HIPAA and BAAs for Legal Nurse Consultants

Whether HIPAA applies to you directly depends on whose records you hold and who hired you. On defense work for a hospital or other provider, the defense firm is often the provider's business associate, and it may ask you to sign a business associate agreement as its subcontractor. On plaintiff work, records usually arrive through the patient's authorization or discovery, and protective orders, state law and your agreement with the firm usually govern how you handle them. Either way, treat every record as protected health information, and ask the retaining attorney which rules apply to the case.

The terms in plain words

• Covered entities are health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically. Hospitals, nursing homes and most physician practices are covered entities.
• A business associate is a person or company that does work for a covered entity involving protected health information. Lawyers who represent a hospital can be business associates, and so can their subcontractors, which can include a nurse consultant they hire.
• A business associate agreement (BAA) is the contract that passes HIPAA obligations down that chain: what you may do with the information, how you protect it, and what you do if something goes wrong.

HIPAA is federal, and state privacy laws can add requirements. That is why the attorney, not a blog post, should tell you what applies on a given case.

How it usually plays out

The side you work for shapes more than the privacy rules (see plaintiff vs defense work as an LNC). For records, these are the common patterns:

These are patterns, not rules. The same type of client can be set up differently, so ask every time.

What a BAA usually asks of you

Read a BAA for these points before you sign, and have an attorney review the first one:

1. Permitted uses. Usually only for the services in the engagement, and only the minimum necessary.
2. Safeguards. Administrative, physical and technical protections for the information. Make sure you can actually do what it describes on the devices and accounts you use.
3. Reporting. What you must report (a breach, a security incident, an improper use), to whom and how quickly.
4. Your own subcontractors. If a team member, transcription service or software tool touches the records, you may need a matching agreement with them.
5. Return or destruction at the end, and what to do if something cannot be returned or destroyed.
6. Indemnification and insurance requirements. These go beyond HIPAA and change your risk. Ask your attorney and your broker (see liability insurance for LNCs).

Everyday safeguards

These apply whether or not you sign a BAA:

• Keep records in one secure place. A case platform with encryption and access logs beats downloads spread across devices. On NurseTide Legal, records stay private until the firm hires; see sharing medical records securely.
• Lock your devices. Disk encryption, a strong password, automatic screen lock, and multi-factor authentication on every account that touches case files.
• Keep the work separate. A separate user account for consulting, no shared family computer, and no personal email for records.
• Limit copies. No unencrypted USB drives, no cloud folders the client has not approved, and shred anything you print.
• Minimum necessary in messages. Refer to the case by its matter name in emails, and leave identifiers out of anything that does not need them. Public case descriptions should carry none at all; see redacting a case brief.
• Ask before using AI tools. Uploading records to a tool discloses them to its vendor. See AI tools for legal nurse consultants.
• Close out the matter. Return or delete records as the engagement letter or BAA says, and note when you did it.

Your day job is a separate risk

If you still work at a hospital, never use your work access to look up a patient, provider or record connected to a case, even out of curiosity. Access without a work reason is a privacy violation at your employer, whatever your consulting role. Never review a case involving your own facility either; that is a conflict as well as a privacy problem (see conflicts of interest).

If something goes wrong

A lost laptop, an email sent to the wrong person, a login you did not make: tell the retaining attorney right away and follow the reporting terms in your BAA or engagement letter. Do not decide on your own whether it "counts" as a breach; that assessment belongs to the client and its counsel. Write down what happened and when you noticed.

Put it in writing at the start

The cleanest time to sort this out is before records arrive. Ask the attorney whether a BAA, a protective order or a confidentiality agreement applies, get copies of anything you must follow, and record the arrangement in your engagement letter. Our article on engagement letters lists what else to include.

Next step

Start with the free LNC Academy course: it covers the role, the legal basics and record review, so your first case starts on solid ground.

General information for legal professionals, not legal advice. Rules and deadlines vary by state; check the statute and local rules that govern your case.