Medical record review for solo attorneys: a field manual for firms with no nurse on staff

Every small firm that takes injury, malpractice, comp or disability cases ends up choosing among the same 3 routes. Most end up using all 3 at different times, which is the right answer. The mistake is picking one by habit.

The work does not change with firm size: sort by provider and date, strip duplicates, build a chronology with a page cite on every row, total the bills, list what should exist but was not produced, and flag every prior injury before defense counsel does. What changes is who does it and what their hour costs.

The 3 routes combine. The pattern we think works best for a small practice: software builds the cited first draft on every file, the lawyer or paralegal verifies what goes into the demand, and a nurse consultant is hired for the files that need clinical judgment, working from the cited draft instead of a raw box of paper. That puts the nurse's hourly rate on analysis, which is what you are paying for, and takes it off sorting. The fuller trade-off for firms of any size is in in-house vs outsourced medical record review.

Common beliefs that cost solos time

Published market rates for nurse consultants and review vendors vary widely, change often, and many vendors do not publish them. We will not quote a rate or a pages-per-hour figure we cannot verify. Here is 1 hypothetical file costed 4 ways, every input stated so you can swap in your own. The only real price in the table is the software rate from our own pricing page.

Read the ledger for its structure, not its totals. 3 things drive every one of these numbers, and the hypothetical makes them visible:

1. Attorney hours dominate. In option A, 95% of the cost ($6,600 of $6,920) is attorney time. Any route that moves reading off the lawyer and onto real verification wins.
2. Duplicates are a pricing trap. 400 of the 1,800 pages (22%) are repeats. Ask every vendor whether duplicates are billed.
3. Verification time is the swing variable. If the attorney in option C spends 12 hours verifying instead of 6, option C costs $140 + $60 + $3,600 = $3,800, more than option B. AI is cheaper only when the draft is cited well enough that checking it is fast.

How vendors price, and what to ask

A solo's caseload is lumpy. Seat pricing charges for capacity every month; per-page pricing follows the files and ties each dollar to 1 case (chapter 5). For reference, Medrecords AI Self-Service bills 10 cents a deduplicated page, down to 5 cents at volume, duplicates free; Enterprise On-Prem is an annual license. The medical record review cost guide shows how to convert any quote into a per-page figure.

No ethics rule was written for record review or for AI. The old rules govern both, and a solo carries them alone. 3 do most of the work.

Rule 1.1 and comment 8: technology competence

Rule 1.1 requires the knowledge, skill, thoroughness and preparation reasonably necessary for the representation. In 2012 the ABA amended the comment that explains how a lawyer stays competent:

"To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject."

By the count kept on the LawSites technology competence tracker, 40 states, the District of Columbia and Puerto Rico have adopted some version of it. Note the words "benefits and risks". Comment 8 does not tell you to use AI and does not tell you to avoid it. It tells you to know enough about the tool to judge both. For record review: how the tool reads scanned and handwritten pages, whether every statement points to a source page, and where the records go.

That cuts both ways. Declining a tool should be an informed choice too, made after you know what it does and what it costs.

Rule 1.6: confidentiality

Rule 1.6(c) requires reasonable efforts to prevent unauthorized access to or disclosure of information relating to the representation. A client's medical records are the most sensitive information in most injury files. Every route in chapter 1 moves them somewhere: to a nurse consultant's laptop, a vendor's portal, a software company's cloud, or a general chatbot's servers. The duty is the same for all 4. What changes is how much you can verify about where the pages go.

A HIPAA point that trips up plaintiff lawyers: a firm that receives records from its own client under an authorization is usually not a HIPAA covered entity or business associate for those records, so HIPAA itself may not bind the firm. Rule 1.6 does. A defense firm hired by a hospital is usually a business associate, and HIPAA reaches it directly. Either way, ask your vendor for a business associate agreement (BAA); chapter 11 covers its terms.

Rule 5.3: nonlawyer assistance, inside and outside the firm

Your paralegal, your outside nurse consultant, your records retrieval company and your software vendor are all nonlawyers assisting you. Rule 5.3 says:

"(b) a lawyer having direct supervisory authority over the nonlawyer shall make reasonable efforts to ensure that the person's conduct is compatible with the professional obligations of the lawyer"

The ABA changed the rule's title in 2012 from nonlawyer "assistants" to nonlawyer "assistance", and comment 3 lists outside services the rule reaches: document management companies, sending documents to a third party for printing or scanning, and Internet-based storage of client information. The same comment says the extent of the duty depends on the provider's education, experience and reputation, the nature of the services, the terms protecting client information, and the legal environment where the work is done. Opinion 512 applies that reasoning to AI vendors directly.

