documents to train or improve their underlying models. If a vendor's terms of service allow them to use your client's medical records as training data, that is a potential unauthorized disclosure of PHI. Read the terms carefully, and ask vendors directly whether your data is used for training.
Access Controls and Audit Logs
For firms with business associate obligations, limiting access to PHI to those with a legitimate need — and maintaining records of that access — is a core compliance concern. Does the AI platform you are evaluating provide role-based access controls? Does it maintain audit logs showing who accessed which documents and when? Ask your HIPAA compliance counsel what access-control and logging standards apply to your firm's specific situation.
Retention and Deletion
What happens to your client's medical records after you close a matter or cancel your subscription? A HIPAA-conscious vendor should have a documented policy for returning or destroying PHI at the end of the relationship. If a vendor cannot tell you how and when they delete your data, that is a red flag.
Evaluating AI Vendors: A Practical Compliance Checklist
When you evaluate AI document tools or any other legal tech vendor that will touch PHI, run every candidate through the same compliance checklist before the price conversation begins. Compliance is a threshold requirement — not a feature to weigh against cost.
Before signing any contract, confirm the vendor:
- Will execute a BAA — in writing, before you upload any PHI
- Stores data in encrypted infrastructure — ask specifically about encryption standards for data at rest and in transit, and get written confirmation of their data-residency practices
- Does not use your data for model training — get this in writing if it is not explicit in the terms
- Provides role-based access controls — so only authorized users can access specific matters
- Maintains audit logs — with sufficient detail to support your firm's compliance documentation
- Has a documented breach notification process — including the timeframe and method for notifying your firm
- Has a clear data retention and deletion policy — so PHI does not linger on vendor servers after the engagement ends
- Has completed a SOC 2 Type II audit or equivalent — as evidence of mature security practices
A Note on Pricing and Compliance Trade-offs
When firms evaluate AI legal tools, they sometimes treat compliance features as a premium add-on — something that justifies a higher price tier. The more accurate framing is that a vendor who cannot meet baseline requirements for your firm's situation is not actually a viable option for your practice, regardless of price. A lower monthly fee is not a bargain if it exposes your firm to regulatory liability and erodes client trust.
That said, pricing structure does matter. Flat-rate, per-firm pricing — as opposed to per-seat or per-document pricing — tends to be more predictable for small firms and removes the incentive to limit staff access to the platform, which can inadvertently create compliance gaps when people share credentials.
Building an AI Workflow for Your Firm That Supports HIPAA
Compliance is not a one-time vendor check. It is an ongoing workflow. Here is how to build AI into your practice in a way that holds up under scrutiny.
Step 1: Conduct a Risk Assessment
Before adopting any new technology that handles PHI, consider documenting a risk assessment in consultation with your HIPAA compliance counsel. Identify what PHI flows through the tool, what the risks are, what controls are in place, and what residual risk remains. This does not need to be a lengthy document, but it does need to exist. If your firm is ever audited, the absence of a risk assessment is itself a finding.
Step 2: Update Your Policies and Procedures
Your firm's HIPAA policies should reference the specific AI tools you use and describe how staff are expected to interact with them. Who is authorized to upload PHI? What types of documents can be uploaded? What happens if a staff member accidentally uploads the wrong client's records? Write the answers down.
Step 3: Train Your Staff
HIPAA training is a recurring obligation, not a one-time onboarding exercise. When you introduce a new AI tool, add a training component that covers how to use it in a way that protects PHI. This is especially important for paralegals and legal assistants who may be the primary users of document management and AI analysis tools.
Step 4: Review Vendor Agreements Annually
Vendors update their terms of service. A BAA that was adequate when you signed it may no longer reflect the vendor's current data practices. Build an annual review of all vendor agreements into your compliance calendar.
How ProvaLens Approaches HIPAA Compliance
ProvaLens is built specifically for small personal injury and employment law firms — practices where medical records are not the exception but the rule. The platform is designed with the understanding that every document uploaded may contain PHI, and compliance is treated as a foundation, not a feature tier.
ProvaLens is willing to execute Business Associate Agreements with client firms. Prospective customers should review ProvaLens's current terms of service and BAA directly to verify specific data-handling commitments — including representations about encryption, data residency, model training, and access controls — before uploading any PHI. Do not rely on any summary description, including this one, as a substitute for reviewing those documents.
The core platform — which reads entire case files and returns AI-generated answers cited to exact page and paragraph, flags possible conflicts across documents, builds filterable case timelines, generates medical chronologies, and transcribes depositions — is available at flat-rate per-firm pricing with no per-seat fees. This structure means your entire team can use the platform without compliance workarounds like shared credentials.
For firms that want a fully managed option, ProvaLens also offers Expert Services: done-for-you AI case analysis delivered as interactive timelines, itemized special-damages tallies, medical chronologies, liability narratives, and demand letter drafts. Pricing for Expert Services is available directly from ProvaLens. Because Expert Services is a discrete, per-case engagement rather than a subscription, it functions as a genuine out-of-pocket case cost — similar to an expert witness fee or an eDiscovery charge — that a firm may pass through to the client at cost, with appropriate disclosure and informed consent. The monthly platform subscription, by contrast, is firm overhead and is not structured as a per-client pass-through.
Illustrative Scenario (Hypothetical)
Imagine a hypothetical five-attorney personal injury firm that has been using a general-purpose AI chatbot to summarize medical records. The tool does not offer a BAA, and its terms of service allow the vendor to use uploaded content to improve its models. When the firm's managing partner runs the vendor through the compliance checklist above, the tool fails on the first item. After consulting HIPAA counsel to confirm the firm's business associate status, the firm switches to a purpose-built legal AI platform that executes a BAA and provides written confirmation that client data is not used for model training. The managing partner documents the transition as part of the firm's annual risk assessment.
This scenario is entirely hypothetical and illustrative. The broader pattern it reflects — firms adopting AI tools quickly without first confirming compliance basics — is a genuine risk worth taking seriously. The firms most exposed are not the ones that have never heard of HIPAA. They are the ones that moved fast because the tool seemed useful and the price was right, and skipped the compliance check.
The Bottom Line: Compliance and Capability Are Not in Conflict
The best AI tools for personal injury and employment law firms are not the ones that ask you to choose between capability and compliance. They are the ones that treat HIPAA requirements as the baseline and build useful features on top of that foundation.
When you evaluate AI document tools, run the compliance checklist first. Confirm the BAA, verify the data practices in writing, and document your risk assessment with the guidance of qualified counsel. Then evaluate features and price. That sequence protects your clients, protects your firm, and ensures that the efficiency gains AI delivers do not come with hidden liability attached.
If you are ready to see what a HIPAA-conscious AI document platform looks like in practice, Start your free ProvaLens trial and explore how it fits into your existing workflow.