The question at hand
When Tarter Krinsky & Drogin discovered unauthorized access to servers containing the protected health information (PHI) of 196,645 patients, the Manhattan law firm faced a critical question: Who owns HIPAA compliance when you're handling PHI as a business associate?
The unauthorized access occurred intermittently between July 9, 2025, and September 9, 2025, but the firm didn't detect it until September 10. This detection gap highlights a significant issue in practice. Some firms treat HIPAA obligations as a Governance, Risk, and Compliance (GRC) function, reporting to IT or operations. Others embed it in client service teams, where attorneys manage it like any other fiduciary duty.
This division isn't just theoretical. It affects budget allocation, risk management, and whether your firm can explain to the Office for Civil Rights why you missed two months of unauthorized server access.
The case for GRC ownership
Compliance officers argue that HIPAA is a regulatory framework, not a legal strategy question. You wouldn't ask litigators to configure your firewall. The HIPAA Security Rule's administrative, physical, and technical safeguards align with ISO/IEC 27001 controls. Your Chief Information Security Officer (CISO) knows how to implement access controls, encryption, and audit logging. Your attorneys don't.
This approach centralizes accountability. When Park Dental in Virginia discovered unauthorized access to email accounts between June 10, 2026, and July 22, 2026, they strengthened account security and increased monitoring. These are IT security measures, not legal remedies. If your firm treats HIPAA as a GRC problem, you're more likely to have technical controls in place before an incident happens.
GRC-led programs also standardize risk assessment. The HIPAA Security Rule requires regular risk analyses under 45 CFR § 164.308(a)(1)(ii)(A). Your compliance team knows how to document threats and vulnerabilities. They'll integrate your PHI handling into your broader enterprise risk management program and your SOC 2 Type II audit scope if you're pursuing one. You get consistent risk language across the firm.
The practical advantage: When Heritage Pediatrics in Texas identified fraudulent emails from a compromised employee account in April 2026, they immediately engaged third-party cybersecurity experts. A GRC team has those vendor relationships in place. They know which digital forensics firms can preserve evidence for potential litigation while meeting investigation requirements under 45 CFR § 164.308(a)(6).
The case for attorney ownership
Partners advocating for attorney ownership argue that PHI at law firms isn't just regulated data; it's privileged information covered by attorney-client confidentiality. When Tarter Krinsky & Drogin's breach involved "confidential and attorney-client privileged information" alongside PHI, that dual obligation changed the incident response approach.
If your GRC team leads the breach investigation, they'll focus on HIPAA's 72-Hour Notification Requirement and the breach notification provisions under the Health Information Technology for Economic and Clinical Health Act. But they might not recognize when forensic review could waive privilege or when notification language needs to protect work product. Your malpractice carrier cares deeply about this distinction.
Attorney-led programs also align accountability with existing client relationships. When you're a business associate handling PHI for healthcare clients, those clients expect their relationship partner to own the risk. If a breach happens, they're calling the partner who brought them in, not your CISO. That partner needs direct visibility into controls, not a quarterly dashboard from IT.
Healthcare clients increasingly ask about your cybersecurity posture during RFP processes. They want to know whether you've implemented Role-Based Access Control for their matter files and whether you're encrypting PHI in transit and at rest. If your client service attorneys can't speak to those controls with authority, you're at a competitive disadvantage.
Where practitioners actually land
Most mid-sized and large firms are adopting a hybrid model, but the division of labor varies. A common pattern: GRC owns the technical controls and HIPAA Security Rule compliance. Client service teams own the business associate agreements, client-facing incident response, and judgment calls about when a security event becomes a reportable breach.
This split requires tight coordination. When Park Dental discovered their email compromise, someone had to decide whether the "potential" unauthorized access to patient records triggered notification obligations. That's not purely a legal or technical question. It requires your attorneys to understand the forensic evidence and your GRC team to understand the regulatory threshold for "acquisition" versus "access."
Firms getting this right run joint tabletop exercises where attorneys and security teams work through breach scenarios together. They're also embedding security requirements directly into matter intake processes, so client service teams can't onboard a healthcare client without triggering a GRC review of data handling procedures.
Our take
Law firms should treat HIPAA compliance as a GRC function with attorney oversight. Here's why: The controls that prevent breaches are technical and operational. Access logging, encryption, network segmentation, and Privileged Access Management require specialized expertise your litigators and transactional attorneys don't have. When Tarter Krinsky & Drogin took two months to detect unauthorized server access, that's an IT monitoring failure, not a legal judgment failure.
However, the business associate relationship creates obligations that GRC teams can't handle alone. Your incident response plan needs legal review. Your breach notification language needs to protect privilege. Your risk assessment needs to account for the reputational impact on client relationships, not just regulatory penalties.
The practical framework: Your CISO owns the Statement of Applicability mapping HIPAA requirements to your control environment. Your General Counsel owns the business associate agreement template and breach notification protocol. They meet quarterly to review the risk register together and immediately when an incident occurs.
If you're still treating HIPAA as something your IT department handles in the background, you're making the same mistake that led to 196,645 breach notifications. The regulation is technical, but the risk is existential to your client relationships. Split the accountability accordingly.
