AI for Medical Malpractice and Disability Lawyers: Record Review, RFC Evidence Maps and ABA Opinion 512

Malpractice and disability practices read more medical record per case than almost any other kind of legal work. A malpractice file turns on a few hours around one event. A disability file turns on what your client can still do across years of treatment. Hathr.AI reads both kinds of file and cites the page behind every answer. Our AI medical chronology software guide compares the tool categories. This page covers how each practice uses AI on the record, where HIPAA reaches your firm, and what ABA Formal Opinion 512 asks of you. The product page is AI medical record review on Hathr.AI.

Key takeaways

• Defense firms that represent a hospital, practice or health plan act as HIPAA business associates. They need a BAA with the client and another with any AI vendor that touches the records.
• Plaintiff and claimant firms receive records through the patient, so HIPAA reaches them less often. Model Rule 1.6, protective orders and state privacy law still govern the file.
• Malpractice review works hour by hour around a critical event. Disability review maps function across every provider and year to the five-step SSA process or the LTD policy.
• ABA Formal Opinion 512 asks you to understand the tool, verify its output, get informed consent before client data enters a self-learning tool, and bill for actual work.
• Hathr.AI runs Anthropic's Claude models in AWS GovCloud (US), hosted on FedRAMP High infrastructure, with a signed BAA on every HIPAA-compliant plan, at $47 per user per month.

What does AI do with a malpractice or disability case file?

AI reads the whole case file, builds a dated index of it, and answers your questions with a citation to the source page. You upload the production, ask in plain language, and check the cited page instead of reading from page one. Attorneys and paralegals use it for five jobs:

• Chronologies. Every dated encounter, order, result and medication change, by date and provider. Our medical chronology template shows the twelve fields a litigation chronology needs.
• Targeted extraction. Every mention of one issue, such as fall-risk assessments, lifting restrictions or missed appointments.
• Gap detection. Missing dates, absent records from a known provider, and stretches with no documented assessment.
• Summaries. Short narratives by provider, body system or date range for intake memos and expert packets.
• Drafting support. First drafts of demand letters, appeal briefs and deposition outlines built from findings you have already checked.

Capacity decides whether the tool sees the whole file. A malpractice or disability record can run to thousands of pages across hospitals, clinics, imaging centers and therapists. Each Hathr.AI web app account holds up to 100 documents totaling up to 100,000 pages, and Hathr.AI processes that volume in a single workflow, about 100 times the ~1,000-page ceiling common in competing tools. If you are new to the format, start with what a medical chronology is and how to prepare one.

Hathr.AI surfaces what the record says. Your expert decides the medical meaning, and you decide the legal one.

Does HIPAA apply to your firm's medical records?

HIPAA applies to your firm when you hold records on behalf of a covered entity, and it reaches you less often when you represent the patient. The answer changes what you need from an AI vendor, so settle it matter by matter.

• Defense firms. HHS lists an attorney whose legal services to a health plan involve access to PHI as an example of a business associate. If your firm defends a hospital, practice or plan and receives PHI to do it, you need a BAA with that client.
• Your AI vendor as subcontractor. A business associate must sign a BAA with any subcontractor before disclosing PHI to it. Before you upload a hospital client's records, the AI vendor signs a BAA with your firm.
• Plaintiff and claimant firms. You obtain records through the patient's authorization, the patient's right of access, or a subpoena. You do not act for the covered entity, so HIPAA does not govern the records in most of these matters. A qualified protective order under 45 CFR 164.512(e) can still limit use of the PHI to the litigation and require its return or destruction at the end.
• Substance use disorder records. Records from federally assisted programs fall under 42 CFR Part 2, which adds consent and court-order rules on top of HIPAA. Flag them at intake.

We advise one default for both sides: treat every production as though a BAA were required, and buy a tool that signs one. A signed BAA costs you nothing on a plaintiff matter and covers you on a defense matter. Our guide to medical record review for law firms covers the BAA rules for each posture in more depth. This page describes how the frameworks fit together. It is not legal advice.

How does malpractice record review differ from disability record review?

Malpractice review asks what happened in a short window and whether care met the standard. Disability review asks what the claimant can still do on a regular and continuing basis, across every treating source. You use the same tool for both and ask it different questions.

How do medical malpractice lawyers use AI on the record?

Malpractice lawyers use AI to screen cases before intake, build an hour-level chronology, and prepare expert packets and depositions. Most states require expert testimony on the standard of care and causation, and many require a certificate or affidavit of merit early in the case. That puts pressure on your first pass through the record.

