Security

Medical records are protected
health information. We started there.

A personal injury file is full of it. So is a custody file with mental health evaluations in it. That constraint shaped the database before the first feature was written — which is a different thing from adding a compliance page later.

Worth saying plainly

There is no such thing as HIPAA certification.

No government body issues one. No auditor can grant one. If a vendor tells you they are “HIPAA certified,” they are describing something that does not exist.

HIPAA compliance is what you actually implement — and what you can prove you implemented. So rather than claim a badge, here is the list. Ask any vendor you are evaluating for theirs — the answer tells you a great deal.

What is implemented

The controls, in plain English.

Encryption at the field level

Protected health information is encrypted in the individual database fields that hold it, not just on the disk underneath. A copy of the raw storage is not a copy of your clients’ records.

Separation enforced by the database

One firm cannot reach another firm’s data, and the rule is enforced at the database layer rather than by application code remembering to check. Code has bugs; this holds regardless.

Every access recorded

Who opened what, when, and what they did with it — written to a separate audit database and kept for six years. This is what satisfies a client’s right to know who has seen their records.

Multi-factor authentication, required

Not an option a firm can switch off. Idle sessions time out on their own, because the realistic risk to a small firm is an unattended laptop, not a sophisticated attacker.

Business associate agreements, both directions

Signed with the infrastructure underneath us, and signed with your firm before any protected information is loaded. One agreement covering one vendor, instead of chasing five.

Your data is not training data

Client documents are used to answer your questions about your matters. They are not used to improve models, and they are not pooled with anyone else’s.

The question behind the question

“Can I check what it told me?”

The security question attorneys ask out loud is about data. The one they ask next is about trust in the output — and after a few well-publicized sanctions, they are right to ask it.

Every finding cites its source page. A chronology entry, a summary, an answer in case chat — each one points at the page it came from, and you can open it.
Nothing posts without you. Client status updates, intake answers writing into a matter, generated documents — all of it waits for an attorney to approve it.
From your file, not the internet. Answers come from your matter’s documents. The system does not invent case law, because it is not reaching for any.
It tells you what it could not find. A generated document flags what is missing rather than filling the gap with something plausible.

Under the rules of professional conduct the work is yours no matter what produced the first draft. So the product is built to be checked — that is the point of citing every page, and the point of the approval step before anything reaches a client or a court.

For your file

Diligence, before you commit.

Firms handling protected information often need documentation for their own records or their carrier’s. Ask and you get it — the architecture in writing, the business associate agreement to review, and a direct answer about anything not covered here.

Request Security Documentation

Bring your hardest security question.

You will be talking to the person who designed the architecture, not to a sales engineer relaying the answer. If something is not built yet, you will hear that too.