Insight #4 State Bar Rules and Compliance for Client Communication

Insight #4 objective

To bring awareness and insight on the existing State Bar Rules and the post COVID-19 pandemic, as they apply to stay at home orders, working remotely, and compliance.

Insight

Favorable ethical and business outcomes are achieved by adopting the standard best practices in secure client communication as established by financial and health portals to manage risk and meet compliance.

Are you using the best practices to protect your clients and yourself? Whether you are in Estate Planning, Criminal Law, Tax Law, Family Law, in Litigation or in Transnational Law, the State Bar Rules apply to all areas of practice. So what are you doing to protect your clients’ information? The RULE is that you had better be doing something to protect client confidentiality or face potential repercussions. That Rule has become more of a mandate as a result of Covid-19 Pandemic lock down physical distancing and transition to digital remote communication.

ETHICAL OBLIGATIONS FOR LAWYERS WORKING REMOTELY

All 50 States have long established ethical Rules prohibiting lawyers from revealing unauthorized client confidential information. ABA Rule 1.6 summarizes, “A lawyer shall make reasonable efforts to prevent the disclosure of, or unauthorized access to, information relating to the representation of a client …”. See Bar Rules-Florida Rule 4-1.6.e, See also Comments to Rule; Texas Rule 1.5; California 1.6, Cal. State Bar Formal Opn. No. 2010-179.

PENNSYLVANIA BAR ASSOCIATION COMMITTEE ON LEGAL ETHICS AND PROFESSIONAL RESPONSIBILITY April 10, 2020 FORMAL OPINION 2020-300 ETHICAL OBLIGATIONS FOR LAWYERS WORKING REMOTELY

… “ In many cases, attorneys and their staff were not prepared to work remotely from a home office, and numerous questions arose concerning their ethical obligations. Most questions related to the use of technology, including email, cell phones, text messages, remote access, cloud computing, video chatting and teleconferencing. This Committee is therefore providing this guidance to the Bar about their and their staff’s obligations not only during this crisis but also as a means to assure that attorneys prepare for other situations when they need to perform law firm- and client-related activities from home and other remote locations. Attorneys and staff working remotely must consider the security and confidentiality of their client data, including the need to protect computer systems and physical files, and to ensure that telephone and other conversations and communications remain privileged.- Full text

The key take away of the Opinion is-Attorneys and staff working remotely must consider the security and confidentiality of their client data.

The Opinion also affirms: “A lawyer generally may transmit information relating to the representation of a client over the [I]nternet without violating the Model Rules of Professional Conduct where the lawyer has undertaken reasonable efforts to prevent inadvertent or unauthorized access. However, a lawyer may be required to take special security precautions to protect against the inadvertent or unauthorized disclosure of client information when required by an agreement with the client or by law, or when the nature of the information requires a higher degree of security.”

This affirmation, with little variation, is substantively the State Bar Rule in virtually every State.

state bar & ABA COMPLIANCE-“reasonable efforts”

What are “reasonable efforts” to prevent disclosure of client info? The ABA sites several factors such as, the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use). See Bar Rules-Washington RPC 1.6, North Carolina Rules 1.1,1.5; Massachusetts Rule 1.6; Oregon Rule 1.6; Pennsylvania Rule 1.6.

The challenge that every attorney has is in the integration of ethical obligations with ever changing technology tools and applications. Uniformly, State Bar Rules and Opinions hone in on the term “reasonable efforts”. Reasonable efforts is generally defined as, “ the good faith efforts that a reasonably prudent Person desirous of achieving a result would use in similar circumstances to ensure that such result is achieved as reasonably expeditiously and effectively as possible.” To drill down just a little deeper, “efforts” means, “a vigorous or determined attempt”. That’s clearly more than sitting behind a desk and clicking on your email account while rationalizing that you’re in compliance. Let’s put this another way. Do you want to be the test case for malpractice when your clients information somehow “inadvertently” or “innocently” falls into someone else’s possession?

Consequences for failure to use reasonable efforts include State Bar disciplinary action or suspension, possibly even disbarment in extreme cases. More practical consequences, to say the least, would be irreparable damage to your reputation, an incredible source of embarrassment with your client, an adverse impact on the client, termination by client, and oh yes, that State Bar Complaint. The potential for liability is high when simply maintaining status quo. New and developing processes require review, analysis and implementation to satisfy the standard. Due diligence and best practices require action to at least investigate effective alternatives.

To be clear, the language of the Rules has not significantly changed over the years. However, the application of the Rule is changing frequently given our ever changing technology tools and applications as well as available and emerging resources. Add to that the new circumstances and resulting new considerations for remote or online legal work due to the pandemic, constant vigilance is become a requirement to meet the compliance standards. Compliance is a matter of risk management.

minimum standard or the Best practice?

So what is the right thing to do? Is it undertaking a minimal effort and hope you can argue your way out of it if things go awry? Clients now have a much higher awareness of best practices in secure client communication and expectations of online portals from their financial and health service providers. That awareness has migrated to the legal profession. If a client is asked about your current client communication processes would they agree that you’re adopting and utilizing the most current and best practices at protecting their information? Will that set you apart from other Attorneys? The answer is emphatically, “yes”! The differentiator will be whether you are set apart in a negative or positive way.