In a solo practice, you are the partner with managerial authority under 5.3(a) and the lawyer with direct supervisory authority under 5.3(b). There is no one else. That makes a written 1-page policy for your own office worth the hour it takes: which tools are approved, what may be uploaded to each, who verifies AI output, and how verification is recorded.

The ABA Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512, "Generative Artificial Intelligence Tools", on July 29, 2024. It creates no new duty. It maps 6 existing ones onto generative AI. It is also a model opinion: your state bar may have its own AI opinion, and where it differs, the state version controls. Several states, including California, Texas and Illinois, issued guidance before the ABA did.

What the opinion says about how much to verify

Opinion 512 gives no single answer on how much to verify. As the National Conference of Bar Examiners summarizes it, the review needed depends on the tool and the specific task, and using a tool for document review calls for more independent checking than using it to generate ideas.

We read that as 2 tiers for records work. Everything that leaves the office gets 100% verification at the cited page. Internal working material can be spot-checked, once you have tested the tool on files you already know. Keep a short note of that test.

Contingency lawyers sometimes assume billing rules do not touch them. They do: Rule 1.5 covers expenses as well as fees, and whether a software charge is a case expense or overhead is settled by the fee agreement you signed at intake. Hourly practices face the time question directly.

The 4 billing situations

A per-page price is easier to handle here than a subscription, because the charge on the invoice is already tied to 1 client's pages. In the chapter 2 hypothetical, the $140 software charge is a line a client can read and understand. A monthly seat split across clients invites the double-billing problem Opinion 512 warns about.

What to put in the engagement letter

Opinion 512 says boilerplate consent in an engagement letter is not enough where consent is required. We think a specific paragraph beats a silent letter every time, even when your tool does not train on inputs and consent may not be strictly required. It answers the client's question before it is asked, and it settles the cost treatment in writing at the start, which is when Rule 1.5(b) wants the basis of fees and expenses communicated.

USE OF AI SOFTWARE TO ORGANIZE YOUR MEDICAL RECORDS

To prepare your case, we will collect your medical and billing
records. We use [SOFTWARE NAME], a medical record review program,
to sort those records, remove duplicate pages, and prepare a draft
timeline and bills summary. Each entry in the draft points to the
page of your records it came from.

A lawyer at this firm checks the draft against your records before
anything is used in a demand, a court filing or a discovery answer.
The software does not give legal or medical opinions, and it does
not decide anything about your case. Where your case needs a medical
opinion, we will discuss hiring a qualified medical expert with you.

Protecting your information: [SOFTWARE NAME] has signed a business
associate agreement with us, holds a SOC 2 report, and is not
permitted to use your records to train its software. Your records
are stored [LOCATION, e.g. in the United States] and are deleted
[RETENTION TERM, e.g. within X days after we close your file].

COST OPTION 1 (case expense):
The software charges [PRICE BASIS, e.g. $0.10 per unique page].
We will pass that charge through as a case cost at the exact amount
we are billed, with no markup, and list it on your closing statement.

COST OPTION 2 (firm overhead):
The software cost is part of our office overhead. You will not be
charged for it.

We do not charge you for time spent learning to use this software.
If you prefer that we not use it on your case, tell us in writing
and we will review your records by other means. Ask us any
question about how we use it, at any time.

Client initials: ______   Date: __________

A solo does not need a records department. It needs a fixed weekly rhythm so records never pile up behind trial prep. This is the flow we would set up in a 1 to 5 lawyer office. AI touches only the middle steps.

The week, day by day

1. Monday
   New matters and requests

   Last week's intakes become authorization packets. Follow-ups go out on requests older than 30 days.

   Paralegal, 1 to 2 hours
2. Tuesday
   Receive and log

   Every production that arrived is logged (provider, dates, pages) and uploaded.

   Paralegal, 1 hour
3. Tuesday night
   AI drafts run

   Uploads are sorted, deduplicated and drafted, and new productions compared to the existing file.

   Software, no staff time
4. Wednesday
   Attorney review block

   A protected block. Open the flags first, then verify entries on files heading to demand.

