HIPAA-Compliant AI for Law Firms: Any Model, No Seat Minimum
ChatGPT-style AI for law firms with Claude, GPT, Gemini and Grok under one BAA: $499/month, no seat minimum, and per-client billing for medical records.
Concentrate.ai
On this page
Lawyers want to use AI, but doing it in a compliant way is hard and expensive.
A 14-person personal injury firm was quoted 50 seats to use AI on medical records under a BAA. Fifty seats, for fourteen people, before a single record was processed. Legal AI tools follow the same seat math: Harvey and Legora are reported at $300 to $2,000 per seat per month, with 10 to 25 seat minimums.
Concentrate works like ChatGPT for your firm, with any model. The only subscription is $499/month for the BAA. Everything else is pay-per-use at provider token rates, with no markup and no seats. The firm picks a model, runs the record, and sees exactly what to charge back to the client. Here's how it works.
What was the firm trying to do?
About 80% medical malpractice, 20% general PI. The AI job is the most time-consuming part of a med mal case:
Turn a medical record into a timeline
Summarize the record
Analyze standard of care and identify potentially liable parties
Records are PDFs, typically 300 to 500 pages, sometimes a few thousand. Fourteen people need access.
They had been testing Grok 4.7 and liked it. Then the enterprise rep said a BAA meant 50 licenses. Anthropic's BAA came with its own seat minimum, a per-user license fee, and usage on top. For a 14-person firm, both deals meant paying for dozens of empty chairs.
LLM Gateway
Instant access to every model
Change models, providers, add fallbacks, and more by running all AI usage through one platform.
What does ChatGPT for law firms with any model mean?
Concentrate comes with a playground: a chat interface where you pick a model, pick a key, upload a file, and go. For a firm that is not building software, the playground is the product.
Concentrate
Grok or Claude seats
Harvey or Legora
Models
Claude, GPT, Gemini, Grok, DeepSeek, GLM, Kimi and more, one login
One vendor
Vendor's choice
Compare models on the same record
Yes, side by side
No
Varies
Pricing
$499/month with a BAA, plus provider token rates with no markup
Per seat, seat minimums (this firm was quoted 50), usage on top
Reported $300 to $2,000 per seat per month, 10 to 25 seat minimums
Bill back to clients
Per-client keys with spend reports
No per-client keys
Varies
Data retention
Zero data retention, locked on
Depends on plan
Depends on contract
On the call, the same prompt ran through Claude Opus 5.5, GPT, DeepSeek and Grok at once. Opus had the best structure and cost 7 cents. DeepSeek cost half a penny. The firm can run that test on a real record and pick a model on evidence.
Which model is best for medical record analysis?
Claude Opus 5.5 leads the Artificial Analysis Healthcare and Medical Index at 58, with Claude Sonnet 5.5 and GPT-6 Astra at 54 and GPT-6.1 Sol at 52. Grok 4.7 scores 47 and DeepSeek V4.1 Flash 41. For this use case we'd start with Claude Opus 5.5 or Sonnet 5.5, with Grok 4.7 or DeepSeek as cheaper options. Any frontier model from the last year will beat doing it by hand, and the playground lets you try them all, Gemini 4 Argon included, before committing.
One exclusion: Anthropic's newest flagship, Claude Fable 5, requires 30-day data retention on every platform and can't run with zero data retention. Concentrate's HIPAA organizations are zero retention by design, so Fable simply doesn't appear there and nobody can select it by mistake.
How does the BAA work?
Medical records are PHI, so anyone processing them for you is a business associate and must sign a BAA. Under HHS guidance, that includes cloud and AI services. The firm signs one BAA with Concentrate. Concentrate holds the BAAs with Anthropic, OpenAI, Azure, Google Vertex AI, Fireworks AI, Azure Fireworks and Baseten. One agreement, 70 covered models.
Once signed, we turn on a HIPAA organization:
Zero data retention locked on
Request logging locked off
Non-BAA models and providers blocked, including fallbacks
Labeled HIPAA / PHI enabled at the top of the screen; nobody on the firm's side can misconfigure it
This firm signed via DocuSign during the call. The HIPAA org was live within the hour. The firm still owns its own HIPAA obligations; the BAA and the locked settings keep the AI side covered.
Why doesn't the playground save your chat history?
Because Concentrate doesn't store your data. Close the browser and the session is gone. No copy of the record, prompt or output sits on our systems, and every covered provider route runs with zero data retention.
The attorney on the call said that's "actually better for us." The work product goes in the case file; the AI vendor never becomes a second copy of the client's medical history. Need the summary again? Re-run it for a few cents. Prompt caching is supported, so re-reading the same document costs less the second time.
How do you bill AI usage back to clients?
The same way you bill Westlaw or LexisNexis.
One team per client (or per matter)
One key per client, named with the client or matter ID
A spend cap on each key, total or monthly
Roles: Owner, Admin, Member, Billing, so associates can use keys but not see firm-wide spend
The dashboard shows requests and spend by key. At month end, the number next to each client's key is the number on the invoice. You can also block expensive models on specific keys if you want paralegals on a cheaper model by default.
What does it cost?
$499/month for the BAA, whatever your headcount. Compare: 50 seats for 14 people means paying for 36 empty seats every month, plus usage. Without a BAA there is no subscription fee at all.
Inference at provider rates, no markup, no per-request fees. Real numbers from the call:
Task
Model
Cost
2-page sample record
Claude Opus 5.5
$0.07
Same task
DeepSeek
$0.005
Summarize a 2,000-page PDF (about 1.6M tokens, in two passes)
Claude Opus 5.5
About $8
Our estimate for this firm's total monthly token spend across all 14 people: well under $100. Seat subscriptions charge every chair, used or not. Pay-per-use means you pay for the charts you actually run, and you know which client each one belongs to.
Where is this going?
Law firms are a newer use case for us, and we're shipping improvements constantly: HIPAA-compliant web search for current case law, better PDF handling, and a redaction tool that strips client identifiers before a prompt reaches the model. Firms like this one, telling us exactly how a med mal record moves through their office, are shaping what we build next.
How do you get started?
Sign up at concentrate.ai with Microsoft, Google or email.
Create a key, add $20 in credits, and test the playground with non-PHI documents. No subscription fee without a BAA.
Ready for real records? Request a BAA. We DocuSign it, turn on your HIPAA org, and you're live.
Set up one team and key per client, turn on spend caps, and invite the firm.
Yes. $499/month with no seat minimum, no per-request fees and no markup on tokens; inference is billed at provider rates.
Which models can we use on medical records?
70 models across 7 BAA-eligible providers as of November 2026, including Claude Opus 5.5, GPT-6.1 Sol, Gemini 4 Argon, Grok 4.7, DeepSeek V4.1 Flash and GLM-5.3. See the live list in Model Fortress. Claude Fable isn't available on a HIPAA organization.
Is DeepSeek safe on client data?
On Concentrate, it runs on Azure, Fireworks AI, Azure Fireworks and Baseten under our BAAs with them, with zero data retention. Nothing goes to DeepSeek's own API.
Does Concentrate store our records?
No. Zero data retention is locked on and request-content logging is off. Closing the browser clears the session.
Do we need engineers?
No. The playground is a chat interface. The API is there if you ever want a custom front end.
Blog