The AI Tool We Built for a Law Firm, and the Five Rules That Made It Safe

A workers’ compensation defense firm we support gets subpoenaed medical records by the box. A single production runs anywhere from around fifty scanned pages to two thousand. Somebody at the firm reads every page and writes a “Summary of Records” letter by hand: the page number, the visit date, what happened, who signed the report, and whether it touches the body parts the claim is about. Their estimate was about an hour per hundred pages, and they had a stack of them.

Their question to us was simple. Can AI do this without us getting in trouble?

“Can AI do this” turned out to be the easy half. Gpt-5.1 reads a clinic note and writes a tight paragraph in the firm’s house style better than most first-year associates. “Without getting in trouble” is the whole job. Those records are protected health information (PHI), the kind of data HIPAA exists to protect. The firm is the custodian. If a summary tool leaks them, the AI vendor doesn’t get the bar complaint. The firm does.

So here is what we built, and more importantly, the five rules that made it something a law firm could actually use.

What it does

An attorney opens a web page, types the case name, where the records came from, and the body parts pled on the claim. They upload the PDF. Somewhere between one and fifteen minutes later, depending on the size of the file, they get a review table: one entry per encounter or document, in page order, with the date, a paragraph in the firm’s voice (“Applicant presented to the clinic with…”), the clinician who signed it, and a flag on every entry that touches a pled body part. They edit, delete the noise, and click export. Out comes a Word document on the firm’s letterhead, already named the way their document system expects.

Under the hood it is three Azure AI services in a row, plus a Word document generator: optical character recognition (OCR) to turn the scans into text, a de-identification service, and a language model. The interesting part is not the summarizing. It is where the data is allowed to go at each step.

Rule 1: The AI never learns who the patient is

Before a single word reaches the language model, a separate service strips the injured worker’s name, date of birth, medical record number, address, phone, and Social Security number. This is not a line in the prompt asking the model to please ignore the name. A prompt is a request. It is not a control. De-identification runs as its own deterministic step, and the model only ever sees text that has already been through it.

We made one deliberate exception on names. The names of treating and signing clinicians are preserved, because the attorney needs to know who wrote each report. HIPAA’s Safe Harbor rule covers the individual’s identifiers, not the doctor’s, so this is consistent with de-identification. It took real engineering to keep those names while stripping the patient’s, and it was worth it. A summary that says “an unnamed provider signed this” is useless in a deposition.

Rule 2: The data never leaves the client’s house

The whole thing runs inside the firm’s own Microsoft Azure subscription. Their tenant, their storage, their AI services, their login. We built it, and we can’t read a single record. That is on purpose.

Because every AI service in the chain is a Microsoft service, one Business Associate Agreement (BAA) covers the entire path. A BAA is the contract HIPAA requires from any vendor that touches health data; it makes the vendor legally responsible for protecting it. There is no third-party model API and no consumer chatbot, so there is no second vendor whose data terms you would have to read and trust. The language model deployment is pinned to US data centers. It costs about ten percent more than the global option. For protected health information, that is the cheapest ten percent you will ever spend.

Compare this to the pattern I see constantly: a paralegal pasting a medical record into a free chatbot because it’s faster. Same task. Completely different risk. The difference is not the AI. It is the plumbing around it.

Rule 3: Keep nothing you don’t need

The uploaded PDF is deleted as soon as processing finishes. Anything that survives a crash gets purged automatically by a storage lifecycle policy within days. The only thing the system keeps long-term is a usage log with the user, a matter label, page counts, and cost. Never the record content.

Most AI data leaks are not dramatic. They are a forgotten upload folder that has been quietly accumulating client files that nobody remembered was there. The fix is a retention policy you set once and then never think about again.

Rule 4: Access should be boring

Who can use the tool is controlled by one group in the firm’s Microsoft 365. Add someone to the group and they can log in with the account they already have. Remove them and they can’t. No separate password, no shared login, no list of users buried in the code that somebody has to remember to update when an attorney leaves.

Boring is a feature. The best security controls are the ones nobody has to think about.

Rule 5: A human signs it

The tool writes the first draft. The attorney owns the letter. The review table exists because the model is very good, not perfect, and “very good” is not a standard you can sign your name to.

My working number for AI is that it’s about 98 percent awesome. The tool exists to catch the other two percent. Early in the build we found a case where the AI service was rate-limiting us during a large job and the tool was silently skipping the throttled pages. The summary looked complete. It wasn’t. We fixed it so the tool retries, and if it still can’t get through, the whole job stops with an error instead of handing you a letter with a hole in it. The same rule applies to the de-identification step: if that service fails, nothing goes to the model at all. A tool that quietly skips pages is far worse than one that stops and tells you.

What it costs

People assume this kind of thing is expensive. Measured across the first 19 real jobs and about 6,300 pages:

Azure cost per 300-page record	about $2
Per 1,000 pages	about $6.40
Hosting	about $25 per month, flat

By the firm’s own estimate, about three hours of staff time for a 300-page record, versus about two dollars of cloud compute. The math is not close. And because it runs in the firm’s own Azure, they see every penny on their own bill.

The one we got wrong

I’ll tell you about the mistake, because the lesson is the point of this post.

During the build, an automation on our side that periodically saves work into version control swept up a test file that contained real record data and pushed it into a private repository. Nobody outside eTop ever saw it. We caught it, scrubbed it, and changed the process: automation never touches a working folder that can hold client data, and the project now refuses to accept a PDF or a rendered letter into version control at all.

Notice what the mistake was not. It was not the AI model. It was not a hacker. It was a convenience script doing exactly what it was told. That is where AI projects actually go wrong. The model gets all the attention, and the boring plumbing around it, the folders and the scripts and the logs, is where the data escapes.

It’s only an expensive lesson if we don’t learn from it.

The questions to ask anyone building you an AI tool

I think of AI as a 3D printer for knowledge work. It will happily print whatever you feed it. The safety is entirely in what you feed it and where the output goes. If someone is building an AI tool for your business, or your team is about to start using one, these are the questions that matter:

• Where does the data physically go? Whose cloud account, whose country, whose agreement?
• What is removed before the model sees it? And is that a separate step, or a polite request in the prompt?
• What gets kept, and for how long? If the answer is “we hadn’t thought about it,” the answer is forever.
• Who can use it, and how do you turn someone off? If it’s not tied to your existing logins, it will drift.
• Who signs the output? If nobody reviews it, the tool is making decisions, not drafts.

None of these questions are about the AI. All of them are about the plumbing. That’s the part we do.

We build tools like this for law firms and professional services businesses across the Inland Empire, and more often we help clients figure out which of the AI tools their staff are already using are safe. If you want to know where your business stands, our AI Readiness Assessment is a fixed-fee review that shows you what your team is actually using, where the data is going, and what to do about it. You keep the findings and the roadmap either way.