HIPAA Compliant AI for Legal Medical Record Review

HIPAA compliant AI for legal medical record review means a signed BAA when HIPAA makes your firm a business associate, and the same data-handling standard when it does not. Hathr.AI sells a HIPAA-compliant AI platform, so weigh its answers against the contracts you read yourself. Hathr.AI is not a case-management system and does not give legal advice. This page is part of Hathr.AI for medical-legal teams. Last updated 28 October 2026.

Key takeaways

• HHS lists legal services as a business associate function, so a firm serving a covered entity needs a BAA. A plaintiff's firm holding records under an authorization or protective order usually does not, but the file is just as sensitive (HHS, Business Associates guidance, reviewed 21 October 2026).
• Hathr.AI accepts its BAA at signup on every HIPAA-compliant plan, so a firm can buy as if a BAA were required without waiting on a sales process.
• A BAA is worth its written terms. Hathr.AI's BAA sets a 20-business-day clock for reporting breaches and security incidents and a 30-business-day clock for returning or destroying PHI after termination.
• ABA Formal Opinion 512 asks lawyers to assess confidentiality risk, read the tool's terms and get informed consent for self-learning tools before entering client information.
• Hathr.AI does not hold a SOC 2 report. Hathr.AI holds an attestation from the Department of War of its security against NIST SP 800-171, and firms with a SOC 2 requirement should say so before a trial starts.

Does a law firm need a BAA to use AI on medical records?

The answer depends on the firm's posture, and posture changes the paperwork, not the sensitivity of the file. HHS names legal services as a business associate function and gives the example of an attorney whose services to a health plan involve access to PHI (HHS, Business Associates guidance, reviewed 21 October 2026). A defense firm representing a hospital, insurer or health plan is in that position. Its AI vendor then becomes a subcontractor business associate and must sign a BAA before the firm discloses any PHI to it (same guidance).

A plaintiff's firm usually sits elsewhere. Records that arrive under a patient authorization or a qualified protective order come with their own limits. Under 45 CFR 164.512(e), a qualified protective order bars use of the PHI for any purpose other than the litigation and requires its return or destruction when the proceeding ends. The firm's duties then run through that order, state privacy law and the rules of professional conduct. Reading that posture correctly is a lawyer's call, not a vendor's, and this page is not legal advice.

Hathr.AI's view is to buy as if a BAA were required. A BAA costs nothing when it is not required, and it is the one version of the decision that does not depend on a posture analysis being right.

What does HIPAA compliant AI for legal medical record review require in the BAA?

HHS says a BAA must describe the vendor's permitted uses and disclosures of PHI, bar any use or disclosure beyond the agreement or the law, require Security Rule compliance and the reporting of security incidents and breaches, and bind subcontractors the same way (HHS, Business Associates guidance). Vendors differ on the terms, not the template. Put each question in writing before any upload.

Compare the 20-business-day reporting window with the clocks your own state breach law and client agreements set. A window that is fine for one firm can be too slow for another, and Hathr.AI would rather you check before signing than after an incident.

Is there a legal AI platform that doesn't retain medical data?

Ask what "retain" covers before you accept the answer. Hathr.AI's LLM inference is zero data retention, and files that customers store are stored securely in Hathr.AI's compliant AWS GovCloud environment. Those are two layers, and a case workflow needs both. The model keeps nothing from a prompt once it has answered, while the file library keeps the production so the team can ask follow-up questions next week.

Hathr.AI also keeps full audit logging of platform activity, including prompts and outputs, and those records are walled off from Hathr.AI employees and contractors. Hathr.AI never uses customer data for model training or product development, and its BAA requires PHI to be returned or destroyed within 30 business days of termination. A vendor that says "we retain nothing" while offering a saved file library is describing only one layer. Hathr.AI's position is that a retention claim with no layer attached is marketing, so make every vendor name the layer.

What does ABA Formal Opinion 512 require when AI touches client medical records?

ABA Formal Opinion 512, issued 29 July 2024 by the ABA Standing Committee on Ethics and Professional Responsibility, asks four things that matter for a records file (ABA Standing Committee, Formal Opinion 512, as summarized in The Bar Examiner, Fall 2024).

