Is ChatGPT HIPAA compliant for law firms?
You have 214 pages of medical records and an AI that could summarize them in a minute. Before you paste them in, two separate rules apply, and only one of them is HIPAA.
You have 214 pages of medical records and a tool that could summarize them in ninety seconds. Before you paste anything in, two separate sets of rules apply to what you are about to do, and most of the advice circulating about this only addresses one of them.
The short answer on the HIPAA question: consumer ChatGPT is not offered under a business associate agreement, so it is not a HIPAA-compliant destination for protected health information. The longer and more useful answer is that HIPAA may not be the rule binding your firm at all, while a rule that definitely does bind you gets almost no attention.
Work out which one applies to you.
Are you even covered by HIPAA?
HIPAA binds covered entities and their business associates. A law firm is rarely a covered entity. A plaintiff's firm that receives its own client's records under an authorization is usually holding them as the client's representative rather than as a business associate, which means HIPAA is not what governs your handling of them.
Unless you work for a covered entity
Defense counsel for a hospital, a health plan, or a provider group is doing legal work that involves protected health information on that client's behalf. That is the classic business associate relationship, it requires a signed BAA, and everything downstream of you needs one too.
Your ethics rules always apply
Whether or not HIPAA reaches you, Rule 1.6 does. Client medical records are confidential information, and putting them into a third-party tool is a disclosure you have to make reasonable efforts to protect. This is the rule most firms skip past on the way to arguing about HIPAA.
The ABA addressed this directly. Formal Opinion 512, issued in July 2024, takes up generative AI and lawyers' duties. It covers competence in understanding what the tool does with your input, confidentiality including whether client consent is needed before entering information into a self-learning system, communication with the client about how you are using it, and the effect on fees when a task that used to take four hours now takes ten minutes. Read it before you set firm policy. Your state bar may have issued its own opinion on top of it.
The question is retention, not branding.
"Is it HIPAA compliant" is a question about paperwork. What actually protects your client is what the vendor does with the data after the answer comes back. CaseFuze runs its agent on models offered under HIPAA-compliant terms, does not retain your prompts, uploads, or matter data on those models, and does not permit them to be used for training. The agent reads the case out of the database you are already working in, which removes the copy-and-paste step where most exposure happens.
- Nothing retained, nothing trained on. The records you upload are used to answer your question and are not kept afterwards.
- Your choice of model, all under the same terms. Switch providers per task without the compliance position changing underneath you.
- No pasting into a browser tab. The agent already has the matter, the parties, the documents, and the ledger, so the records stay inside the system holding the file.
Six things to check in the vendor's terms.
Will they sign a BAA?
Only relevant if you are a business associate, but if you are, this is not optional and a marketing page claiming compliance is not a substitute for the signed agreement.
How long is input retained?
Look for a stated retention period in the contract rather than a blog post. "We do not train on your data" and "we do not keep your data" are different promises, and vendors often make only the first.
Is your input used for training?
Consumer tiers frequently default to yes with an opt-out buried in settings. Business tiers usually default to no. Find the sentence that says so and keep a copy of it.
Who else touches the data?
Subprocessors, hosting regions, and human reviewers. A vendor that reviews a sample of prompts for quality is reviewing your client's medical history unless it has excluded you from that.
Can you control it at firm level?
Individual attorneys choosing their own settings is not a policy. You want administrative control over which tools are available and what they are permitted to do with a file.
Do you need to tell the client?
Opinion 512 discusses when informed consent is required. At minimum, know what your engagement letter says about how you use technology on the matter, and consider whether it should say more.
Read the whole record before lunch.
Upload the medical records, the deposition, or the file the adjuster sent, and get back a summary, a chronology, or the demand letter draft, on models that keep nothing and train on nothing. The agent already knows the matter, so there is no context to paste and nothing to leak in the pasting. In the $49 plan.
Common questions about AI and medical records.
Is ChatGPT HIPAA compliant?
My client signed an authorization. Does that cover putting the records into AI?
Can I use AI on records if I redact the name first?
Do I have to tell my client I used AI on their case?
Can I bill for the time the AI saved me?
The software that does this for you.
CaseFuze handles the ledger, the statement, and the checks. $49 per user per month.