This content is for informational and educational purposes only and is not legal, financial, or tax advice. No attorney-client relationship is created by reading or using this article. Federal, state, and local rules may differ and may change without notice. A qualified professional can review specific circumstances. The author and publisher assume no liability for actions taken based on this content.
Key Facts
- National overview: Medical-legal partnerships are designed to connect clinical care with legal services to address social needs that affect health outcomes.
- Federal level: The HIPAA Privacy Rule restricts how covered entities and business associates may use or disclose protected health information to only what HIPAA permits or requires.
- Federal level: HIPAA includes specified situations in which disclosure may be allowed without written authorization under 45 CFR 164.512.
- Federal level: HHS explains that a covered entity may disclose protected health information to comply with a court order, including an order from an administrative tribunal.
- State level: State unauthorized practice of law rules can regulate who may provide legal services and can affect partnership staffing and roles.
- National overview: AMA policy connects social determinants to health outcomes and describes limitations of relying on screening alone without the resources to respond.
- National overview: AMA policy states physicians and trainees are inadequately trained to screen for social determinants and that screening without resources or treatment options is ineffective.
- National overview: The ABA’s Medical-Legal Partnerships Pro Bono Project describes improving health and well-being of vulnerable populations through partnerships with the medical community and volunteer attorneys.
Medical-legal partnerships are a collaboration model that connects clinical care with legal services to address social needs that can drive health outcomes. In policy terms, both the American Medical Association (AMA) and the American Bar Association (ABA) have endorsed the idea that improving patient well-being can require coordinated work between health providers and legal advocates. At the same time, real programs have to operate within federal HIPAA privacy rules that govern protected health information, and state rules on who may provide legal services, including unauthorized practice of law (UPL) constraints.
- What “medical legal partnerships” mean in AMA and ABA descriptions
- Why AMA links social determinants to the legal side
- Federal HIPAA rules affect what information health teams can share
- State unauthorized practice of law rules can constrain who provides the legal help
- Where HIPAA and state legal practice rules meet in partnership work
- Confidentiality and privilege concepts often come up alongside HIPAA
- A note on “Federal and state” variation
- Sources
What “medical legal partnerships” mean in AMA and ABA descriptions
The AMA’s policy on medical-legal partnerships frames the model as a response to social determinants of health that affect patients’ health and outcomes. See AMA Resolution 601 (Support for the Establishment of Medical-Legal Partnerships). The ABA’s policy description focuses on improving health and well-being for vulnerable populations through partnerships with the medical community and the work of volunteer attorneys, as described on the ABA Medical-Legal Partnerships Pro Bono Project page.
Why AMA links social determinants to the legal side
AMA policy explains that screening for social determinants is not enough on its own when the health system lacks resources or pathways to address the underlying barriers. In particular, the AMA policy states that physicians and trainees are inadequately trained to screen for social determinants effectively and respectfully, and that screening without providing resources or treatment options is ineffective. See AMA Resolution 601 for this framing.
Federal HIPAA rules affect what information health teams can share
HIPAA’s Privacy Rule establishes a federal framework for protected health information (PHI). A core concept is that covered entities (and certain business associates) generally may not use or disclose PHI except as permitted or required by the Privacy Rule. The general rule appears in 45 CFR 164.502. In a medical-legal partnership context, that means program designers often start by clarifying what information will be exchanged and under which HIPAA disclosure pathway.
HIPAA disclosure provisions that can matter for partnership work
HIPAA also contains specified disclosure situations in which written authorization may not be required—depending on the circumstances. One way to think about this for partnership design is to map the partnership’s proposed information-sharing tasks (for example, sharing relevant PHI for legal processes or documentation) to the specific HIPAA provision that governs the disclosure. For the broader framework and “no authorization required” situations, see 45 CFR 164.512.
HHS’s HIPAA FAQs also address disclosures to comply with legal process. HHS explains that a covered entity may disclose PHI to comply with a court order, including an order of an administrative tribunal. See HHS HIPAA FAQs: Judicial and Administrative Proceedings.
State unauthorized practice of law rules can constrain who provides the legal help
Even when HIPAA allows (or requires) certain disclosures, medical-legal partnership staffing still has to respect state professional rules about who is authorized to provide legal services. Put simply: HIPAA addresses privacy and permitted disclosures; UPL rules address whether a person or entity may provide “legal services” under that state’s licensing rules.
As an example of how state UPL frameworks can be described, the Ohio State Bar Association’s unauthorized practice of law overview discusses how UPL relates to attorney licensing status and describes enforcement tools such as investigations and potential injunctive and civil penalty remedies. Because UPL rules vary by state, partnership roles commonly need local legal-ethics review when designing the program’s legal staffing model.
Where HIPAA and state legal practice rules meet in partnership work
A helpful way to separate the two systems is to focus on what each one governs:
| Partnership topic in practice | Main legal authority | What the cited sources support |
|---|---|---|
| Whether a clinic may share protected health information | HIPAA Privacy Rule | 45 CFR 164.502 sets general limits on uses and disclosures, and 45 CFR 164.512 covers specified situations; HHS guidance also addresses disclosures to comply with court orders and administrative tribunals. |
| Whether legal help comes from properly authorized legal professionals | State UPL and licensing rules | The Ohio UPL overview illustrates how enforcement and permission can be linked to attorney licensing status and described enforcement steps. |
| Why the partnership model pairs clinical care with legal help | AMA and ABA policy | AMA connects social determinants to health outcomes and describes limitations of screening alone; the ABA describes improving health and well-being for vulnerable populations through partnership work and volunteer attorneys. |
Confidentiality and privilege concepts often come up alongside HIPAA
When health organizations coordinate with legal services, “confidentiality” can refer to more than one concept depending on the context—HIPAA privacy rules for PHI, and legal privilege principles (such as attorney-client privilege) for communications in the legal context. For general background on attorney-client privilege terminology that often appears in advocacy discussions, see Attorney-client privilege basics.
A note on “Federal and state” variation
The division of responsibility is often straightforward in theory but complex in practice. Federal HIPAA governs PHI handling by covered entities and business associates, while state rules govern legal practice and UPL/licensing enforcement. Because state legal-practice rules can vary, partnership program structures usually need both (1) HIPAA-privacy compliance planning and (2) state-ethics analysis for how legal services are delivered—even when the health side and the legal side share the same goal of improving patient well-being.