1. Screen before you accept the case. Upload the records and ask for a chronology of the key admission, every order and result in the window that matters, and anything that looks like a delay or omission.
2. Build the chronology to the hour. Ask for each entry with date, time, author and page citation. Flag late entries and amendments with their original dates.
3. Spot the issues. Ask when an abnormal result first became available, when a clinician first acknowledged it, and what happened in between. Hathr.AI surfaces the gap. Your expert decides whether it was a deviation.
4. Prepare the expert packet. Send the full record plus the AI chronology, labeled as a work-product aid. The expert forms opinions from the source record.
5. Prepare depositions. Pull every entry a nurse or physician authored and every place the record contradicts their likely testimony.

For defense counsel, every one of these steps touches your client's PHI, so the BAA chain has to be in place before the first upload.

How do disability lawyers use AI for SSDI and long-term disability claims?

Disability lawyers use AI to map every functional limitation in the record to the residual functional capacity factors, by provider and date, with a page citation on each entry. Disability files run long because SSA and LTD reviewers look at function over time.

Know the five steps. Under 20 CFR 404.1520, SSA asks in order whether the claimant is doing substantial gainful activity, has a severe impairment that meets the duration requirement, meets or equals a listing, can do past relevant work, and can adjust to other work. SSA assesses residual functional capacity between steps three and four and uses it at steps four and five.

Build the RFC evidence map. Under 20 CFR 404.1545, residual functional capacity is the most a claimant can still do despite their limitations. The rule names physical abilities such as sitting, standing, lifting and reaching, and mental abilities such as understanding, remembering and responding to supervision and work pressure. Ask Hathr.AI for every entry that speaks to each ability, by provider and date. Therapy notes and mental health records belong in the map, and the OCR reads handwritten progress notes that text-only tools skip.

Support the medical source statement. For claims filed on or after March 27, 2017, 20 CFR 404.1520c makes supportability and consistency the most important factors in weighing a medical opinion. Before a treating physician completes a medical source statement, ask the tool where that physician's own findings support each limitation and where other records agree.

Check the listings. The Listing of Impairments sets medical criteria for step three. AI can line up the record's findings against a listing. You decide whether the claimant meets or equals it.

Do not filter the record. Under 20 CFR 404.1512, the claimant must inform SSA about or submit all evidence known to them that relates to whether they are disabled. Use AI to find and organize evidence. It does not decide what SSA sees.

Long-term disability. ERISA governs most employer-sponsored LTD plans, and the policy's definition of disability controls, often own occupation and then any occupation. Many courts limit review to the administrative record, which makes the internal appeal your last chance to add evidence. A full-record pass before that appeal catches the pages a hurried review leaves out. Coverage appeals follow the same discipline, and our guide to AI for Medicare appeals walks through tying each denial reason to the pages that answer it.

Map one disability file to the RFC factors in Hathr.AI, free for 7 days

What does ABA Formal Opinion 512 require when lawyers use AI?

ABA Formal Opinion 512, issued July 29, 2024, applies the Model Rules to generative AI. Your state's rules and ethics opinions control, so check those as well. The opinion covers six duties:

• Competence (Rule 1.1). Understand what the tool can and cannot do, and verify its output. The opinion says the right amount of checking depends on the tool and the task. A lawyer who tested a tool's summaries against a smaller set reviewed by hand may not need to re-read every document in the larger set.
• Confidentiality (Rule 1.6). Before you put information relating to the representation into a self-learning tool, get the client's informed consent. Boilerplate in an engagement letter does not satisfy that requirement.
• Communication (Rule 1.4). Depending on the facts, tell clients how you use AI even where Rule 1.6 does not require consent.
• Supervision (Rules 5.1 and 5.3). Set firm policy on AI use, train staff, and vet vendors on security, confidentiality terms and data handling.
• Candor (Rules 3.1, 3.3 and 8.4(c)). Review AI output before it reaches a tribunal. A misdated chronology entry becomes a credibility problem once it appears in a brief.
• Fees (Rule 1.5). Hourly billers bill actual time, including time spent reviewing the AI draft. Flat and contingent fees must stay reasonable, and general overhead does not get billed to the client.

Opinion 512 ties the consent requirement to self-learning tools, whose outputs could reveal your inputs to other users. Hathr.AI never uses customer data for model training. Ask your ethics counsel whether your state's rules still call for consent, and keep verifying output. The ten-page check below gives you a documented method.

Which AI tool should a malpractice or disability firm choose?

Choose a tool that signs a BAA, processes records in a named environment, excludes your data from training, cites a page for every answer, and holds the whole file. Ask every vendor these questions and get the answers in writing:

1. Will you sign a BAA, and does it flow down to your subcontractors?
2. Where are the records processed and stored, by country and cloud environment?
3. Do you use our data for model training or product development?
4. What happens to our data at the end of the contract, and can retention fit inside our protective orders?
5. Does every answer cite a page in the source record?
6. Can one workspace hold an entire case file, handwritten pages included?

