Connecting a tool to your caseload is a decision about who you trust with your clients. As SSD software offers more of the same features, that question matters more than the feature list, and a free price tag hides the part you most need to know: who is paying, and what they get for it. Whether software is secure tells you who is kept out. Its terms tell you who is let in.
For a disability firm, what gets let in is medical histories, Social Security numbers and the names of people who will soon be eligible for Medicare. If a stranger calls one of those clients to sell them something, the client doesn’t think about your software vendor. They think about the firm they trusted with their file, and that trust is where your referrals and reviews come from. That is the stake in choosing a free or low-cost ERE and case-tracking tool, the category Chronicle competes in. Such tools can be useful. The questions below, and a current example, help you see what the arrangement asks of your clients before you upload one.
Chronicle's short answer
Chronicle is independently owned. It isn't owned or controlled by a law firm, insurer or association.
We don't sell a firm's case or claimant data or share it for another company's independent use.
We do not use firms' case data to train AI models.
Chronicle has its own SOC 2 Type II report, audited every year.
Who Pays for Free Software?
When a product is free, someone else pays for access to something the user brings. Meta is the cleanest public example: in 2025, advertising made up $196.2 billion of its $201.0 billion in revenue, more than 97%, according to its annual report filed with the SEC.
Legal software has more ways to be free. Dues, a grant or a parent organization can fund it, a paid tier can subsidize it, and so can referral income from services offered to your clients, or data. None of these is wrong on its face. What matters is which one applies, and whether it needs anything from your clients they have not agreed to.
A SOC 2 Type II report is worth asking for (the guide on how to evaluate legal software before you sign walks through how). It does not tell you what a vendor’s terms let it do with what you submit. A tool can be well locked and still, by its own terms, hand a key to someone else.
Who Else Can Contact Your Clients?
Once a client’s information is in the system, who besides your firm is allowed to contact them, and about what?
The answer decides whose name is attached to every call your client gets. To a client, an unexpected sales call about a Medicare plan looks like a breach by the firm they hired, not by a vendor they have never heard of. If your firm has referral relationships of its own, outreach you didn’t choose can redirect that income too.
The answer is rarely in the marketing. Look in the terms for the specific feature you are turning on, which can differ from the website’s terms, and in any separate agreement you sign to activate it. In the sharing section, note every party named (affiliates, partners, outside providers, “related programs”) and what each may do. Processing data to deliver your service is ordinary. Reaching out to your client about other services, memberships or programs goes further.
- Can anyone other than my firm contact my clients directly?
- Does any outreach happen without my firm choosing to send it?
- If the terms make the firm responsible for client permission, does my engagement letter cover it?
- Does any of this change if I stop using the tool?
Brock Hunsaker of SSD Advocates put the reason his firm texts clients itself plainly:
I want to be the first person to communicate an update to our client as a way to build trust.
Brock Hunsaker, SSD Advocates, LLC
The duty side is real too. ABA Model Rule 1.6(c) asks a lawyer to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” Check your state’s version. A free tool does not move that duty to the vendor.
What Happens to Your Clients’ Data When You Leave?
Plenty of firms check how to get into a tool and never check how to get out. If a vendor keeps your clients’ information after you leave, it can go on holding files your clients trusted to you, and you are the one they will ask about it.
Ask whether the vendor keeps your data after you cancel or your membership lapses, for how long, and why. Retention for legal and tax obligations is normal; retention for open-ended “business purposes” is broader. Ask whether any permission to contact your clients or use their information ends the day you cancel. And ask how you export your data, in what format, and at what cost. A tool that is free to join and expensive to leave has not really been free.
Is “De-Identified” a Promise or a Qualifier?
Many terms allow research or product use of data “in de-identified form.” Under HIPAA, de-identified health information is no longer protected, so the word carries weight. There are two methods. Under Expert Determination, a qualified expert concludes the risk of identifying anyone is very small. Under Safe Harbor, 18 types of identifiers are removed, including names, Social Security numbers, any geographic unit smaller than a state and every date element except the year. The organization that de-identified the data may keep a code to re-identify it later, under conditions.
“Will be de-identified” is a commitment. “Where practicable” is a qualifier that leaves room for identified use. Ask which method is used, whether it covers every secondary use, and whether your firm can opt out of research or aggregate use entirely.
Who Earns From a Referral, and Who Chooses It?
