Health Care Providers, Health Plans and Third Party Administrators may need to disclose an individual’s PHI to outside counsel that is necessary for the lawyers to represent them and provide legal services. That makes the law firm a HIPAA Business Associate that must comply with HIPAA Rules. HIPAA requires Business Associates to disclose their own files and data received from Covered Entities to the Department of Health and Human Services during an investigation of either organization’s HIPAA compliance. That presents special issues for Law Firm Business Associates and their clients because lawyers must protect attorney-client privileged materials and another category of information called Attorney Work Product. We have special procedures  and specific form language to protect Attorney-client privilege and Attorney Work product based on legal research and citations. Unfortunately we encounter lawyers who are not familiar with HIPAA Rules they must follow to protect themselves and their Covered Entity Clients. Subscribers to the HIPAA E-Tool®  Business Associate edition include law firms.