   Attorney, 2 to 3 hours
5. Thursday
   Chase the gaps

   Accepted missing-record flags become targeted requests: the MRI mentioned but not produced, the chiropractor intake missed.

   Paralegal, 1 hour
6. Friday
   Demands and expert packets

   Verified files move to demand drafting, or to the expert or nurse with the cited draft attached.

   Attorney, as needed

The 30-day follow-up is not arbitrary. A HIPAA covered entity must act on an individual's access request within 30 days under 45 CFR 164.524(b)(2), with 1 extension of up to 30 more if it tells the patient why in writing. When a client requests records through the access right, HHS lets providers charge a flat fee of up to $6.50 for electronic copies of records kept electronically, as 1 option among the fee methods HHS permits. Requests made by a lawyer under an authorization are treated differently, and state copy-fee laws apply. The full procedure is in how to get medical records for a lawsuit.

Keep a verification log

Keep a 1-line log entry every time you verify AI output that will leave the office. It costs 30 seconds and it is the record that you did what Rules 1.1 and 3.3 ask.

CLIENT / MATTER: [NAME, FILE NO.]
TOOL: [SOFTWARE NAME AND VERSION OR DATE]

DATE | DRAFT (file name) | PAGES IN | USED FOR | VERIFIED BY | SCOPE OF CHECK | CHANGES MADE | TIME
-----|-------------------|----------|----------|-------------|----------------|--------------|-----
[MM/DD/YYYY] | [chronology_v2.docx] | [1,400] | [Demand] | [Initials] | [All 212 entries cited in demand checked at source page] | [3 dates corrected; 1 entry removed, not supported] | [2.4 h]
[MM/DD/YYYY] | [supplement_compare.docx] | [260] | [Internal triage] | [Initials] | [Spot check: 20 of 94 entries] | [None] | [0.5 h]

UNREADABLE OR LOW-CONFIDENCE PAGES REVIEWED BY HAND: [page numbers]
FLAGS ACCEPTED FOR FOLLOW-UP: [list, with request date]
FLAGS REJECTED AND WHY: [list]

The route choice from chapter 1 happens on every file, usually in the first 2 weeks, when the first productions land and you still do not know how big the file will get. Run each new matter through these 6 questions in order. The first "stop" answer you hit tells you who has to be involved.

Question 4 does most of the sorting. A soft-tissue case rarely needs clinical judgment beyond a careful lawyer's. A delayed-diagnosis case always does, and many states require an expert's certificate or affidavit before or soon after filing a med-mal claim; see certificate of merit rules by state. Comp and SSDI files sit in between: restrictions over time are extraction work, while the capacity opinion comes from a physician.

1. 03/04
   Intake

   Fee agreement signed with the AI disclosure paragraph, software cost as a case expense. 6 providers named. Authorizations out the same day.

   Intake memo, file p. 1 to 3
2. 03/27
   Production 1: ED and ambulance, 312 pages

   Uploaded Tuesday. Draft shows triage at 17:42 on 02/20/2026, neck pain 7/10, CT cervical spine read as no acute fracture. 41 pages flagged as duplicates of the ED visit summary.

   ED record p. 12, 19 to 21
3. 04/21
   Production 2: primary care and PT, 486 pages

   Draft adds 14 PT visits. The PT discharge note says "pt reports prior chiropractic care for neck, 2021". The software lists it under prior conditions with the page cite.

   PT discharge p. 468
4. 04/22
   Flag: MRI referenced but not produced

   The PCP note of 03/18 orders a cervical MRI and a later PT note says "MRI showed C5-6 disc herniation". No MRI report or images are in the file. The missing-record flag cites both pages.

   PCP note p. 88; PT note p. 301
5. 04/23
   Attorney review block

   The attorney opens both cited pages, accepts the flag and sends a request to the imaging center. The prior chiropractic note goes on the list to discuss with the client, and a request goes to the chiropractor the client now names.

   Verification log, 04/23, 1.6 h
6. 06/02
   Production 3: imaging center and chiropractor, 138 pages

   MRI report dated 03/25/2026 confirms a C5-6 herniation. Chiropractic records show 6 visits in 2021 for neck and upper back stiffness, no imaging, discharged "resolved". The supplemental comparison shows the new pages agree with the PT reference and add the 2021 history.