Referral programs show up often in disability practice, and many help clients. Some pay the referring firm, the vendor, or both. Money changing hands is not the test. A referral carries your firm’s name, so when a client is passed along without your say, you lose the referral relationship and the client’s sense that you were looking out for them.
Chronicle runs one of these programs itself. Through Medicare Partners, Chronicle can flag clients approaching Medicare eligibility, the firm decides whether to offer a client the connection, and the Medicare Partners team contacts the client once the firm makes the referral. When the client enrolls in a Medicare Advantage plan through the referral, the firm is compensated. Chronicle’s Medicare Partners post states the control this way: “You control the referral. If a client prefers not to receive Medicare guidance, do not make the referral. The program is opt-in for your firm and for each client.”
That is the standard worth holding any vendor to, Chronicle included. Ask who is paid when a client is referred, and whether the amount is disclosed. Then the question that matters most: does your firm choose each referral, client by client, or are clients passed along by default once you use a feature? If it is by default, the firm is no longer the one deciding. Referral compensation can also raise ethics questions under your state’s rules, so check with your bar first.
What Should a Free Medical-Records Offer Tell You?
Records cost money and time, and a program that delivers them free can be a real help. It is also where a client signs the most consequential document in this list: a release.
Under HIPAA, a valid authorization must name who may receive the information, describe it and the purpose, carry an expiration, state the right to revoke in writing, and warn that the recipient may redisclose it beyond the rule’s protection (45 CFR 164.508). That last warning matters most when records pass through an intermediary. For comparison, SSA’s own SSA-827 is good for 12 months and can be revoked in writing.
| Ask before the client signs | Why it matters |
|---|---|
| What records, from whom, for what dates? | A broad release can reach far past what the claim needs. |
| Who receives the records first: your firm, or an organization that forwards them? | An intermediary is another party holding your client’s health information. |
| Is the client offered anything else, such as a medical visit, an enrollment or a membership? | The release may open a direct relationship with another organization. Ask who bills for it. |
| Is any extra service clearly optional, and does declining affect getting the records? | Consent tied to something the client needs is weaker consent. |
| How long does access last, and how does the client revoke it? | Compare it with the SSA-827’s 12 months. |
| What if the client says no? | The firm needs its own path to the records either way. |
A well-run program will have written answers to all of these, and if it doesn’t, that tells you something too.
A Current Example: ACRD’s Partner Portal
Free or low-cost ERE and case-tracking tools are the category Chronicle competes in, so it is fair to name one and apply the same questions. Advocates, Counselors & Representatives for the Disabled (ACRD) describes its Partner Portal as “A powerful gateway to enterprise-level tools delivered to partner firms at little to no cost.” Its public help center describes a “BSO tool” in the portal with screens for each case stage (“Initial, Reconsideration, Hearings, Appeals Council, and Federal District Court”) and PACER checks “every five days.” For a feature-by-feature look, see our comparison of ACRD’s BSO tool and Chronicle.
ACRD’s technology page also describes a Medicare education service: “your clients are personally guided at their enrollment time.” That is the same territory as the referral questions above. ACRD’s terms of service define the “Resources” a member uses to include its “customer relationship management software, agent portal, tools, data, materials, referrals, or any compensation or benefits provided in connection with your affiliation with ACRD.”
ACRD’s privacy policy, “Last updated June 13, 2024,” says it explains how ACRD handles information “when you visit our website.” It states, “We do not process sensitive personal information,” and that ACRD keeps personal information no longer than “the period of time in which users have an account with us.” Ask ACRD which document governs client information submitted through the portal.
When a Tool Comes With a Related Organization
Some free tools sit inside a family of organizations: an association, a sister nonprofit, a program partner. That is not wrong on its face, and many of these groups do real work. But each organization can have its own terms, its own privacy policy and its own reasons to contact your clients, and a portal agreement or a records release can name more than one of them. A client who hears from an organization they have never heard of will still connect that call to your firm.
Before a client’s information goes in, find out exactly which organizations it can reach:
- Which organizations do the terms, the release and the privacy policy name, and how are they related (shared leadership, staff, funding or members)?
- Does client information pass from the tool to a related organization, and under whose terms?
- Which organization contacts your clients about Medicare, records or a medical visit, and does anyone earn from that contact?
- Does the related organization have its own privacy policy, and does it cover health information?
