Protecting Client Data When Your Law Firm Uses AI

Protect more than personal identifiers

Personally identifiable information, or PII, includes details that identify someone directly or through a combination of facts. Names, contact details, government identification numbers and account information are obvious examples. A distinctive event or combination of location, employment and dates can also make someone recognizable.

Protected health information, or PHI, has a specific meaning under HIPAA. Whether HIPAA obligations apply depends on the information and the firm's role, including whether it acts as a business associate. Health information can remain highly sensitive even outside that framework. [1]

Client confidentiality also extends beyond PII and PHI. Litigation strategy, settlement discussions, privileged communications and confidential business records need protection even when no individual's name appears. The firm's protocol should therefore assess the whole disclosure, not simply count redacted fields.

Redaction and de-identification are different

Replacing a name with “Client A” can reduce exposure, but remaining facts may still identify the person.

For HIPAA purposes, HHS describes two de-identification methods: Safe Harbor and Expert Determination. Safe Harbor requires removal of specified identifiers and no actual knowledge that the remaining information could identify an individual. Expert Determination requires a qualified expert's documented assessment of very small identification risk. Identifiers in narrative text matter as well as those in structured fields. [2]

Do not label an extract “HIPAA de-identified” merely because names were removed. Treat pseudonymized or partially redacted material as sensitive unless the appropriate review establishes otherwise. Client confidentiality, protective orders and contractual restrictions still require a separate assessment.

Maintain a register that identifies the permitted product, account type, configuration, information classes and workflows. Assign an owner who can approve changes and answer staff questions.

Require staff to use firm-managed accounts for approved client work. An individual subscription or a disabled training setting should not substitute for the firm's review.

That review should cover vendor terms, access, retention, connected services and incident handling. California's 2026 guidance emphasizes understanding how a tool handles information and warns against relying solely on broad marketing assurances. [3]

Decide what the task actually needs. A generic outline may require only a fictional scenario. A formatting task may need an empty template. A limited comparison may need a few approved clauses rather than an entire agreement.

If redaction removes facts essential to the analysis, use an approved confidential workflow or perform the task without the tool. Do not restore sensitive facts to an unapproved service to improve its response.

Prepare a separate working copy and protect the original. Review names, contact information, identifiers, account details, medical record numbers and identifying dates or locations. Also consider signatures, faces, exhibits and unusual narrative details.

Use consistent placeholders when relationships matter to the task. Keep any mapping back to real identities inside the firm's restricted systems. Do not attach that mapping to the prompt.

Do not upload an unredacted record to an unapproved AI service and ask it to remove sensitive information. The disclosure has already occurred by that point. An approved internal redaction system can assist, but its output still needs verification.

A black rectangle or highlight can conceal text visually without removing it. Use a redaction function that actually removes content, apply the changes and save a new copy. Adobe distinguishes redaction from sanitization of hidden information such as metadata, comments and layers. [4, 5]

Reopen the saved file. Search for removed values and test copying or extracting text. Check filenames, document properties, annotations, attachments and searchable OCR text. For office files, also inspect tracked changes, comments, hidden sheets and embedded material.

Use a second reviewer for high-risk inputs. Automated detection can help find patterns; it should not be the sole release check.

The following example is fictional. It illustrates reducing disclosure, not a determination of HIPAA de-identification.

The second prompt changes the task so real client information is unnecessary. If the objective is an actual case chronology, fictional material cannot replace the case record; that work requires an approved environment and appropriate handling of the source information.

Restrict who can access the workspace and its outputs. Configure available identity, retention and sharing controls, and remove access promptly when people leave.

Review connected document systems separately. Limit access by matter and role, and test restrictions with realistic accounts. Require human review before an AI agent sends messages, files documents or transfers client information externally. California's guidance specifically addresses these agentic access and transmission risks. [3]

Review feedback settings too. Anthropic's commercial policy, for example, describes training and retention implications when users submit feedback. Staff should not include client content in vendor feedback unless the firm has authorized that disclosure. [6]

Treat prompts and generated results as part of the information lifecycle. Store accepted work in the appropriate matter location and follow retention rules. Outputs may repeat sensitive input or introduce unsupported facts.

An attorney should verify substantive work against the source record and applicable legal authorities. No summary should move into a filing or client communication solely because it reads convincingly.

If HIPAA applies, approve the complete processing path

For a HIPAA-covered entity or business associate using a cloud provider to process ePHI on its behalf, HHS guidance requires an appropriate BAA and compliance with applicable HIPAA obligations, including risk analysis. Encryption alone does not eliminate business associate requirements. [1]

Confirm that the agreement covers the actual product, features and downstream services in use. A “HIPAA-ready” description is a starting point for review, not blanket authorization for every upload or integration.

Give staff a clear incident route

If someone uploads information to the wrong account or service, require immediate reporting to the firm's designated security and legal contacts. Stop further sharing, record the affected service and material, and follow instructions for containment and evidence preservation.

Do not assume deleting a chat reverses the disclosure. Authorized leadership should coordinate with the vendor, assess access and retention, and determine any client, contractual or regulatory notification obligations.

Make the protocol part of everyday work

Give staff a short pre-upload check: approved tool, permitted material, minimum necessary input, verified redaction and assigned reviewer. Train with fictional documents, review exceptions and reassess controls when vendors add features or change terms.

Allnext Legal helps law firms put AI governance, security controls and practical staff training into place so adoption supports the way the firm operates.