   MRI p. 2; chiro p. 9 to 31
7. 09/08
   Production 4: spine surgeon and hospital, 864 pages

   Operative report for the 08/12 fusion. The surgeon's history names the 2021 chiropractic care and states the herniation is new on imaging. 360 duplicate pages removed from this production.

   Op report p. 402; H&P p. 377
8. 09/15
   Demand prep

   The attorney verifies all 188 chronology entries cited in the demand at their pages (3 corrections, 1 removal), and the bills summary line by line. The causation sentence quotes the surgeon's own note with its page cite and is not the lawyer's opinion.

   Verification log, 09/15, 3.1 h

What the example shows is the division of labor. The software found and cited the prior chiropractic mention on page 468 of production 2, and it caught the MRI that was referenced but never produced. It did not decide whether the 2021 care is relevant. The lawyer did, by reading the chiropractor's records, talking to the client, and letting the surgeon's own history carry causation in the demand. If a defense examiner calls the herniation degenerative, the lawyer needs a physician's opinion, not a better chronology. The pre-existing condition side of this is covered in eggshell plaintiffs and pre-existing conditions.

At a per-page rate of 10 cents on unique pages, this file costs $139.90 in software. Verification took the attorney 4.7 logged hours across 2 sessions (1.6 + 3.1), under the 6-hour assumption in chapter 2 and far under the 22 hours assumed for a hand read. All figures are hypothetical.

The line is not "simple work in-house, hard work outside". It is "organizing work can go to software or staff; judgment stays with you; medical opinion goes to someone licensed to give it". Causation is the clearest case. A lawyer can summarize what the treating surgeon wrote about cause. A lawyer cannot supply the opinion that the collision caused the herniation. Software cannot either, and courts in many states limit what a nurse may say about medical causation; rules vary by jurisdiction.

Ranked: where a solo's outside money does the most good

Workers' comp and SSDI practices have their own version of the split. In comp, the restrictions and work status trail across dozens of short visits, and extracting them is organizing work; see work capacity and restriction tracking. The medical opinion on capacity still comes from a treating or examining physician. In SSDI, a cited chronology makes the hearing brief faster to write and check.

Most legal AI tools marketed to small firms are built on a large language model (LLM), the same class of model behind general chatbots. What separates a tool you can use on a client's chart from one you cannot is what surrounds the model: how pages are read, whether each statement is tied to a page, what happens to the data, and whether a person checks the result.

What it does well on medical records

• Sorting and deduplication. Tedious for people, well suited to software. See deduplicating medical records for personal injury.
• Extraction into a structure. Dates, providers, diagnoses, procedures, restrictions and charges pulled into a chronology and bills summary. Clinical NLP (natural language processing on clinical text) is what turns "s/p ACDF C5-6" into an entry a lawyer can read.
• Page-level citations. The better tools use a grounded, retrieval-augmented design: the model answers from the pages you uploaded and each line carries a cite to its source page, so you can check it in 1 click.
• Flags. Visits referenced but not produced, treatment gaps, prior conditions, conflicting dates. Signals to check, not findings.
• Supplemental productions. A new batch compared to the file: agrees, conflicts, adds.

Where it fails, and how to catch it

The courtroom risk is real and well known. In Mata v. Avianca, Inc. (S.D.N.Y. 2023), lawyers were sanctioned under Rule 11 for filing a brief with case citations a chatbot invented. The same failure applied to medical facts (an invented treatment date, a misstated diagnosis) produces the same problem under Rules 3.3 and 8.4(c) and under Federal Rule of Civil Procedure 11(b)(3), which requires that factual contentions have evidentiary support. The defense is the same too: verify before you file. Human-in-the-loop review is what makes the output usable in litigation. More on admissibility and accuracy is in is AI accurate enough for court.

General chatbots vs a records tool

Agentic AI tools that take multi-step actions on their own (requesting records, drafting and sending letters) are arriving in legal software. For records work we would keep a person at every step that leaves the office, for the same reasons as above: you can delegate drafting, not judgment. For a longer treatment of AI in a PI practice, see the AI-native personal injury law firm.

Rule 5.3 comment 3 points to the vendor's experience and reputation, the nature of its services and the terms protecting client information, and Opinion 512 adds reading the tool's terms of use and privacy policy. We would also check whether it keeps your data after the work is done, and whether it claims any right to it. For a solo, that is a 1-hour review per vendor, filed away. It applies to software, review vendors and nurse consultants alike.