- If you leave the tool, does the related organization keep what it already received?
If you’re an ACRD member, read the terms the portal asks you to accept before you submit a client’s information, and check the questions above.
We don’t know how these programs are funded, and we are not suggesting anyone sells client data. ACRD’s pages describe tools many firms may find useful, and the questions here are the same ones Chronicle answers below.
Facts about other organizations are from their public websites as of October 22, 2026. If anything here is out of date, email us at support@chroniclelegal.com and we’ll correct it.
How Chronicle Answers These Questions
We would rather answer these in public than ask you to take them on trust, and every answer below is one you can repeat to a client.
| Question | Chronicle’s answer |
|---|---|
| Who pays for Chronicle? | Firms pay per case Chronicle monitors, so the price scales with the caseload, not the payroll, and it is published on our pricing page. More than 150 SSD firms use Chronicle. Chronicle isn’t backed by venture capital and doesn’t accept ownership investment from customer firms. |
| Is it secure? | Chronicle has its own SOC 2 Type II report, issued to Chronicle Technology, Inc. The audit covers the Security criterion and is repeated every year, and firms doing due diligence can ask for a copy. Data is encrypted in transit and at rest. |
| Who else can use what we submit? | We don’t sell a firm’s case or claimant data or share it for another company’s independent use. Chronicle is independently owned and isn’t owned or controlled by a law firm, insurer or association. |
| Who can contact our clients? | Chronicle Dispatch can text a firm’s clients when something happens on their case, using templates the firm customizes. Firms control which clients are enrolled, a client who is not enrolled receives nothing, each firm texts from its own dedicated, isolated number, and Chronicle records opt-outs. Chronicle never contacts a firm’s clients unless the firm sends the message through Dispatch. |
| What happens when we cancel? | After cancelling, a firm has 30 days to request an export of its data, and Chronicle fulfills the request within 60 days. In practice, Chronicle deletes a firm’s data 90 days after cancellation. |
| Can we take our data with us? | Yes. A firm can export its data at any time. A full export includes all of its client data, case status data and documents, as CSV files and PDFs, at no fee. |
| Is our data used for research, aggregate analysis or AI training? | We do not use firms’ case data to train AI models. We do use aggregated, de-identified case data to synthesize industry trends for broader educational efforts, like our Know Your Numbers talk. |
| Who earns from referrals? | Medicare Partners pays the firm when a client it refers enrolls in a Medicare Advantage plan. The program is opt-in for the firm and for each client, and Medicare Partners receives a referral only when the firm chooses to make one. Nothing is passed along automatically. Chronicle doesn’t automatically sell or route claimant leads to federal court appeals firms or insurance providers. Chronicle itself receives no compensation from Medicare Partners referrals. |
| Medical records? | Chronicle is preparing to launch medical records retrieval through a partner. Subscribe to our newsletter on this page to hear when it launches, or check back here. |
Ask us any of these on a call, and ask every other vendor the same ones. Our comparison of whose name is on a SOC 2 report explains why the name on the report matters.
Frequently Asked Questions
Is free legal software safe to use with client data?
Free legal software can be safe with client data, but the price doesn’t decide that. The terms do: whether they limit use to the service your firm asked for, whether anyone else may contact your clients, and whether those permissions end when you leave.
What does “de-identified” mean under HIPAA?
De-identified health information has had identifying details removed so it no longer counts as protected health information. HIPAA allows two methods: an expert determination that re-identification risk is very small, or Safe Harbor removal of 18 types of identifiers.
How long does an SSA-827 authorization last?
An SSA-827 is good for 12 months from the date the claimant signs it. The claimant can revoke it in writing, though information released before the revocation can still be used.
Can a disability firm earn money from client referrals?
Some programs pay referring firms, including Medicare enrollment programs. Whether that is permitted, and what disclosure is required, depends on your state’s ethics rules. The safer arrangements let the firm decide each referral, client by client.
What should I ask a vendor before I cancel?
Ideally before you sign: what data the vendor keeps after cancellation and why, whether any permission to contact or use your clients’ information survives, and how you export your data and at what cost.
The Question to Ask First
Your clients will never read your vendor’s terms. They trust you to have read them. Free is a fair offer when the trade is written down and the firm still decides who reaches each client. Ask every vendor, including us, the same thing first: what happens to this person after I press submit?