HIPAA and Attorney-Client Privilege in Virtual IMEs

Virtual independent medical examinations can make medical-legal scheduling faster, but they also remove the comfort of a controlled exam room. For attorneys, insurers, and corporate legal teams, the issue is not whether a virtual IME is useful. The issue is whether the process protects protected health information, preserves litigation strategy, and keeps the examiner’s report defensible.

MLP IME provides independent medical examinations and related physician expert services across all 50 states, including virtual and in-person options when the case facts support that format. In a virtual setting, the privacy plan needs to be built before the appointment, not reconstructed after a report is challenged.

Why HIPAA and Privilege Need Separate Analysis in a Virtual IME

HIPAA governs health information handling

PHI movement and safeguards

HIPAA is concerned with protected health information. The Privacy Rule sets conditions for use and disclosure of PHI, while the Security Rule addresses safeguards for electronic PHI. In a virtual IME, that means counsel should think about records transfer, platform access, identity verification, recordings, report delivery, and who is allowed to be present during the exam.

An IME vendor, examining physician, health plan, claims administrator, or other participant may have HIPAA obligations depending on its role in the transaction. HHS guidance on business associates is useful here because vendors that create, receive, maintain, or transmit PHI for a covered entity may need appropriate contractual safeguards in place before PHI moves through the workflow.

Attorney-client privilege protects legal communications

Legal advice is a separate category

Attorney-client privilege serves a different purpose. It protects confidential communications between attorney and client made for the purpose of seeking or providing legal advice. It does not automatically cover every medical record, scheduling email, video link, or expert communication simply because a lawyer is involved.

That distinction matters in a virtual IME. A claimant’s medical history may be PHI. Counsel’s evaluation of how an IME finding affects litigation strategy may be privileged. A physician expert’s draft analysis may implicate work-product protection depending on the engagement, jurisdiction, and procedural posture. Treating all three categories as if they are the same creates unnecessary risk.

Virtual format adds practical weak points

Remote access creates new exposure points

The virtual format can introduce weak points that are not always visible in an in-person exam. A link can be forwarded. A family member can remain off camera. A recording setting can be left on. A records packet can be uploaded to the wrong folder. A screen can display privileged notes while the physician is present.

For attorneys arranging an examination through MLP IME’s medical expert witness services, the safer approach is to separate the medical, procedural, and legal-strategy channels before the appointment starts.

Building a HIPAA-Conscious Virtual IME Workflow

Start with the minimum necessary mindset

Limit the packet to the exam purpose

HIPAA’s minimum necessary concept is a useful discipline even when lawyers are also dealing with discovery rules, authorizations, or court orders. The exam packet should be tailored to the scope of the evaluation. Counsel may need to include prior treatment records, imaging, job descriptions, incident reports, or relevant pleadings, but the packet should not become a catch-all dump of unrelated PHI.

That does not mean withholding medically relevant records from the examiner. It means deciding what the physician needs for the stated evaluation and documenting why the materials were included. When the exam later becomes part of a deposition or motion practice, that discipline helps show the process was intentional.

Control the video platform and access points

Treat platform settings as process controls

For a virtual IME, the video platform should support appropriate privacy and security safeguards. Counsel should confirm how invitations are sent, whether waiting rooms or passcodes are used, whether participants are authenticated, whether recordings are disabled unless expressly authorized, and how technical failures are documented.

HHS telehealth guidance recognizes that remote communication technologies can be used in healthcare settings, but it does not remove the need for covered entities and business associates to comply with applicable HIPAA requirements. Virtual convenience is not a substitute for access control.

Document who attends and why

Create a participant record

The attendance list should be settled before the exam. The examining physician, claimant, interpreter, nurse observer, defense representative, plaintiff representative, or technical support person may each have a legitimate role in some cases. But each additional person also raises privacy, privilege, and witness issues.

A clean attendance protocol should identify each person, their role, and whether they may speak during the examination. If a dispute arises, the record should show that the virtual setting was managed like a formal medical-legal event, not a casual video call.

Protecting Privilege Without Obstructing the Examination

Keep legal strategy out of the exam room

Give the examiner medical questions, not strategy

The simplest privilege safeguard is also the most overlooked. Do not place legal strategy in front of the examiner unless there is a clear reason to do so. The physician needs medical records and a legally appropriate referral question. The physician does not need counsel’s private assessment of settlement posture, witness credibility, or cross-examination themes.

