HIPAA (AI in Healthcare Law)

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations establish federal privacy and security standards for protected health information (PHI) in the United States. In the context of AI-assisted legal work, HIPAA becomes directly relevant when attorneys representing healthcare clients, handling healthcare litigation, or conducting healthcare-related due diligence use AI tools to process documents containing PHI.

HIPAA's Privacy Rule and Security Rule apply to covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates—a category that explicitly includes attorneys who receive PHI in the course of providing legal services to covered entities. When a law firm handling healthcare litigation uses an AI tool to review medical records, or when a healthcare corporate lawyer uses AI for due diligence on a hospital acquisition, PHI may flow through AI systems in ways that trigger HIPAA obligations.

The key HIPAA mechanism governing AI tool use is the Business Associate Agreement (BAA). Before a covered entity or business associate shares PHI with an AI vendor, a BAA must be in place. The BAA governs how the vendor may use PHI, what security safeguards are required, breach notification obligations, and the return or destruction of PHI at contract termination. Not all AI vendors are willing or able to sign BAAs, which effectively limits which tools can be used in healthcare legal matters involving PHI.

Healthcare lawyers and litigation firms handling medical malpractice, personal injury, healthcare M&A, or regulatory matters routinely work with large volumes of PHI. As AI tools become integral to document review, research, and drafting workflows, the question of whether those tools can be used with PHI—and under what contractual conditions—becomes a threshold compliance question that cannot be deferred.

The consequences of HIPAA violations involving AI tools can be severe. The HHS Office for Civil Rights enforces HIPAA and can impose civil monetary penalties ranging from $100 to $50,000 per violation, with annual maximums up to $1.9 million for identical violations. Willful neglect violations can reach $1.9 million per category. Attorneys can also face state bar discipline for confidentiality breaches involving PHI.

Beyond direct compliance, healthcare clients often specify in outside counsel guidelines that law firms must maintain HIPAA-compliant practices, including obtaining BAAs with legal technology vendors. Firms that cannot demonstrate HIPAA-compliant AI tool use may be excluded from healthcare client relationships where this is a contractual requirement.

Major practice management and legal AI platforms used by healthcare lawyers have responded to HIPAA demand in different ways. Clio and Filevine offer BAAs for customers handling PHI, with security architectures designed to meet HIPAA Security Rule requirements. ContractPodAi similarly supports enterprise deployments with HIPAA-compliant data handling arrangements.

The challenge is that not all AI vendors will sign BAAs—some general-purpose AI tools explicitly state that they are not HIPAA-compliant and should not be used with PHI. This creates a bifurcated landscape: enterprise legal AI tools built for professional use often support HIPAA compliance; consumer-facing or general-purpose AI tools typically do not. Healthcare lawyers must verify HIPAA capability—not assume it—before using any AI tool with PHI.

Technical safeguards required under HIPAA (encryption in transit and at rest, access controls, audit logging, automatic logoff) are now standard features in enterprise-grade legal AI platforms, but implementation quality varies. Due diligence in procuring AI tools for healthcare legal work should include review of the vendor's HIPAA risk assessment, security policies, and breach history in addition to the BAA itself.