Introduction: Two of These Rules Constrain the Software Itself
Most compliance discussions in legal technology are about how a firm uses a system. Two of the four obligations covered in this law firm software compliance guide are different: they’re about what the system may be built to do at all.
State advertising and solicitation rules determine how a firm may communicate with prospective clients, which places direct limits on what an intake feature may automate. The telephone consumer protection framework carries per-contact statutory damages with class exposure, making outbound contact functionality the largest single legal risk in a personal injury platform.
The other two obligations are about handling rather than contact: medical records obtained under patient authorization, and settlement funds held in trust.
One clarification belongs early. The professional conduct rules are adopted state by state, and many states are materially stricter than the model rules. Anything written generally, including this article, is a starting point for a conversation with ethics counsel rather than a substitute for one.
Compliance is the regulatory layer sitting underneath the full custom software development approach to a personal injury platform, and it shapes the web application development decisions made throughout the build.
This is educational and strategic content, not legal or ethics advice.
State Bar Advertising and Solicitation Rules
The rules governing lawyer communications, advertising, and solicitation are adopted state by state, and personal injury is the practice area where enforcement attention has historically concentrated.
The general shape looks like this: communications about services must not be false or misleading; advertising is permitted subject to conditions; and live person-to-person solicitation, where a significant motive is the lawyer’s pecuniary gain, is generally prohibited, with defined exceptions for other lawyers, family, prior clients, and people who routinely use such services.
Several states go further still, including waiting periods before direct contact following an accident, mandatory disclaimers, filing or retention requirements for advertising materials, and specific restrictions on claims about results.
Paying for lead generation is permitted under conditions in the model rules, but the conditions matter, and state treatment varies significantly. Paying non-lawyers to solicit clients is a criminal offense in many states.
The software implications follow directly from this: lead source records that show where a case came from, retention of advertising and communication records where a state requires it, disclaimer handling, and, most importantly, not automating any contact that would constitute prohibited solicitation.
Verify per state with ethics counsel before finalizing any intake workflow.
TCPA and Lead Contact Limits
Of the four compliance surfaces in this guide, this one carries the most direct financial exposure. It also moves the fastest, which makes it easy to get wrong in a way that doesn’t show up until a firm is already being sued.
Why This Is the Largest Exposure in Intake Technology
The telephone consumer protection framework provides statutory damages per offending call or text, and claims are commonly brought as class actions. Plaintiff firms are frequent defendants in this litigation as well as frequent plaintiffs, which makes the exposure familiar and no less real. Any feature that places outbound calls or sends text messages needs to be designed against these rules from the start, rather than adjusted to them afterward.
A Moving Target — Verify Before Publication
The consent standard differs between marketing and informational contact. The Supreme Court narrowed the definition of an automatic telephone dialing system in 2021. The FCC adopted a rule requiring one-to-one consent from lead generators, which a federal appeals court vacated in January 2025, returning the federal standard closer to its pre-2023 baseline for prior express written consent. Several states have enacted their own stricter statutes, with their own definitions and damages. This area moves continuously, and an article written from a stale summary can lead a firm into genuine exposure. Verify the current federal and state position before publication.
What the Platform Must Carry
Consent capture with provenance is essential: what was consented to, when, through what channel, and what disclosure was shown at the time. Do-not-contact list handling and scrubbing need to run continuously. Calling-time windows should be set by the recipient’s location, not the firm’s. Revocation processing needs to take effect immediately across every channel at once. And all of it needs retention, because the evidentiary question in these cases is what the firm can actually prove.
Crash Report and Motor Vehicle Data — a Hard Line
This deserves its own section because technology makes it easy, and the law makes it dangerous.
Federal law restricts the use of personal information obtained from motor vehicle records, providing for statutory damages, and the Supreme Court has held that soliciting clients does not fall within the statute’s exception for uses connected to litigation. Several states separately restrict the release or use of personal information from accident reports for solicitation purposes, and some impose waiting periods on any direct contact after an accident.
