HIPAA doesn't certify software. Here's what to ask instead.

If you've shopped for case management software, you've seen badges that say "HIPAA certified." Be wary of them. The government doesn't certify software under HIPAA, and there is no official HIPAA certification for a product to hold.

That doesn't mean the question doesn't matter. A plaintiff firm's cases are full of medical records, and the software that holds them should be built to protect them. It means the badge isn't the answer. Better questions are.

What HIPAA actually asks for

HIPAA's Security Rule asks for safeguards around electronic health information: administrative, physical and technical. When a vendor handles that information on someone's behalf, a business associate agreement (a BAA) sets out what the vendor must do to protect it.

Whether your firm is itself covered by HIPAA depends on the work it does, and your own counsel can tell you. Either way, the medical records in your cases deserve the same care, and a vendor that will sign a BAA is telling you it is prepared to be held to it.

Questions to ask any vendor

Ask these before you upload a single file:

1. Will you sign a BAA before we upload anything? Not after the trial, not once you're a bigger customer. Before.
2. Where does our data live, and does any of it leave? That includes the AI models. A model that runs on someone else's servers is someone else handling your clients' records.
3. Is our data used to train AI models? Yours or anyone's.
4. How is our firm's data kept apart from other firms'? "Separate accounts" isn't an answer. Ask where the separation is enforced.
5. Is there an audit log? Every change, by people and by AI, should be on the record.
6. What happens to our data if we leave? You should get all of it back, and they should delete their copy.
7. Who are your sub-processors? Every provider that touches your data should be named.

How we answer them

• The BAA: we sign one with your firm before any client data arrives.
• Where it lives: your case database, your documents and the AI models all run inside one AWS account in the United States.
• Training: nothing your firm keeps in PlaintiffStack is used to train any model.
• Separation: the database itself scopes every request your team makes to your firm.
• The record: every change is on the record, whether a person made it or an agent did.
• Leaving: we export your cases, contacts and documents for you, then delete our copy.
• Sub-processors: they're listed on our security page.

One more thing worth asking: where a vendor stands on audits like SOC 2. Ours is in progress, and we say so. Until the report is out, we'll walk your IT lead through how PlaintiffStack is built and answer your security questionnaire in writing.

See all of it on our security page.