HIPAA Disclaimer

Legal Status and the Scope of HIPAA Applicability

Legal Online Directory operates as a commercial lead-generation platform and attorney marketplace. We are not a "Covered Entity" as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d et seq., and its implementing regulations at 45 C.F.R. Parts 160, 162, and 164 (the "Privacy and Security Rules").

Under 45 C.F.R. § 160.103, HIPAA applies specifically to health plans, health care clearinghouses, and health care providers who conduct certain financial and administrative transactions electronically. Because Legal Online Directory does not provide medical treatment, process insurance claims, or manage health plans, we are not subject to the strictures of HIPAA in the same manner as a doctor’s office or hospital.

Furthermore, while HIPAA applies to "Business Associates"—entities that perform functions or activities on behalf of a Covered Entity—Legal Online Directory generally does not function as a Business Associate for the law firms or legal funding partners on our platform. Unless a specific Business Associate Agreement (BAA) is executed between us and a specific legal partner for a designated purpose, the information you submit to this site is not protected by HIPAA.

No Attorney-Client Privilege or Confidentiality

It is critical to distinguish between HIPAA protections and the Attorney-Client Privilege. Legal Online Directory is not a law firm. Consequently, any information you provide through our intake forms, chat features, or document templates is not protected by the attorney-client privilege as defined under state laws (e.g., Cal. Evid. Code § 950 et seq. or N.Y. CPLR § 4503).

When you submit information to us, you are providing it to a third-party directory for the purpose of being matched with legal counsel. Under the "Third Party Disclosure" doctrine, sharing information with a non-legal intermediary can result in a waiver of privilege. While we maintain internal privacy protocols, your communications with Legal Online Directory are not legal advice, and our receipt of your data does not create an attorney-client relationship.

Data Collection and the Distinction of PHI vs. PII

In the context of personal injury, medical malpractice, or workers' compensation leads, you may share details regarding medical conditions or injuries. Under HIPAA, this would be classified as Protected Health Information (PHI). However, because we fall outside the jurisdiction of the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) regarding HIPAA enforcement, this data is instead classified as Personally Identifiable Information (PII) or Sensitive Personal Information (SPI) under various state and federal privacy laws.

Governing Privacy Frameworks

Instead of HIPAA, your data is protected by the following:

• FTC Act Section 5: As per 15 U.S.C. § 45, the Federal Trade Commission (FTC) prohibits unfair or deceptive acts. We are bound by our published Privacy Policy regarding how we handle your health-related data.
• CCPA/CPRA: Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.140), "sensitive personal information" includes information concerning a consumer’s health. We provide California residents the right to limit the use of this sensitive data.
• State Health Privacy Laws: Statutes such as Washington’s My Health My Data Act (MHMDA) and Nevada’s SB 370 create HIPAA-like protections for health data collected by non-covered entities. These laws require explicit "opt-in" consent before collecting or sharing health data, which we implement for users in these jurisdictions.

Lead Generation and One-to-One Consent

In compliance with the Federal Communications Commission (FCC) 2024 amendment to the Telemarketing Sales Rule (TSR) and the Telephone Consumer Protection Act (TCPA) (47 C.F.R. § 64.1200), we do not share your health-related legal inquiries with multiple "aggregators."

We utilize a "one-to-one" consent model. When you request a referral for a medical-related legal matter, we identify the specific attorney or firm and obtain your prior express written consent to share your information with that specific entity only. This ensures that while HIPAA may not apply to our initial collection, your data is transferred securely to the legal professional who is bound by state bar ethics rules (e.g., ABA Model Rule 1.6) regarding confidentiality.

The Role of Legal Funding and Third-Party Partners

Legal Online Directory refers consumers to legal funding partners. These partners are also not Covered Entities under HIPAA. If you apply for pre-settlement funding, you will be required to sign a specific release of information. This release allows your medical providers (who are Covered Entities) to share your PHI with the funding company under 45 C.F.R. § 164.508.

Once your medical records move from a Covered Entity (your doctor) to a non-covered entity (a funding company or this directory), the HIPAA "Privacy Rule" protections typically cease to apply. However, we maintain contractual requirements with our partners to ensure they treat this data with a level of security commensurate with the Gramm-Leach-Bliley Act (GLBA) and relevant state data breach notification laws.

State-Specific Health Data Variations

While HIPAA is a federal floor, several states have enacted laws that fill the "HIPAA Gap" for entities like Legal Online Directory.

Data Security and Storage

Although we are not a HIPAA Covered Entity, Legal Online Directory implements administrative, physical, and technical safeguards that mirror many aspects of the HIPAA Security Rule (45 C.F.R. § 164.304). This includes:

• Encryption: Use of TLS 1.2 or higher for data in transit and AES-256 encryption for data at rest.
• Access Control: Limiting internal access to consumer health-related inquiries to personnel with a "need to know" to facilitate an attorney referral.
• Vendor Management: Requiring affiliate partners and case-exchange participants to certify compliance with state-level data protection statutes.

Affiliate Commissions and Referral Fees

Pursuant to ABA Model Rules of Professional Conduct 5.4 (Professional Independence of a Lawyer) and 7.2 (Communications Concerning a Lawyer's Services), Legal Online Directory does not "split fees" with attorneys in states where it is prohibited. In jurisdictions where we operate an attorney case-exchange, the referral-fee settlement is conducted in strict accordance with the rules of the state bar where the case is filed.

The payment of affiliate commissions or lead-generation fees is a business expense of the law firm and does not impact the confidentiality of the consumer's health information. However, users should be aware that the financial transaction of "selling a lead" occurs under the commercial framework of the TCPA and FTC Act, not the medical framework of HIPAA.

Revocation of Consent

Under the FCC’s latest rulings on the TCPA and the TSR (16 C.F.R. Part 310), you have the right to revoke your consent to be contacted or to have your data shared at any time. Because this directory often handles sensitive health-related legal inquiries, we provide a centralized mechanism to revoke consent for data sharing.

Revocation of consent to Legal Online Directory will stop the further dissemination of your information within our network, but it will not automatically delete records already transferred to an attorney or funding partner. You must contact those third parties individually to exercise your "Right to be Forgotten" under statutes such as the CCPA/CPRA.

Contact

If you have questions regarding this HIPAA Disclaimer or how your health-related legal data is handled, please visit our Contact page to submit a formal inquiry to our privacy and compliance department.