Eleven questions to ask before you upload medical records to an AI tool

A plaintiff firm's files are mostly medical records. Every AI tool that promises to read them faster is asking you to hand them over first. Before you do, ask the vendor these eleven questions, and get the answers in writing.

We've answered each one for PlaintiffStack below, including the two where our answer is "not yet". A vendor's answers are only useful if they're honest, so judge ours the same way.

Why these questions

Two sets of rules sit behind them. HIPAA requires a business associate agreement when a vendor handles protected health information on behalf of a covered entity, and sets out what that agreement must require (HHS; 45 CFR 164.504(e)). Whether your firm is itself covered depends on its work, and your counsel can tell you.

The professional rules apply either way. The ABA's Formal Opinion 512 says lawyers using generative AI have to understand the tools well enough to protect client confidences, and to review what the tools produce (ABA Formal Opinion 512). The State Bar of California's practical guidance on generative AI makes the same points for California lawyers (State Bar of California). We cover both in our guide to ABA Formal Opinion 512 for plaintiff firms.

The eleven questions

1. Will you sign a BAA before we upload anything?

Not after the trial, and not once you're a bigger customer. Before the first record.

Our answer: yes. We sign a business associate agreement with every firm before any client data arrives.

2. Where do our data and the AI models run?

A model that runs on someone else's servers is someone else handling your clients' records. Ask where the documents live, where the database lives, and where the model processes them.

Our answer: your case database, your documents and the AI models all run inside one AWS account in the United States. The models run on Amazon Bedrock inside that account. Data is encrypted at rest and in transit.

3. Is our data used to train any model?

Yours, the vendor's or anyone else's.

Our answer: no. Nothing your firm keeps in PlaintiffStack is used to train any model.

4. Who are your sub-processors?

Every company that touches your data on the vendor's behalf should be named, with where it runs and why.

Our answer: three, all in the United States: Amazon Web Services for hosting, the database and documents; Amazon Bedrock for the models; and Amazon SES for email delivery. They're listed on our security page. Integrations your firm chooses to turn on, like Dropbox, are your own providers.

5. Do you have a SOC 2 Type II report?

A Type II report means an independent auditor tested the vendor's controls over a period of months (AICPA). If a vendor has one, ask for it, check the period it covers, and read the exceptions.

Our answer: not yet. Our SOC 2 Type II audit is in progress, and so is ISO 27001. Until the report is out, we'll walk your IT lead through how PlaintiffStack is built and hosted, and answer your security questionnaire in writing.

6. How is our data kept apart from other firms'?

"Separate accounts" isn't an answer. Ask where the separation is enforced.

Our answer: the database itself scopes every request your team makes to your firm, so no request reaches another firm's cases.

7. Is there an audit log, and does it cover the AI?

You should be able to see what changed, when and by whom, and that includes changes an AI agent made.

Our answer: yes. Every change is on the record, whether a person made it or an agent did, and so is every change to how your workspace is set up.

8. What happens to our data when we leave?

You should get all of it back in a usable form, and the vendor should delete its copy.

Our answer: we export your cases, contacts and documents for you, then delete our copy.

9. Does every fact the AI produces cite its source?

A summary you can't check is a summary you have to redo. Ask whether a fact points to the document, the page and the words it came from.

Our answer: yes. Every fact an agent proposes cites the document, the page and the exact words, so checking takes a click. Drafts cite the page each fact came from. We explain why in why every AI-drafted fact should link to its page.

10. Does a person approve before anything changes or goes out?

Ask what the AI can do on its own: change a case, set a deadline, send a message.

Our answer: agents propose facts, deadlines and tasks, and none lands in a case until a person accepts it. One exception, said plainly: the summary at the top of each case is written by an agent, and earlier versions can be restored. Nothing goes to a client, a carrier or a court until a person sends it.

11. Can it read scanned records and faxes?

This is the question vendors least like to answer with a number, and the one that matters most for medical records. Many records still arrive as scans. Ask what the tool does with a page that has no readable text, and whether it tells you.

Our answer: not yet. Our agents read searchable PDFs, Word documents and text files. A file with no readable text is flagged in the document list, so your team knows the AI hasn't read it. Scanned pages inside an otherwise searchable PDF aren't read or flagged yet. If most of your records arrive as scans, factor that in.

How to use the answers

Put the questions in your vendor questionnaire, and ask for answers in writing. Compare them side by side, and weight the ones your clients would care about: who holds their records, whether a model learns from them, and whether a person checks what the AI says about them.

If a vendor can't answer one, that's an answer too.

Our legal AI security checklist has a longer version of this list. For our own answers in one place, see the security page and the FAQ, or read our earlier post on why HIPAA doesn't certify software.