A law firm is a HIPAA business associate when it does legal work for a health care provider, health plan or clearinghouse and that work involves the client’s protected health information. HIPAA for law firms starts with that test. The federal definition of business associate names “legal” services first in its list (45 CFR 160.103), and HHS gives “an attorney whose legal services to a health plan involve access to PHI” as an example (HHS).
Once a firm meets that test, it answers to the HIPAA Security Rule directly, on top of the agreement it signed and Louisiana’s ethics rules.
Talk to an advisor
Ask about your own setup.
We ask what you’re trying to accomplish and tell you what we’d look at first. It costs nothing to talk, and no price comes up on this call.
When a law firm becomes a business associate
Three things have to be true: your client is a covered entity (a provider, health plan or clearinghouse), you’re doing work for that client, and the work involves health information the client gives you or that you create for them. Defending a hospital in a malpractice case, handling a clinic’s employment dispute with patient records in the file, or advising a health plan on claims all qualify. The same definition covers accounting and consulting, so a CPA firm auditing a medical practice is in the same position.
Representing the patient is different. A plaintiff’s firm that gets medical records with its own client’s authorization isn’t doing work for the provider, so the business associate definition doesn’t reach it. Louisiana’s Rule 1.6(c) still asks for “reasonable efforts” to protect that client’s information, as we cover on our law firm IT page.
What HIPAA asks of a business associate
HHS says it can take enforcement action against a business associate directly for a short list of failures (HHS fact sheet). Four of them land on a law firm’s IT:
The Security Rule
A business associate has to meet the Security Rule’s safeguards, starting with an “accurate and thorough” risk analysis and procedures to “regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports” (45 CFR 164.308).
Breach notice to the client
After discovering a breach, the firm must tell the covered entity “without unreasonable delay and in no case later than 60 calendar days after discovery” (45 CFR 164.410). A breach counts as discovered when any employee knows, or would have known with reasonable diligence.
Agreements with your own vendors
If an e-discovery platform, records vendor or IT provider handles that health information for you, the firm needs a business associate agreement with them too.
Use only what the agreement allows
Health information in the file can be used and disclosed only as the agreement and the rule permit, and only the minimum needed.
HHS has proposed changes to the Security Rule. Our post on HIPAA Security Rule updates covers where that stands.
Case file: a law firm breach of client health records
What the record shows
Tarter Krinsky & Drogin, a New York law firm, filed a notice with the California Attorney General dated September 4, 2026 (notice letter). The firm said it became aware of suspicious activity on September 10, 2025, and that there was “unauthorized access to certain TKD servers at various times between July 9, 2025 and September 9, 2025.”
The letter explained why patients were getting it: “Our clients include one of your healthcare providers, and through that representation, we were in possession of certain protected health information.”
The firm said it notified federal law enforcement, is reviewing its security policies, has added security measures and is offering 12 months of credit monitoring. It said it is not aware of any misuse. The California listing shows the breach dates as September 9 and 10, 2025 (California AG). HIPAA Journal, a secondary source, reported on October 23, 2026 that the health information of 196,645 patients of the firm’s healthcare clients was involved (HIPAA Journal).
What we don’t know
The notice doesn’t say how the attackers got in, why about a year passed between the firm noticing the activity and the date on the letter, or what the firm’s agreements with its healthcare clients required. We don’t know whether HHS has opened an inquiry.
Questions for your firm
- 01The firm held patient records because of one client relationship. Do you know which matters put health records in your files, and where those files are stored?
- 02The access ran for about two months before it was noticed. Who at your firm reviews sign-in and server activity, and how often?
- 03Notice came about a year after discovery. If client files were taken, how long would it take you to work out which clients, and which of their patients, were affected?
Louisiana adds its own rule
Louisiana’s breach law has a section written for firms holding data they don’t own. A person that “maintains computerized data that includes personal information that the agency or person does not own shall notify the owner or licensee of the information” after discovering a breach, and the notice deadline is “not later than sixty days from the discovery of the breach” (La. R.S. 51:3074). The same statute requires “reasonable security procedures and practices appropriate to the nature of the information.” When a breach falls under both laws, both clocks start at discovery.
How we set up a firm that holds client health records
We sign a business associate agreement with every client that handles patient information. For a law firm, we set access by matter so health records are seen only by the people working on them, and we shut off sign-ins from abroad. Shared links open only for the people you name. Our email sign-in monitoring has caught multiple takeover attempts at our clients.
We run an annual HIPAA risk assessment, keep hourly immutable backups copied off-site daily, and run endpoint detection backed by a 24/7 security operations center that can isolate a device. Log review follows the approach in our security log management guide.
How this could happen at a firm like yours
These are illustrations, not a description of what happened at any named firm.
- A firm defending a clinic keeps every discovery production on one file share that all attorneys and staff can open. What we would have done: restrict that matter’s folder to the people on the case and record who opens it.
- A paralegal’s mailbox password is reused from a personal account, and the account has no second factor. What we would have done: require multifactor sign-in for every mailbox and block sign-ins from countries where the firm doesn’t work.
- The firm’s e-discovery vendor processes medical records, but nobody signed a business associate agreement with it. What we would have done: list every vendor that touches the records and flag the missing agreements for the firm’s managing partner.
Case log
- October 2026: Tarter Krinsky & Drogin notice of data event, letter dated September 4, 2026 (California AG).
If your firm represents a provider or health plan, start with the matter list and where those files live. Book a 15-minute call and we’ll walk through what a HIPAA risk assessment would cover for your firm. See our IT for law firms page for how we work.
Related reading
Frequently asked questions
Is a law firm a business associate under HIPAA?
Yes, when it does legal work for a health care provider, health plan or clearinghouse and that work involves protected health information. Legal services are named in the federal definition of business associate, and HHS uses an attorney working for a health plan as an example. A firm working for the patient instead isn’t a business associate for that matter.
Do law firms need a business associate agreement?
A firm that is a business associate needs one with the covered entity it works for before it receives health information. It also needs agreements with its own vendors that handle that information, such as e-discovery or records services, because HHS can hold a business associate liable for skipping them.
Does HIPAA apply to personal injury lawyers?
Usually not directly. A personal injury firm gets medical records from its own client, the patient, with the client’s authorization, so it isn’t working for the provider. Ethics rules and Louisiana’s Rule 1.6(c) still require reasonable efforts to protect those records.
How long does a business associate have to report a breach?
Without unreasonable delay and no later than 60 calendar days after discovery, under 45 CFR 164.410. The notice goes to the covered entity, which then notifies patients. A breach is treated as discovered when any employee knew, or would have known with reasonable diligence.
Sources
- eCFR, 45 CFR 160.103, definition of business associate
- HHS, Business Associates FAQs
- HHS, Direct Liability of Business Associates fact sheet
- eCFR, 45 CFR 164.308, administrative safeguards
- eCFR, 45 CFR 164.410, notification by a business associate
- Tarter Krinsky & Drogin notice of data event, September 4, 2026
- California Attorney General data breach listing
- HIPAA Journal, October 23, 2026 (secondary)
- La. R.S. 51:3074
Next step
Let us handle this for you.
We tell you which rules apply, put safeguards in place and hand you the policies.
- 15 minutes
Tell us which question brought you here and how your office runs.
We’ll tell you how it applies to you and what we’d look at first.
If we’re not the right fit, we’ll say so.
