Do I need a lawyer for HIPAA compliance?

Not for the routine programme — the risk analysis, policies, training and record-keeping are administrative work that does not require a licensed professional. You do need one when there are legal consequences: an OCR investigation or state enquiry, a breach with notification decisions to make, a negotiated business associate agreement, or an unusual arrangement where the interaction between HIPAA and state law is the question. Many organizations keep counsel on call and run the programme themselves.

Is a HIPAA risk assessment privileged?

It depends entirely on how it was produced, and it is a question for your own attorney rather than for us. Work developed at the direction of counsel for the purpose of legal advice may be treated differently from a document your organization produced in the ordinary course of business. What is not in doubt is that the Security Rule requires the analysis to exist and be documented — so the choice is about how it is created, not whether.

A law firm or compliance software? They are not the same purchase

Healthcare law firms build HIPAA programmes too, usually for $10,000–$50,000 to set up and $25,000–$75,000 a year to maintain. What that buys is privileged advice from someone licensed and insured to give it. Software buys the opposite: cheap, repeatable execution with no advice attached. Confusing the two is how organizations end up paying legal rates for filing.

Stay with law firm if…

You are dealing with an OCR investigation, a state attorney general enquiry, a class action, or a breach likely to become one of those. This is legal work and it needs a lawyer.
You need attorney-client privilege over your own assessment of your gaps. A finding written into software is a business record; the same finding developed under privilege may be treated differently. If that distinction matters to you, take counsel before you write anything down anywhere.
You are negotiating the terms of a business associate agreement rather than signing a standard one — indemnities, notification windows shorter than the regulatory outer limit, insurance requirements.
You operate across states with their own health privacy statutes, or handle 42 CFR Part 2 records, where the interaction between regimes is the actual question.

Switch to us if…

Your firm has been doing your annual risk analysis and policy refresh at hourly rates. That is the most expensive possible way to buy a repeatable process.
The bill is mostly for producing and updating documents rather than for advice on hard questions.
You need the programme to be current continuously rather than reviewed once a year — renewals, training, expiring agreements and incidents all have their own clocks.
You want your counsel's hours spent on the questions only they can answer, with the routine work happening somewhere cheaper.

Comparison with law firm
	CompyMax	law firm
Setup cost	Included	Commonly $10,000–$50,000
Annual cost	From $948	Commonly $25,000–$75,000
Legal advice	None. We are not a law firm and do not provide legal advice	Yes — this is what you are buying
Privilege over findings	No	Potentially, depending how the engagement is structured
Day-to-day execution	Assessment, tasks, policies, training, vendors, incidents, evidence	Usually delivered as documents and advice memos
Response to an investigation	We produce your records; we cannot represent you	Yes

Being straight with you

If there is a live legal problem, close this page and call a healthcare attorney. We do not provide legal advice, we cannot represent you, and nothing in our product substitutes for counsel on a question with consequences. What we replace is the part of a firm's bill that is document production at hourly rates — and if your counsel already does that cheaply, there is nothing here worth switching for.

Try it before you decide.

14 days free, no credit card, no sales call, and cancel from account settings in one click. Run your assessment and export an evidence pack before you commit to anything.

Start free trial

Common questions

Do I need a lawyer for HIPAA compliance?: Not for the routine programme — the risk analysis, policies, training and record-keeping are administrative work that does not require a licensed professional. You do need one when there are legal consequences: an OCR investigation or state enquiry, a breach with notification decisions to make, a negotiated business associate agreement, or an unusual arrangement where the interaction between HIPAA and state law is the question. Many organizations keep counsel on call and run the programme themselves.
Is a HIPAA risk assessment privileged?: It depends entirely on how it was produced, and it is a question for your own attorney rather than for us. Work developed at the direction of counsel for the purpose of legal advice may be treated differently from a document your organization produced in the ordinary course of business. What is not in doubt is that the Security Rule requires the analysis to exist and be documented — so the choice is about how it is created, not whether.

Keep reading

Comparisons reflect information law firm publishes about its own product at the time of writing, plus our own assessment. law firm is named for identification only and has no affiliation with us. Verify current capabilities and pricing with them before deciding — vendors change both without notice.