Counsel can prepare the client for logistics without coaching testimony. For example, explaining how to join the video platform, what identification may be requested, and how to handle a technical interruption is different from scripting medical answers.

Separate protected work product from medical records

Use separate records and strategy lanes

Work-product protection may apply to materials prepared in anticipation of litigation, including attorney mental impressions and certain consultant communications. But protection can be weakened when materials are shared too broadly or mixed with ordinary medical records.

A practical rule is to maintain two lanes. The exam packet contains the records and referral materials the physician needs. The litigation file contains counsel’s impressions, notes, internal strategy, and communications that should not be transmitted through the IME workflow. This is especially important when an attorney, claims professional, and IME coordinator are all working in the same shared drive.

Use careful referral questions

Ask focused medical questions

Referral questions should be specific enough to guide the physician but not so argumentative that they look like advocacy disguised as medicine. A good question might ask the physician to address diagnosis, causation, restrictions, impairment, treatment necessity, or consistency with objective findings. It should not tell the physician what conclusion to reach.

MLP IME’s peer reviews and IME coordination processes can support focused medical questions, but counsel remains responsible for protecting legal strategy and complying with applicable procedural rules.

Managing Discovery, Authorizations, and Court Orders

Match the disclosure path to the case posture

Tie each transfer to legal authority

HIPAA permits certain disclosures in judicial and administrative proceedings when the regulatory conditions are met. Depending on the matter, the proper path may involve a valid authorization, subpoena, court order, qualified protective order, workers’ compensation rule, or other lawful process. The right answer depends on the case posture and jurisdiction.

This is where attorneys should avoid shortcuts. A virtual IME does not make a disclosure less formal simply because the records move electronically. The file transfer method, the authority for disclosure, and the recipient list should all match the governing process.

Treat recordings as a separate decision

Decide before anyone joins

Recording a virtual IME can raise HIPAA, privilege, evidentiary, consent, and state-law issues. It should not happen by accident. If recording is permitted or required, the parties should decide who controls the recording, where it is stored, who receives it, how long it is retained, and whether the recording becomes part of the discoverable record.

If recording is not permitted, the platform settings and opening instructions should reflect that decision. Counsel should also consider whether screenshots, screen recordings, AI meeting assistants, and automated transcripts are disabled.

Check licensing and location issues

Confirm location and authority

Virtual IMEs often involve people in different states. CCHP’s telehealth policy tracking notes that telehealth is typically considered to occur where the patient is located, and state licensing rules vary. For a medical-legal examination, counsel should confirm that the physician’s license, specialty, and location are appropriate for the assignment.

MLP IME’s nationwide network and fit-for-duty, CME, FCE, radiology, and peer review services can help match the right physician to the case, but licensing and procedural requirements still need case-specific review.

Practical Safeguards Before, During, and After the Virtual IME

Before the exam

Set the plan before the link is sent

Confirm the legal authority for the records disclosure. Limit the exam packet to relevant materials. Use a secure transfer method. Verify the physician and participant list. Send platform instructions that cover privacy, attendance, recording, identification, and technical interruptions.

Counsel should also decide who will handle day-of-exam problems. If the claimant joins from a public place, an unauthorized person is present, or the video connection fails, the team needs a response plan before the physician is waiting on screen.

During the exam

Confirm identity, location, and boundaries

At the start, confirm identity, location, participant names, and whether anyone else is present. State whether recording is allowed. Keep privileged notes, claim strategy, and internal communications off screen and out of the chat. If a problem occurs, pause and document it rather than trying to fix it informally after the fact.

The physician should be able to conduct the exam without interference. Counsel’s role is to preserve process integrity, not to turn the medical evaluation into a remote deposition.

After the exam

Control report routing

After the examination, confirm where the report will be sent, who receives copies, and how any supplemental materials will be handled. Store the report in the correct case file and avoid forwarding it through informal channels.

If the report will support litigation strategy, expert testimony, claim evaluation, or corporate decision-making, the post-exam workflow should be as controlled as the pre-exam records transfer. MLP IME’s contact page is the right place to start when a case needs coordinated scheduling, physician matching, or a secure medical-legal workflow.