Human perceptions often allow us to interpret rules and regulations in whatever way suits us best. Rules and Regulations require action. However, by their nature Rules and Regulations are actually the lowest standard one must meet in order to be in compliance. That’s really a pretty low bar (no pun intended).

So what is your work ethic? Do you do the minimum to get by? Or do you do your level best to excel at whatever you do in your profession?

The right thing to do is to put your client’s interest first. Investigating, identifying and utilizing technology tools and resources available to protect your client’s information will help accomplish that objective. Taking time and effort to do what is right will set you far above the masses who will perform less just to meet compliance (minimum standards).

What are the best practices today?

“Today” is a relative term. Today, we are faced with an unprecedented world event-A global pandemic in the corona virus. With the resulting requirements of business shut downs, physical distancing and remote workplace, the legal profession, as well as many other industries, must innovate and adapt to new procedures or risk closing their doors permanently. Use of technology tools such as Zoom, Skype, and the tried and true telephone have become essential tools. Like Pavlov’s dog, we also default to the use of email in our communications because that is what we are used to do. But is it safe for privileged attorney-client communication?

Fact-email is not secure. Do you do your online banking via email? Does your Doctor send you your patient files or test results via email?

Steps to make email more secure are onerous at best (encryption, etc). It is possible to make email more secure. However, the cost is less efficiency and more burdensome to your client.

A more effective and efficient alternative is a secure client portal. In a nutshell, a secure client communication portal is software that allows you and your staff to interact with your clients, share files, discuss, chat, plan, organize and manage tasks and events in an exclusive secure private online environment. Use of a secure client portal makes your firm more mobile, more organized and efficient, more unified, and more secure. Clients uniformly adopt and appreciate the use of portals (e.g., online banking, healthcare portals).

More importantly, use of a portal demonstrates that you have undertaken and made reasonable efforts to protect your clients information. Consequently, that firm will not only achieve compliance pursuant to State Bar Rules, but other developing privacy requirements generally (See GDPR and CCPA). There is no doubt that stricter compliance with privacy protection laws and regulations is on the horizon. Failure to take appropriate and protective measures is like playing Russian roulette. It’s only a matter of time. You don’t want to be that family law attorney that sends her client a sensitive email without properly advising her client of it’s sensitivity, and then the estranged spouse sneaks access to your client’s email. Or that Business Law or Patent Attorney that sends his client an email to the client’s work email. The employer has direct access to that email and the confidential information it contains. Why take the risk when there are better, safer, more efficient methods of secure client communication.

Secure communication portal

Choosing the right platform is important. Factors such as cost, complexity, feature set, and ease of access and use as well as ease of adoption or transition are crucial considerations in choosing the right online platform.

Also of critical importance is the Privacy Policy of any contemplated platform. The Privacy Policy should clearly state that information is not used or accessed by any third party (except when compelled by law of course).

Given the circumstances of today with the lock downs and remote work, a secure communication portal unifies remote work from several locations into one real time hub or portal. The Portal is your virtual office.

Document management is also an important feature to consider. Having the availability to upload and share documents allows for unified collaboration as well. A secure communication portal can dramatically increase law practice efficiency and client engement while protecting your client’s information.

With a little due diligence and some forward thinking a law firm can achieve full compliance with protecting client information while increasing law firm efficiency and case management.

Insight #4

We hope that you found this article valuable. If you think this might be of interest to you or others in legal profession, we encourage you to consider PrivyCounsel for your needs. Share and subscribe below to be notified of new insight articles as we post them.

As always, Contact us with any questions or for help in improving your law practice.

INSIGHTS TO improve your LAW PRACTICE:

I Just Took The Bar Exam. Now What?

Worst and Best Practices of Attorney Client Notification - email/voice auto reply

Law Practice Portal New Features & Enhancements - April 2020

Stabilize - Reset Your Law Practice COVID-19

What Matters Most Today COVID-19

Law Offices are Adapting to Physical Distancing COVID-19

Complimentary Collaboration Portal: Attorney-Client Case Management COVID-19

Working from Home - Remote Best Practices for Solo Attorneys COVID-19

Insight #3 Efforts to Improve the Bar Exam for Law Students

Insight #2 Measuring the Health of a Law Firm

Insight #1 Imagine The Next Chapter. What’s your end game?

Additional Resources: ABA Formal Opinion 11-459; Pennsylvania Formal Opinion 2011-200; Texas Ethics Opinion 648 (2015); Risks of not meeting or exceeding State bare rule. Definitions - legal ethics Compliance; Sources and Back-link ; New-Rules-of-Professional-Conduct-2018 PDF ; (http://www.calbar.ca.gov/Attorneys/Conduct-Discipline/Ethics/Ethics-Technology-Resources)

Joseph FoleyMay 18, 2020Doing Good, LLC PrivyCounsel.comComment