Start with the business associate agreement

Even where HIPAA does not bind your firm directly (chapter 3), the terms HIPAA requires in a business associate contract are the best template for what a records vendor should promise. Under 45 CFR 164.504(e)(2), the contract must limit the vendor's uses and disclosures, require safeguards, require reports of breaches, bind the vendor's subcontractors to the same restrictions, and deal with the data when the relationship ends:

"At termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such information"

Solos skip the subcontractor clause. Most AI tools send text to a model provider; ask whether each sub-processor is under a BAA, retains nothing and cannot train on your data.

The 12-point vendor checklist

• Signed BAA before the first uploadCovers uses, safeguards, breach reports, subcontractors and return or destruction, per 45 CFR 164.504(e)(2)
• No training on your data, in the contractOpinion 512 treats tools that learn from inputs as needing informed client consent. A marketing page is not a contract term
• SOC 2 report availableAsk for the report or a summary under NDA, and check the date it covers
• Sub-processor listEvery company that touches the records, including model providers, each under a BAA
• A citation to the source page on every lineWithout it, verification means re-reading the file. Test it: click 10 random entries
• Low-confidence and unreadable pages listedThe tool should tell you which pages it could not read well, so you read them
• Export formats you can useEditable Word or HTML with working citation links; a PDF alone is hard to edit into a demand
• Data retention and deletion termsHow long files are kept, whether you can set it, and how deletion is confirmed
• Where the data is storedCountry and cloud provider. Some clients and some state rules care
• Duplicates and supplements pricedWhether duplicate pages are billed and what a second production costs
• Liability and ownership termsRead the terms for any cap on the vendor's liability and any claim to ownership of your data
• Access controlsMulti-factor login and per-matter access, so a contract reviewer cannot see every client

0 of 12 checked

TO: [VENDOR NAME]
FROM: [FIRM NAME], [ATTORNEY NAME]
RE: Due diligence before sending client medical records
DATE: [MM/DD/YYYY]

We are a [solo / X-lawyer] firm handling [PI / med-mal / workers'
comp / SSDI] cases. Before we send any client records, please
answer the following in writing.

SECURITY AND CONTRACT
1. Will you sign a business associate agreement before our first
   upload? Please attach it.
2. Do you hold a current SOC 2 report? What period does it cover?
   Can you share it or a summary under NDA?
3. List every sub-processor that will receive record content,
   including AI model providers. Is each under a BAA? Does each
   retain any data after processing?
4. Does any contract term allow you or a sub-processor to use our
   records or outputs to train or improve a model?
5. Do you claim any ownership or license in our uploaded records or
   in the outputs?
6. What is your limitation of liability for a data breach?

DATA HANDLING
7. Where are records stored (country, cloud provider)?
8. What is the default retention period? Can we set our own? How do
   you confirm deletion?
9. Do you support multi-factor login and per-matter access controls?

OUTPUT QUALITY
10. Does every entry in the chronology cite a specific source page?
    Do the citations survive export?
11. How do you handle handwritten pages, faxes and low-quality
    scans? Do you list pages you could not read with confidence?
12. What export formats do you offer (Word, HTML, PDF, spreadsheet)?

PRICE
13. How are you priced (per page, per case, per seat, hourly)? Are
    duplicate pages billed? Is there a per-file minimum?

Please return answers to [EMAIL] by [DATE].

Medrecords AI is medical record review software. You upload the records you already have; it sorts and deduplicates them, runs OCR that routes each page to the right engine and flags low-confidence pages, and drafts a cited medical chronology, a bills summary and missing-record flags, with a citation on every line. New productions are compared against the existing file with supplemental record review. Chronologies export to Word and HTML with citations that stay live links back to the source page.

Against the chapter 11 checklist: Self-Service includes a BAA signed at signup, SOC 2 and HIPAA controls, a contractual term that your records never train a model, multi-factor login, per-matter access and configurable retention and deletion. Details are on the security and HIPAA pages. Self-Service bills 10 cents a deduplicated page, down to 5 cents at volume, duplicates free; Enterprise On-Prem is an annual license. Both are on the pricing page.

Just as important for a solo is what it does not do. Medrecords AI does not retrieve records from providers, does not give legal or medical opinions, does not score case merit, and does not replace your nurse consultant or your expert. Its flags are signals for you to check. You review, you revise, you sign.