Hathr.AI's answers: a signed BAA on every HIPAA-compliant plan, accepted at signup, with obligations flowing down to subcontractors. Processing in AWS GovCloud (US), hosted on FedRAMP High infrastructure, and customer data never crosses the commercial internet. No use of customer data for model training or product development. Under the BAA, Hathr.AI gives breach notice within 20 business days of discovery and returns or destroys PHI within 30 business days of termination. Hathr.AI builds its security program on NIST SP 800-53 and NIST SP 800-171, the federal controls that SOC 2 and the HITRUST CSF map back to. For a wider comparison, see our review of the best HIPAA-compliant AI tools, and if your firm is weighing a consumer Claude plan, read is Claude HIPAA compliant first.

The objections we hear from small firms have short answers:

• Price: $47 per user per month, with no per-page fee. A 12,000-page production costs the same to question as a 600-page one.
• Firm size: no seat minimums. A two-person practice gets the same BAA and the same GovCloud hosting as a national firm.
• Procurement: you accept the BAA at signup, with no sales call in the way.
• Trial: 7 days free, on a real production, because the BAA is in place from day one.

How should a firm roll out AI on client medical records?

Roll AI out in six steps, in this order, and write each one into your firm policy.

1. Classify your matters. Separate defense matters that need a BAA chain, plaintiff and claimant matters governed by authorizations and protective orders, and any matter with Part 2 records.
2. Sign the BAA and set retention. Do both before you upload client data, and match retention to your protective orders.
3. Update engagement letters. Explain in specific terms how you use AI on client records. Generic language falls short where Rule 1.6 requires consent.
4. Validate on a closed file. Run the tool on a closed case your team knows well. Open ten cited pages at random and confirm each entry, counting handwritten pages on their own. Ten out of ten is the bar.
5. Write a review protocol. Name who checks output, how many entries they verify against source pages, and how the file labels AI-assisted work.
6. Supervise and check billing. Make one partner responsible for the policy, and confirm that time entries reflect actual work.

Hathr.AI has not published an accuracy figure for record-review output, and we will not quote one until we can show the method behind it. The ten-page check gives you a number for your own records, which is the number that matters on your matter. For the retrieval side of the workflow, see medical records retrieval for lawyers, and for outsourced review costs, the medical record review services worksheet.

Run your closed-file test in Hathr.AI, free for 7 days    See pricing

Frequently asked questions

Is a law firm a business associate under HIPAA?

Sometimes. A firm that provides legal services to a covered entity, such as a hospital or health plan, and receives PHI to do it is a business associate. A firm representing the patient receives records through the patient's authorization, so in most matters it is not. Rule 1.6, protective orders and state privacy law still govern the records either way.

Do I need a BAA with my AI vendor?

If your firm is a business associate on the matter, yes. HHS requires a business associate to sign a BAA with any subcontractor before disclosing PHI to it, and an AI vendor that processes the records is that subcontractor. Plaintiff firms benefit from one too, because it helps document reasonable efforts under Rule 1.6.

Is there a legal AI platform that does not keep medical data after processing?

Yes. The models Hathr.AI uses retain nothing at the model layer. Documents you upload stay in your account, segmented from other customers, until you delete them, and you can delete them at any time. Hathr.AI never uses customer data for model training, and under its BAA it returns or destroys PHI within 30 business days of termination. Match those terms to your protective orders.

What does ABA Formal Opinion 512 require when lawyers use AI?

Opinion 512, issued July 29, 2024, requires a reasonable understanding of the tool, independent verification of its output, informed client consent before client information goes into a self-learning tool, supervision of staff and vendors, and fees that reflect actual work.

How does AI help with Social Security disability claims?

AI maps every functional limitation in the record to the residual functional capacity factors in 20 CFR 404.1545, by provider and date, and lines findings up against the listings. It also shows where the record supports a treating opinion and where other sources agree with it. The claimant must still inform SSA about or submit all evidence, so AI organizes the record and leaves the evidence intact.

Can AI replace a medical expert in a malpractice case?

No. AI organizes the record and surfaces gaps and timing problems. Most states require expert testimony on the standard of care and causation, and only a qualified expert working from the source record can give it.

What AI do law firms use to summarize medical records?

Law firms use three kinds of tool: litigation platforms with a chronology module, chronology-only AI vendors, and compliant AI assistants such as Hathr.AI. Hathr.AI reads full productions with handwriting OCR, cites a page for each answer, and costs $47 per user per month with a signed BAA on every HIPAA-compliant plan.

Last updated October 2026. Pricing effective August 2026. Informational, not legal advice.

Start a malpractice or disability file in Hathr.AI, free for 7 days · $47 per user per month · No seat minimums · Signed BAA on every web app account