If your law firm handles personal information of Massachusetts residents — which includes virtually every PI firm in New England — you must comply with 201 CMR 17.00, the Massachusetts Standards for the Protection of Personal Information. Adding AI tools to your practice introduces new compliance considerations that many firms overlook.
What Is 201 CMR 17.00?
201 CMR 17.00 is a Massachusetts regulation that establishes minimum standards for safeguarding personal information. "Personal information" is defined as a Massachusetts resident's first and last name (or first initial and last name) combined with any of:
- Social Security number
- Driver's license number or state ID number
- Financial account number (credit card, bank account)
- Biometric data (fingerprints, retinal scans)
For PI law firms, this means virtually every client file contains protected personal information — SSNs on medical records, driver's license numbers from police reports, and financial account details for settlement disbursement.
Who Must Comply?
Any person or entity that owns, licenses, stores, or maintains personal information about a Massachusetts resident. This applies regardless of where your firm is located. If you have even one Massachusetts client, 201 CMR 17.00 applies to you.
The Compliance Checklist
Use this checklist to assess your firm's compliance:
Written Information Security Program (WISP)
- Designated data security coordinator
- Written WISP document covering all requirements below
- Regular risk assessments (at least annually)
- Employee training program on data security
- Disciplinary measures for violations
Access Controls
- Unique user IDs for each employee
- Role-based access restrictions
- Automatic account lockout after failed login attempts
- Immediate termination of access for departing employees
- Regular access reviews (quarterly recommended)
Encryption
- Encryption of personal information stored on laptops and portable devices
- Encryption of personal information transmitted over public networks (email, internet)
- Encryption of personal information stored in databases
Monitoring & Incident Response
- Audit trails for access to personal information
- Firewall and system security monitoring
- Incident response plan with breach notification procedures
- Documentation of all security incidents
Third-Party Vendor Management
- Written contracts requiring vendors to maintain security measures
- Due diligence on vendor security practices before engagement
- Regular review of vendor compliance
AI-Specific Requirements
When you add AI tools to your practice, each tool becomes a third-party vendor that processes personal information. This means:
- Data Processing Agreements: You need a written agreement with each AI vendor specifying how they handle personal information, their encryption standards, and their data retention policies.
- Data Flow Documentation: Map where personal information flows — from your system to the AI provider and back. Identify any intermediate storage or processing.
- Encryption in Transit: Ensure all data sent to AI tools is encrypted using TLS 1.2 or higher.
- No Model Training: Confirm in writing that the AI vendor does not use your data to train their models. This is both a privacy requirement and an ethical obligation under ABA Opinion 512.
- Data Residency: Verify where the AI processes data. Offshore processing introduces additional compliance risks.
How Legience Helps
Legience was built with 201 CMR 17.00 compliance as a core design requirement, not an afterthought:
- AES-256 encryption at rest and TLS 1.3 in transit — exceeding the regulation's requirements
- Role-based access controls with granular permissions per user, per case
- Tamper-evident audit logs recording key actions — logins, AI calls, and permission and data changes
- No AI training & no model-side retention — client data is not used to train models and is not retained by the AI provider after processing
- US-only data processing in AWS US-East regions
- Automatic session timeout and account lockout after failed login attempts
For the full details on our security architecture, visit our Security page →
Penalties for Non-Compliance
The Massachusetts Attorney General can impose penalties of up to $5,000 per violation. In the context of a data breach affecting multiple clients, each client's compromised record can constitute a separate violation. A breach affecting 100 clients could result in $500,000 in fines — plus the reputational damage, client loss, and potential malpractice liability.
The cost of compliance is always less than the cost of a breach. Start with the checklist above, evaluate your AI vendors against these standards, and document everything.
For the attorney ethics perspective, see our guide on AI ethics and attorney-client privilege. Learn how Legience's private, BAA-backed AI architecture addresses these requirements by design.
Ready to See Legience in Action?
Early access is open: founding pricing, plus free setup and data migration.
Apply for Early Access