How do solo attorneys handle medical record review without a nurse?

With some mix of 3 routes: reading the records themselves or with a paralegal, outsourcing to a legal nurse consultant or review vendor, and software that drafts a cited chronology the lawyer verifies. A common split is software for the first draft on every file and a nurse consultant only for files that need clinical judgment.

Can a solo attorney use AI to review medical records ethically?

ABA Formal Opinion 512 (2024) says lawyers may use generative AI tools if they understand the tool, protect client information, communicate with the client where required, verify the output, supervise its use and bill fairly. State bar guidance controls and varies, so check your jurisdiction.

Is it HIPAA compliant to upload client medical records to AI?

It can be, if the vendor signs a business associate agreement, protects the data with controls you can verify such as a SOC 2 report, binds its sub-processors to the same terms, and does not use your records to train its models. Consumer chatbot plans usually offer none of that.

Can ChatGPT summarize medical records for a lawsuit?

A general chatbot can produce a summary, but consumer plans may allow training on inputs, usually come without a BAA, can truncate long records, and do not cite each statement to a page. For a client's chart, use a tool built for records and verify every fact before it leaves the office.

Do I need client consent to use AI on their records?

Under Opinion 512, informed consent is required before putting client information into a tool that may learn from it, and boilerplate engagement-letter language does not count. For tools that do not train on inputs, disclosure is still good practice, and some states expect more. A specific engagement-letter paragraph handles both.

Can I bill the client for AI software on a contingency case?

Only if your fee agreement treats it as a case cost, and then at actual cost with no markup. Otherwise it is overhead. A per-page charge tied to 1 matter fits the expense model better than a monthly seat license. State rules on deductible costs differ.

Does medical chronology software replace a legal nurse consultant?

No. Software sorts, extracts and cites. A nurse consultant gives clinical judgment, screens standard-of-care questions and helps find experts. Handing the nurse a cited draft puts their hours on analysis.

What should I ask an AI record review vendor before signing up?

Whether it signs a BAA, holds a SOC 2 report, excludes training on your data by contract, lists its sub-processors, cites every entry to a source page, lists unreadable pages, exports to editable formats, lets you set retention and deletion, and bills duplicates.

Rules and regulations were checked in September 2026. The ABA's own website blocked our automated fetch, so the text of Rule 1.1 comment 8 was verified from the LawSites tracker that reproduces it, Rule 5.3 and its comments from the Louisiana version (identical to the Model Rule except its title), and the content of Opinion 512 from summaries published by the National Conference of Bar Examiners, the Illinois State Bar Association and the UNC law library. We paraphrase Opinion 512 for that reason; read the opinion itself before relying on it. All cases, dollar figures, hourly rates and hour counts in chapters 2 and 8 are hypothetical. Product facts come from this site's product, security and pricing pages. Nothing here is legal or ethics advice.

• ABA Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024).
• National Conference of Bar Examiners, The Bar Examiner, "Generative Artificial Intelligence Tools: ABA Formal Opinion 512" (Fall 2024): self-learning tools and informed consent, boilerplate consent, terms of use, how much verification, vendor checks.
• Illinois State Bar Association, "Be Reasonable, People! AI's Impact on Legal Fees" (2025): the 15-minute billing example, overhead, no markup, and time spent learning a tool.
• UNC Kathrine R. Everett Law Library, ABA Formal Opinion 512 (2025): issue date, themes, and earlier state guidance from Texas, Illinois and California.
• LawSites, Tech Competence tracker: text of Model Rule 1.1 comment 8 (2012) and adoption by 40 states, DC and Puerto Rico.
• Louisiana Rule 5.3 with ABA comments: text of 5.3(a) to (c), comment 3, and the 2012 title change.
• 45 CFR 164.504(e), business associate contract terms, including (e)(2)(ii)(A) to (J).
• 45 CFR 164.524(b)(2), the 30-day access deadline and 1 extension of up to 30 days.
• HHS OCR, clarification on the $6.50 flat-rate option.
• Federal Rule of Civil Procedure 11; Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023), sanctions for fabricated AI-generated citations.

Related guides: the AI-native personal injury law firm, HIPAA-compliant AI medical record review, medical liens and letters of protection, and software for plaintiff attorneys.