Contractual safeguards for sensitive client data
AI Esquire maintains Business Associate Agreements with major technology partners used in applicable deployments. These agreements provide contractual safeguards for HIPAA-aligned handling of protected information and prohibit covered client data from being used to train AI models.
The precise protections depend on the services, configuration, and agreements governing a particular deployment. We review those details with each firm before live client information enters the workflow.
BAA-backed safeguards. HIPAA-aligned handling. No model training on covered client data.
Define what the system may and may not do
Permitted tasks can include identifying the caller, collecting approved facts, answering limited administrative questions, scheduling, routing, and summarizing. Prohibited tasks should include legal advice, legal conclusions, promises of representation, case-value estimates, and unsupervised conflicts decisions.
Those boundaries should appear in the configuration, test scenarios, staff instructions, and quality review. A disclaimer cannot repair a workflow designed to cross the line.
Minimize the data before protecting it
Collect only facts required to determine the next administrative step. Before launch, identify where recordings, transcripts, contact details, summaries, and integration data are transmitted; who can access them; how long they are retained; and how export or deletion requests are handled.
Calendar, CRM, practice-management, telephony, transcription, and model providers can each affect the data path. Review the complete chain, not only the application visible to staff.
- Document systems and subprocessors
- Limit permissions
- Define retention
- Test export and deletion
- Assign an accountable reviewer
Design for uncertainty and failure
A responsible system should stop, transfer, or flag when a caller asks for advice, facts do not fit the approved path, a safety issue appears, or an integration fails. The record should preserve the exception so a reviewer knows what still needs attention.
Every transfer needs a fallback. Every incomplete interaction needs a status. Every consequential decision remains with an accountable person at the firm.
Review current deployment documents
Security claims age quickly. Ask for the current architecture, data-processing terms, vendor and subprocessor list, retention options, incident procedures, and configuration scope that apply to the proposed deployment.
This page is an operating overview, not a certification, legal opinion, or substitute for current contractual and security documentation.
Sources and further reading
Primary and industry sources used to support this page. External guidance should be reviewed in context and for your jurisdiction.
- ABA Formal Opinion 512ABA guidance on lawyers' professional obligations when using generative AI.
Frequently asked questions
Does Intake AI give legal advice?+
No. Its configured scope is administrative intake. Attorneys retain legal judgment.
What should a security review request?+
Request current architecture, subprocessors, data locations, access, retention, deletion, incident response, integration permissions, and contract terms.
Who supervises the system?+
The firm should assign an accountable attorney or operator to approve the workflow, review early calls, investigate exceptions, and authorize material changes.
