HIPAA does not automatically apply to attorneys. The law regulates healthcare providers, health plans, and healthcare clearinghouses, and a law firm is none of those. A firm only becomes subject to HIPAA when it handles protected health information on behalf of one of those healthcare organizations, which puts it in the role of a “business associate” with its own federal compliance duties. When your lawyer represents you as an individual, HIPAA does not apply to the firm at all — but your medical information is still protected, through the attorney’s ethical duty of confidentiality and, in litigation, through attorney-client privilege.
When a Law Firm Is a Business Associate
The trigger is who hired the firm. HIPAA defines a business associate as a person or entity that uses or discloses protected health information (PHI) on behalf of a covered entity. If the client is a hospital, insurer, or other healthcare organization, and the legal work requires access to PHI, the firm is almost certainly a business associate. HHS lists “an attorney whose legal services to a health plan involve access to protected health information” as a textbook example.1HHS.gov. Business Associates
Common scenarios include:
- Defending a hospital or physician group in a malpractice lawsuit.
- Advising a health plan on HIPAA compliance or a government investigation.
- Handling insurance appeals or collections for a provider group.
- Conducting due diligence on a healthcare entity’s merger or acquisition.
If you are the individual patient hiring the lawyer — for a personal injury claim, a disability benefits appeal, a custody dispute involving therapy notes — the firm is not a business associate, because it is not acting on behalf of a covered entity.
What a Business Associate Agreement Requires
Before any PHI changes hands, the covered entity and the law firm must sign a written Business Associate Agreement (BAA).2HHS.gov. Sample Business Associate Agreement Provisions At minimum, the BAA has to describe how the firm may use PHI, prohibit any use or disclosure beyond that, require appropriate safeguards, require the firm to report unauthorized uses and security incidents, require the firm to bind its subcontractors to the same restrictions, and require the return or destruction of PHI when the engagement ends.
If a covered entity discovers the firm has materially breached the BAA, it must fix the problem or terminate the contract. When termination isn’t feasible, the covered entity has to report the situation to the HHS Office for Civil Rights.1HHS.gov. Business Associates
Subcontractors
A law firm handling PHI usually relies on outside vendors: cloud storage, IT support, e-discovery platforms, shredding services. Any vendor that creates, receives, maintains, or transmits PHI on the firm’s behalf is a subcontractor under HIPAA and needs its own BAA with the same restrictions.2HHS.gov. Sample Business Associate Agreement Provisions Skipping this step is itself a violation.
Breach Notification
When a firm acting as a business associate discovers a breach of unsecured PHI, it must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery.3eCFR. 45 CFR 164.410 – Notification by a Business Associate The clock starts when the firm knows about the breach or, with reasonable diligence, should have known. The notice must identify each affected individual to the extent possible and give the covered entity enough detail to meet its own notification obligations.
Data Disposal
At the end of the engagement, the firm must return or destroy the PHI. Paper records need to be shredded, burned, or pulped so they are unreadable; electronic media must be purged or physically destroyed.4HHS.gov. May a Covered Entity Hire a Business Associate to Dispose of Protected Health Information Deleting files or tossing paper in recycling does not meet the standard.
What HIPAA Requires the Firm to Do
Both covered entities and business associates must observe the minimum necessary standard: any use, disclosure, or request for PHI is limited to the smallest amount reasonably needed for the task.5eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information For a firm, that means asking only for records relevant to the legal matter, not a full patient database. A covered entity is entitled to rely on the firm’s representation that a request meets the standard.6HHS.gov. Are Business Associates Required to Restrict Their Uses of Protected Health Information
Since 2009, the obligation runs directly to the firm. Before the HITECH Act, business associates were bound only through their contracts with covered entities; enforcement ran through the covered entity. HITECH and the 2013 Omnibus Rule made business associates directly liable for HIPAA violations, meaning HHS can investigate, fine, and refer the firm on its own. A firm acting as a business associate can face enforcement for unauthorized use or disclosure, Security Rule failures, breach notification delays, minimum-necessary violations, failure to bind subcontractors, and refusing to cooperate with HHS investigations.7HHS.gov. Direct Liability of Business Associates
Penalties a Law Firm Can Face
Civil Penalties
Civil fines run in four tiers based on culpability. The figures below are the most recent inflation-adjusted amounts published by HHS and remain in effect until updated:8Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
- Tier 1, did not know: $145 to $73,011 per violation, with a calendar-year cap of $2,190,294.
- Tier 2, reasonable cause but not willful neglect: $1,461 to $73,011 per violation, same annual cap.
- Tier 3, willful neglect corrected within 30 days: $14,602 to $73,011 per violation.
- Tier 4, willful neglect not corrected: $73,011 to $2,190,294 per violation, with no lower-cap protection.
Each affected record or instance can count as a separate violation, so a single breach involving thousands of records can produce penalties well into the millions.
Criminal Penalties
Criminal prosecution is reserved for knowing violations and is handled by the Department of Justice. Penalties escalate with intent:9Office of the Law Revision Counsel. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
- Knowing violation: up to $50,000 and one year in prison.
- Obtaining PHI under false pretenses: up to $100,000 and five years in prison.
- Intent to sell, transfer, or use PHI for personal gain or malicious harm: up to $250,000 and ten years in prison.
When HIPAA Does Not Apply to Your Lawyer
Most attorneys who handle medical records never become business associates. A personal injury lawyer reviewing your treatment records, a family lawyer examining therapy notes in a custody case, a disability attorney compiling your medical history — none of these engagements trigger HIPAA, because the firm is working for you rather than for a healthcare organization. The records don’t become PHI under HIPAA just because a lawyer is holding them.
Your information is still protected. Under the widely adopted framework in ABA Model Rule 1.6, an attorney may not reveal any information relating to the representation without your informed consent, subject to narrow exceptions. That duty is broader than HIPAA in an important sense: it covers everything connected to the representation — medical records, financial documents, communications, strategy — not only individually identifiable health information. HIPAA itself carves out employment records and FERPA-covered education records from the definition of PHI;10HHS.gov. Summary of the HIPAA Privacy Rule the ethical duty has no such carve-outs. A breach of the duty can lead to state bar discipline, including suspension or disbarment, and potential malpractice liability.
Privilege vs. Confidentiality for Medical Records
Confidentiality and attorney-client privilege overlap but do different work. Confidentiality is an ethics rule that stops your lawyer from voluntarily sharing your information. Privilege is a rule of evidence that stops a court from forcing your lawyer to disclose it.11Legal Information Institute. Attorney-Client Privilege
For privilege to apply, the communication must have been made in confidence, between you and your attorney, for the purpose of obtaining legal advice. Medical records you share with your lawyer to support a claim, and your discussions about them, are generally protected from compelled disclosure. Even an inadvertent disclosure doesn’t automatically waive privilege under Federal Rule of Evidence 502, provided the holder took reasonable steps to prevent it and acted promptly to fix the mistake.12Cornell Law School. Federal Rules of Evidence Rule 502 – Attorney-Client Privilege and Work Product; Limitations on Waiver
One limit worth knowing: if you put your medical condition at issue in a lawsuit, as personal injury plaintiffs typically do, the other side can generally obtain relevant medical records through discovery. Privilege protects your private communications with your attorney about those records; it does not shield the underlying medical information from legitimate discovery.