HIPAA at Legal Intake: Handling PHI on the First Call

Who does HIPAA apply to?

HIPAA’s Privacy, Security and Breach Notification Rules apply to covered entities and their business associates, and to no one else. That is how HHS’s covered-entity guidance puts it: “If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules.” There are three kinds of covered entity. Health care providers, such as doctors, clinics, psychologists, dentists, chiropractors, nursing homes and pharmacies, are covered only if they transmit information electronically in connection with a transaction for which HHS has adopted a standard. Health plans include insurers, HMOs, company health plans and government programs such as Medicare and Medicaid. Health care clearinghouses convert nonstandard health information into standard formats, or the reverse. A business associate is a person or organization that performs certain functions for a covered entity, or provides certain services to it, involving protected health information. HHS also links a CMS decision tool for checking covered-entity status.

Is a law firm a covered entity under HIPAA?

A law firm is usually not a covered entity under HIPAA, because it is not a health plan, a health care clearinghouse or a health care provider. A personal injury firm that hears about a client’s fractures, surgery and physical therapy is still not a provider of that care. The same is true of a criminal defense firm told about a client’s medication in jail, or an immigration firm told about a medical condition in a hardship case. None of those facts turns the firm into a covered entity. A vendor that markets intake as “HIPAA compliant” to a PI firm is answering a question that usually does not arise. The firm’s real obligations on that call come from the rules of professional conduct and any other law that applies to the firm. HIPAA can still enter the picture in two ways: when the firm works for a covered entity, and when it requests records from one.

When is a law firm a HIPAA business associate?

A law firm is a business associate when it provides legal services to or for a covered entity and those services involve the disclosure of protected health information from that covered entity to the firm. The definition is in 45 CFR 160.103, paragraph (1)(ii), which lists “legal, actuarial, accounting, consulting” and other services. A firm defending a hospital in a malpractice case, or advising a health plan on a matter involving member records, can be a business associate when the work involves PHI from the client. In those engagements the covered entity must have a business associate agreement with the firm, and HHS says business associates are directly liable for compliance with certain provisions of the HIPAA Rules. The definition also reaches downstream. Paragraph (3)(iii) makes a subcontractor that creates, receives, maintains or transmits PHI on behalf of a business associate a business associate too. That is the point where a firm’s intake vendor could be pulled in: only if the vendor handles PHI on the firm’s behalf in a business associate engagement.

Is medical information on a personal injury intake call PHI?

When an injured person describes their own injuries to a law firm that is not acting for a covered entity, HIPAA does not govern that conversation. The business associate definition turns on services to a covered entity that involve disclosure of PHI from that entity. A caller telling a PI firm about their own treatment is not a disclosure from a hospital or a health plan. That does not make the information any less sensitive. The caller is a prospective client under ABA Model Rule 1.18, and the firm may not use or reveal what they share, even if it declines the case. State privacy laws may also apply to health information a firm holds, so firms should check their own state. The practical answer is to treat injury and treatment details as the most sensitive part of the intake record. Collect what the attorney needs to evaluate the case, store it with limited access, and keep it out of anything shared outside the firm.

When does HIPAA come into a personal injury case?

HIPAA usually enters a personal injury case when the firm asks a provider for the client’s medical records. Providers that are covered entities generally may not use or disclose protected health information without a valid authorization, unless another HIPAA rule permits it. That rule is in 45 CFR 164.508(a)(1). So the HIPAA step falls on the provider releasing the records, and the firm’s job is to supply a valid authorization signed by the client. Firms typically get that authorization signed with the engagement documents, after the attorney has decided to take the case. That has a direct consequence for intake. The first call should not try to collect records, authorizations or detailed medical histories. It should note who treated the caller, when, and whether treatment is continuing, so the attorney can judge the case and the paralegal can request records later. Our personal injury intake form guide lists the treatment fields to capture.

What medical details should intake collect on the first call?

Intake should collect enough medical detail to evaluate the case and plan records requests, and no more. Comment [4] to Rule 1.18 says a lawyer considering a new matter should limit the initial consultation to information reasonably necessary to decide whether to take it. The table applies that to medical details.

Does a law firm need a business associate agreement with its intake vendor?

A law firm needs a business associate agreement with its intake vendor only if HIPAA reaches the arrangement. That happens when the firm is itself a business associate and the vendor will create, receive, maintain or transmit PHI on the firm’s behalf. In that case the vendor is a subcontractor business associate under 45 CFR 160.103. HHS’s business associate guidance says the agreement must describe the permitted uses and disclosures of PHI, among other required terms in 45 CFR 164.504(e). For ordinary intake from the public, such as a driver hurt in a crash, a family calling about an arrest, or a relative calling about a detention, the firm is usually not a business associate. A BAA is then not the right tool. A confidentiality agreement and the vendor diligence in ABA Formal Opinion 512 are. HHS also notes a narrow conduit exception, which covers only pure transmission services. It does not cover a vendor that accesses the information to do its work.

What should a firm ask an AI intake vendor about health information?

A firm should ask an AI intake vendor how it stores, limits and deletes the health details callers share. These questions apply whether or not HIPAA governs the call.

1. Where are recordings, transcripts and summaries stored, and who at the vendor can access them?
2. Is caller information used to train AI models?
3. How long is call data kept, and can the firm set or shorten that period?
4. What happens to the data when the contract ends?
5. Will the vendor notify the firm of a breach or a demand for call data?
6. Does the vendor claim HIPAA compliance, and if so, on what basis and for which engagements?

How does Della handle medical details on intake calls?

Della, Call Della’s intake specialist, captures the injury and treatment basics a personal injury attorney needs to evaluate a case, and leaves records and authorizations to the firm. On a PI call she asks about the incident, injuries, treatment and insurance, and files the answers in a dossier with a summary, urgency score, recording and transcript. Records requests and authorizations stay with the firm, and she never gives legal advice. She tells callers she is an AI if they ask and never claims to be human. Call Della does not describe Della as HIPAA compliant. Our security page explains how call data is handled. If your firm works as a business associate for a hospital or health plan, tell us before routing those calls. The calls are worth answering: according to ABA Law Practice Magazine (2025), only 40 percent of firms answered the phone in Clio’s 2024 secret-shopper study. See after-hours personal injury intake, and read our guide to privilege and confidentiality at intake.