The practical instruction for anyone building or buying a platform is straightforward: a feature that ingests crash reports or vehicle record data in order to identify and contact potential clients is not a competitive advantage. It is exposed under federal law, state law, and the professional conduct rules simultaneously.
If a vendor proposes building this kind of feature, that itself is information about the vendor worth taking seriously.
Confirm the position in every state the firm operates in with ethics counsel before moving forward.
Medical Records Handling — and Why This Is Not a HIPAA Obligation
A great deal of legal technology content states that a plaintiff firm must comply with the federal health privacy rules. That is generally not the correct framing, and the distinction matters for how a platform gets designed.
A plaintiff firm is ordinarily neither a covered entity nor a business associate. It obtains records from providers under a signed authorization from the client, as a third party the client has authorized to receive their information. Its obligations flow from the terms of that authorization, from the professional conduct rules on confidentiality, from state law, and from its own contracts, not from the federal rules directly.
What that means practically: authorizations have required elements and expiry dates, and a platform should track validity so requests don’t go out against stale authorizations. Records received should be protected to the standard the confidentiality rules require, which in practice means applying the same controls a covered entity would use.
Where the firm engages vendors who are themselves regulated, their arrangements are their own, separate from the firm’s obligations.
Confirm the framing for your firm with counsel rather than assuming in either direction.
IOLTA Trust Accounting and Fee Agreements
Settlement proceeds arrive into trust, and everything that follows, lien payments, provider payments, cost reimbursement, the fee, and the client’s distribution, flows out of it. That places disbursement at the intersection of the two obligations most likely to produce a disciplinary complaint.
The trust requirements are specific: client funds separated from the firm’s own, a ledger for each client, an overall trust ledger reconciled against both the bank statement and the sum of client ledgers, no disbursement against uncollected funds, and prompt accounting to the client.
The fee agreement requirements are equally specific. A contingency agreement must be in writing and signed, stating the method of calculation and how expenses are handled, and whether costs are deducted before or after the fee is computed changes the client’s net materially. Many states require a signed settlement statement itemizing the distribution.
Some states cap contingency fees in particular case types, and division of fees with a referring lawyer carries its own conditions, including a written client agreement.
The software consequence is singular: the disbursement calculator implements the agreement on file, and the same figures drive the trust ledger. Two systems reconciled by hand is how arithmetic becomes a complaint.
The File You Are Holding
A personal injury file is an unusually complete picture of a person: their injuries and treatment, their medical history, their earnings, their household circumstances, sometimes photographs taken at their most vulnerable, and occasionally the same for a minor.
That makes access design worth more attention than a general legal matter would justify. Staff access should be scoped to assigned matters, audit logging should record reads rather than only edits, and retention should be deliberate rather than indefinite. Any staff-facing app carrying that file into the field has to meet the same standard, which is a custom mobile app development requirement rather than a device policy.
Vendor access deserves the same scrutiny, including any records retrieval service, any offshore support team, and any AI tool that processes records.
The confidentiality obligation and state data breach laws both apply here. Neither is unusual. Both are worth more attention than the effort they cost.
Establishing which of these constraints shape your scope is the first job of pre-build scoping, covered further in our guide: Off-the-Shelf vs Custom for US Personal Injury Firm Owners.
Final Thoughts
Firms that design intake technology against the advertising and telephone consumer rules, rather than adjusting it afterward, that keep crash and vehicle record data entirely out of scope, that understand their records obligations flow from authorizations rather than from the federal health rules, and that join their disbursement calculation to their trust ledger, end up with platforms that reduce risk instead of concentrating it. Confirm your obligations with ethics counsel and your state bar.
If you are scoping a platform that will handle intake contact, medical records, and settlement funds, settling your consent architecture and your trust and disbursement design before development begins is the step that keeps compliance from becoming a rebuild. Learn more about digital transformation solutions from one of the leading AI software companies in the United States.
