Does Your Law Firm Need a BAA With an Outsourcing Vendor? HIPAA for PI and Defense Firms
A law firm is a HIPAA business associate when it provides legal services to a covered entity, such as a hospital or health plan, that involve protected health information. Any vendor that receives that information on the firm's behalf is a subcontractor business associate. HHS says the firm must have a BAA with that vendor before disclosing it. A plaintiff firm handling its own client's records obtained by authorization usually is not acting on a covered entity's behalf, but it still owes confidentiality and should contract for equivalent protections.
By OASIS Legal Operations
Last updated
- law firm business associate agreement vendor
- HIPAA business associate law firm
- subcontractor BAA
- HIPAA medical records outsourcing
- personal injury HIPAA
- insurance defense HIPAA
- PHI vendor law firm
Short answer
A law firm is a HIPAA business associate when it provides legal services to a covered entity, such as a hospital or health plan, that involve protected health information. Any vendor that receives that information on the firm's behalf is a subcontractor business associate. HHS says the firm must have a BAA with that vendor before disclosing it. A plaintiff firm handling its own client's records obtained by authorization usually is not acting on a covered entity's behalf, but it still owes confidentiality and should contract for equivalent protections.
Key takeaways
- The HIPAA definition of business associate expressly includes "legal" services to a covered entity involving PHI (45 CFR 160.103).
- Subcontractors that create, receive, maintain or transmit PHI for a business associate are business associates too.
- Defense firms representing hospitals and health plans: put a subcontractor BAA in place with any vendor first.
- PI firms: HIPAA may not be the governing rule, but Rule 1.6, state privacy law and protective orders are. Require BAA-level terms anyway.
When is a law firm a HIPAA business associate?
Under 45 CFR 160.103, a business associate includes a person who provides services to a covered entity, including "legal, actuarial, accounting, consulting" services, where the service involves disclosure of protected health information. HHS gives the example of an attorney whose legal services to a health plan involve access to PHI. A firm defending a hospital in a malpractice case, or a health plan in a claims dispute, is in that position.
Does the firm's outsourcing vendor need a BAA?
If the firm is a business associate, yes. The definition includes "a subcontractor that creates, receives, maintains, or transmits protected health information" on behalf of the business associate. HHS states that a business associate must establish a BAA with its subcontractor before disclosing PHI to it. Downstream subcontractors are bound the same way.
What about plaintiff PI firms?
A plaintiff firm usually receives its own client's records through the client's authorization. It is acting for the patient, not on behalf of the covered entity, so the business-associate definition generally does not reach it. That does not make the records less sensitive: - the duty of confidentiality applies; - state medical-privacy laws may apply; - protective orders often govern medical records; - carriers and co-counsel may impose data-security terms.
The practical answer is the same: contract with the vendor for confidentiality, access limits, approved tools, breach notice and deletion on completion.
What about insurance defense firms representing an insured?
When the defense is for an individual or business insured, not a covered entity, records usually arrive by authorization, subpoena or discovery. HIPAA's business-associate rules may not apply to the firm in that role, but protective orders and the carrier's litigation and data-security guidelines often do. Read the carrier's guideline before sending any file to a vendor.
What should the vendor agreement contain either way?
| Term | Why |
|---|---|
| Permitted uses limited to your matter | Minimum-necessary access |
| Named personnel and access logs | Supervision and accountability |
| Approved tools only; no public AI tools for client data | Prevents uncontrolled disclosure |
| Encryption in transit and at rest | Data protection |
| Breach notice within a fixed time | Your own notice obligations |
| Return or destruction at completion | Florida Opinion 07-2 recommends irretrievable destruction |
| Subcontractor BAA where HIPAA applies | 45 CFR 160.103; HHS guidance |
How OASIS handles medical records
OASIS limits access to the assigned paralegal and a quality reviewer, works only in approved tools, and puts confidentiality agreements in place before any file is shared. We sign a subcontractor BAA where your firm is a business associate. Our Security page describes the controls. The first 12 working hours are free, then $12 an hour.
FAQ
Is a law firm a business associate under HIPAA?
When it provides legal services to a covered entity that involve access to PHI, yes. HHS uses an attorney representing a health plan as an example.
Does a law firm need a BAA with its vendors?
If the firm is a business associate and the vendor will receive PHI, HHS says a BAA with the subcontractor must be in place before disclosure.
Is a personal injury firm covered by HIPAA?
Generally not as a business associate when it obtains its own client's records by authorization. Confidentiality duties, state privacy law and protective orders still apply.
Can PHI be sent to an offshore vendor?
HIPAA does not ban offshore subcontractors outright, but the firm must meet its contractual, security and ethical duties. Some clients, carriers or protective orders restrict offshore access, so check before sending.
Sources
Related services and reading
- Security
- Confidentiality when outsourcing legal work
- Is it ethical to outsource legal work to india
- Medical chronologies
- Contact
View specimen: Medical Chronology: Calloway v. Vance
We assist licensed attorneys; we do not provide legal advice or represent clients. This article is general operational information. Applicable law and professional rules must be checked by supervising counsel.
