If it involves medical info and the attorney is contracted by a covered entity, maybe:

https://www.hhs.gov/hipaa/for-professionals/covered-entities...