AI Confidentiality for Immigration Attorneys: The Practical Setup

In 2026, a CEO facing federal fraud charges typed details from his attorney's communications into Claude. He generated 31 defense strategy documents. The government seized them. Judge Jed Rakoff of the Southern District of New York ruled they were discoverable in full.

His reasoning: Claude is "plainly not an attorney." Using a third-party AI platform eliminates the reasonable expectation of privacy that privilege requires. The 31 documents went to prosecutors.

That case was about a defendant, not a lawyer. But the mechanism applies in reverse. An attorney who inputs client information into a consumer AI platform has arguably made a third-party disclosure. Whether that waives privilege depends on what was input, what tier of service was used, and whether a BAA was in place.

This is not hypothetical risk. It is the current litigation posture on AI and privilege. The practical answer is not to avoid AI. It is to understand exactly which tier of service provides contractual protection and what the remaining risk is after that.

ABA Formal Opinion 512: What It Actually Requires

ABA Formal Opinion 512 was issued July 29, 2024. It is the first ABA ethics opinion specifically addressing attorney use of generative AI tools. A detailed analysis by UNC Law Library summarizes the practical implications for each covered Model Rule.

The opinion focuses on three Model Rules.

Model Rule 1.1 (Competence). You must understand the tool you are using well enough to deploy it competently. This does not mean you need to understand transformer architectures. It means you understand what the tool can and cannot do, how it fails, and how to detect when it produces unreliable output. For immigration work: you must know that AI models hallucinate citations, will occasionally state facts with more certainty than the evidence supports, and produce plausible-sounding legal arguments that may not survive scrutiny.

Model Rule 1.6 (Confidentiality). The duty of confidentiality covers "all information relating to the representation of a client, regardless of its source." Using an AI tool does not create a carve-out. If client information is input into a tool that uses it for training or exposes it to third parties, you have potentially violated Rule 1.6. The practical implication: only input client-identifying information into tools with a signed BAA and zero-training-use terms.

Model Rule 5.3 (Supervision of Non-Attorney Assistance). AI output must be supervised as you would supervise a paralegal. This means a human attorney reviews every AI-generated paragraph before it appears in a filing or client communication. The opinion specifically requires a "human in the loop": AI as a drafting tool, not a filing tool.

The three rules below map to specific failure points in an AI workflow: Rule 1.1 applies when you use an AI tool you do not understand well enough to supervise its output; Rule 1.6 applies when you input client identifiers into a non-BAA tool; Rule 5.3 applies when staff members use AI without adequate supervision.

The Tier Problem: Consumer vs. Enterprise

The single most common mistake immigration attorneys make with AI is using the wrong tier of service for client work.

Both Claude.ai and ChatGPT have multiple tiers. The distinction that matters for attorney use is whether the tier includes a Business Associate Agreement (BAA) and whether inputs are excluded from model training.

Claude.ai:

• Free and Pro tiers: no BAA, Anthropic may use inputs to improve models
• Claude Team: no BAA. This is where most attorneys get this wrong. Team tier looks "business" but does not provide a BAA.
• Claude Enterprise (with HIPAA-ready plan): BAA included, click-to-accept in the setup flow; inputs not used for training; zero data retention options available

ChatGPT:

• Free, Plus, and Pro: no BAA
• ChatGPT Team: no BAA
• ChatGPT Enterprise: BAA available, data not used for training, controls over data retention

The practical rule: if the subscription shows "Team" in its name, it does not have a BAA. Enterprise tier is the threshold for client work.

The Heppner case involved consumer-tier Claude. Had the defendant's attorneys been using Claude Enterprise with a BAA, the analysis might have looked different (not necessarily favorable, but different). The third-party disclosure argument weakens when there is a contractual data processing relationship.

Configuring Claude Enterprise for Client Work

Claude Enterprise's HIPAA-ready plan is the tier relevant to immigration attorneys. Setup involves:

1. Start an Enterprise agreement with Anthropic through the enterprise sales channel. This triggers the BAA acceptance flow.
2. Accept the BAA during the Enterprise setup. Note: if your organization signed a BAA for Claude API access before December 2, 2025, that agreement covers API usage only and does not extend to the Enterprise chat interface. You need a separate BAA for the Enterprise plan.
3. Create a Project for EB-1A or O-1A work. Add your system prompt (see the prompt library guide for a recommended system prompt template).
4. Set data retention controls according to your firm's needs. The HIPAA-ready plan includes options for zero data retention. Confirm this with your account team.
5. Review data processing terms before uploading documents. The Enterprise terms specify how Anthropic handles uploaded files, retention periods, and deletion processes.

Cost: Claude Enterprise is priced by seat, typically starting around $60/seat/month for standard configurations. The HIPAA-ready add-on may require a separate enablement step. Confirm with your account team during setup.

