If it involves medical info and the attorney is contracted by a covered entity, maybe:

https://www.hhs.gov/hipaa/for-professionals/covered-entities...

Who is paying the attorney?

Whose private information is in the documents?

Need a little more detail. Why is that a problem?

Insufficient context