The Legal AI HIPAA Checklist

What your vendor must have before you upload a single client file. Written for attorneys, not IT departments. Print this page and run through it with every vendor on your shortlist.

Business Associate Agreement (BAA)

Vendor provides a signed BAA upon request

BAA covers all subprocessors — cloud storage, AI model providers

BAA is updated and dated within the last 2 years

Data Storage & Encryption

Data encrypted at rest (AES-256 or equivalent)

Data encrypted in transit (TLS 1.2 or higher)

Servers located in the United States

Data is NOT used to train AI models

Access Controls

Role-based access — different permissions for attorneys, paralegals, admins

Multi-factor authentication (MFA) available

Automatic session timeouts enforced

Access logs available to your firm — not just to the vendor

Audit Trail

Every document access is logged with timestamp and user identity

Logs are tamper-proof and exportable

Audit reports available on demand to your firm

Breach Notification

Vendor has a written breach notification policy

Notification timeline meets HIPAA's 60-day requirement

Your firm is notified directly — not via a general announcement

Data Portability & Deletion

You can export all your data at any time, in a usable format

Account deletion results in verified, documented data purge

Data retention policy is documented and matches your firm's requirements

Vendor Risk

Vendor has completed a formal HIPAA risk assessment

SOC 2 Type II report available — or equivalent third-party audit

Named security contact available to your firm

A note on transcription

If you use AI transcription for depositions, client calls, or medical record dictation, the same standards apply. Your transcription provider must sign a BAA and meet every item on this checklist. TranscribeLegal is built to these standards and integrates directly with ProvaLens — one platform, one BAA, full coverage.

ProvaLens is built for HIPAA workflows, and we sign a BAA before you upload.

Review our BAA and security summary

Or start your free trial and verify the platform yourself before you commit.

View Security & Compliance Start Free 30-Day Trial

No credit card required.