Configuring ChatGPT Enterprise for Client Work

ChatGPT Enterprise setup for attorney use follows a similar pattern:

1. Enterprise contract through OpenAI. Not available through the consumer website. Requires direct sales engagement.
2. BAA execution. OpenAI provides a BAA for ChatGPT Enterprise. This is separate from any API BAA.
3. Admin console data controls. ChatGPT Enterprise provides an admin console where conversation history, training use, and data retention can be configured. Turn off conversation history for client work if your firm's policy requires it.
4. Custom GPTs (Enterprise equivalent of Claude Projects): create a custom GPT with the EB-1A legal context as the system prompt. Add instructions for output format and evidence citation.

Both platforms behave comparably once configured. Claude tends to produce longer, more structured legal argument paragraphs; ChatGPT tends to follow explicit formatting instructions more precisely. The side-by-side comparison of their EB-1A output covers the practical differences.

What Not to Input: The Five Identifiers to Exclude

Even on Enterprise tier, the minimum-input principle applies. If the task does not require a specific identifier, omit it. These five identifiers should be excluded unless the task specifically requires them:

1. A-numbers (Alien Registration Numbers). An A-number combined with a name and any case fact creates a uniquely identifiable record. It is never required for AI drafting tasks. The model does not need it to draft a Criterion 5 argument.

2. Passport numbers. Never required for petition drafting tasks.

3. Social Security and Tax ID numbers. Same. Remove them from any document before uploading.

4. Date of birth combined with country of origin. The combination is a direct re-identification vector. Separately, neither is typically sensitive. Combined, they create a unique identifier. Omit the combination.

5. Full name combined with case details. On Enterprise with a BAA, this is contractually protected. On any other tier, it is a disclosure. When in doubt, replace the name with [BENEFICIARY] in the prompt.

None of these exclusions degrade AI output quality. The model produces equally good legal argument text whether the beneficiary is named "Dr. Zhao Wei" or "[BENEFICIARY]."

The Anonymize → Process → Re-identify Workflow

This three-step process applies to any petition task:

Step 1: Anonymize. Before uploading a document or entering facts into a prompt, replace identifiers with placeholders:

• Client name → [BENEFICIARY]
• Employer → [EMPLOYER]
• Specific institution names (if sensitive) → [INSTITUTION A], [INSTITUTION B]
• A-number, passport number, SSN → remove entirely

Step 2: Process. Run the AI task with the anonymized input. The model produces the same quality output regardless of whether names are real or bracketed. Draft the argument, generate the briefing, analyze the RFE.

Step 3: Re-identify. In your editing step, find-and-replace the placeholders with actual names. Review the output for accuracy while reinserting the real identifiers.

This adds roughly two minutes to any task. It applies on any tier, including Enterprise, but is most important on non-BAA tiers where it may be the only protection layer.

What This Does Not Solve

Enterprise tier and anonymization reduce exposure. They do not eliminate it.

The Heppner ruling involved a consumer platform. The privilege analysis under an Enterprise agreement with a BAA has not been definitively litigated. Reasonable expectation of privacy may still be contested even with contractual protections. The safer practice is to treat the anonymize-then-process workflow as mandatory, not optional, on any tier.

State bar rules vary. California, New York, and Florida have issued guidance that supplements ABA Opinion 512 with jurisdiction-specific requirements. If your practice is primarily in one state, verify whether your state bar has issued a technology opinion that adds obligations beyond the ABA framework.

Disclosure to clients is a separate question. ABA Rule 1.4 requires adequate communication. The cautious practice is a technology disclosure in your engagement letter noting that AI drafting tools may be used in preparation of materials. This does not require per-use disclosure. It provides informed consent for the representation generally.

Setting Up: The Checklist

Before using AI for any client matter:

• Confirm your subscription is Enterprise tier (not Team, not consumer)
• Confirm a BAA is signed and in effect (check with account team if using Claude pre-Dec 2025 API BAA)
• Turn off conversation history / training use in admin settings
• Create a project or Custom GPT with your legal context system prompt
• Implement the anonymize → process → re-identify workflow for any task involving client identifiers
• Update your engagement letter to include an AI technology disclosure
• Review ABA Formal Opinion 512 and your state bar's AI guidance once per year

For the specific prompts to run after setup, see 30 AI Prompts for Immigration Attorneys. For the tool comparison covering costs and BAA availability, see Best AI Tools for Immigration Attorneys 2026. For the broader question of whether AI output is safe to file, see Is AI Safe for Your Immigration Practice?.

Immigration Copilot is built on AWS infrastructure with attorney-client data isolation by design: documents are stored in S3 with per-organization scoping, petition generation runs through Claude on Amazon Bedrock (not through Claude.ai), and no client data is ever used for model training. The BAA question doesn't apply to a purpose-built petition drafting platform the same way it applies to general-purpose AI chat. The architecture was designed for this data type from the start.