1. Assess the risk first. Judge whether people outside the firm could access or disclose client information before you enter it.
2. Get informed consent for self-learning tools. Boilerplate waivers do not count, and consent is not needed when no representation-related information goes in.
3. Read the vendor's terms. Read the terms of use and privacy policy, or have a qualified person read them, to learn who can access your inputs.
4. Supervise. Set firm policy and train everyone who uses the tool.

State bar opinions vary, so check your own. Hathr.AI maps each duty to its written terms in the ABA 512 vendor-diligence checklist for client medical records. Using a consumer chatbot instead? Read whether lawyers can use ChatGPT or Claude with client medical records first.

Does Hathr.AI have a SOC 2 report?

No. Hathr.AI does not hold a SOC 2 report. Hathr.AI holds an attestation from the Department of War of its security against NIST SP 800-171, and it builds its security program on NIST SP 800-53 and NIST SP 800-171, the federal control catalogs that commercial frameworks such as SOC 2 and HITRUST map back to. Those are different instruments from a SOC 2 audit, and Hathr.AI makes no claim that one replaces the other. If your firm's vendor policy requires a SOC 2 report, Hathr.AI will not meet that line item, and it is better to learn that before a trial than after.

How do you test a legal AI vendor in one afternoon?

1. Get the BAA text. Read the incident-reporting and return-or-destroy clauses.
2. Ask which layer is retained. Model inference and stored files are separate answers.
3. Ask who can see activity logs. Vendor staff access to your prompts is the question.
4. Ask for the security validation in writing. Match it to your firm's vendor policy.
5. Upload one closed matter. Hathr.AI reads 90+ files and 100,000+ pages in a single workflow, so a full production goes in whole. Ask for a dated chronology with page citations, then open ten cited pages at random and compare them with what you already know.

Hathr.AI surfaces what the record says, and a lawyer or nurse reviewer decides what it means. For the chronology job itself, see AI medical chronology software for law firms.

How can your firm start?

Start a 7-day free trial of Hathr.AI and upload one closed matter under the BAA. The web app is $47 per user per month (as of October 2026) with no seat minimums; see Hathr.AI pricing. Firms of 10 or more can book a Hathr.AI demo to walk through the BAA, the security review and a rollout.

Frequently asked questions

Is a law firm a HIPAA business associate?
A firm whose legal services for a covered entity involve PHI is a business associate, and HHS gives the example of an attorney serving a health plan. A plaintiff's firm holding records under an authorization or qualified protective order generally is not. Confirm your posture with privacy counsel. Hathr.AI accepts its BAA at signup, so either kind of firm can work under one.

Does Hathr.AI sign a BAA with law firms?
Yes. Hathr.AI includes a signed BAA on every HIPAA-compliant plan, accepted electronically at signup. The Hathr.AI Enterprise BAA can be signed in under 24 hours. The BAA sets reporting of breaches and security incidents within 20 business days of discovery and return or destruction of PHI within 30 business days of termination.

Is there a legal AI platform that doesn't retain medical data?
Ask which layer a vendor means. Hathr.AI's LLM inference is zero data retention, and files that customers store are stored securely in Hathr.AI's compliant AWS GovCloud environment. Hathr.AI also keeps audit logs that its own staff cannot browse and never uses customer data for model training or product development.

Does Hathr.AI have a SOC 2 report?
No. Hathr.AI does not hold a SOC 2 report. Hathr.AI holds an attestation from the Department of War of its security against NIST SP 800-171 and builds its program on NIST SP 800-53 and 800-171. If your policy requires SOC 2, say so before the trial.

Does ABA Formal Opinion 512 require client consent before using AI?
The opinion says informed consent is needed before entering representation-related information into a self-learning tool, and boilerplate waivers are not enough. Consent is not needed when no such information goes in. State bar rules vary, so check yours and read the vendor's terms.

Can AI replace a paralegal or nurse reviewer on medical records?
No. Hathr.AI drafts a chronology with page citations and answers questions across 90+ files and 100,000+ pages in a single workflow. A paralegal or nurse reviewer then checks the entries against the source pages, and a lawyer decides what the record means for the case.

Start with your own closed matter. Upload one production under the BAA, ask for a cited chronology and check ten pages. Try Hathr.AI free for 7 days →