Virtual Law Practice

Category: SaaS

  • LSBC Cloud Computing Working Group Recommendations

    Last week The Law Society of British Columbia’s Cloud Computing Working Group published online a report with recommendations regarding the use of cloud computing by legal professionals.

    Recommendations included in the report include:

    1)      Guidelines to help lawyers conduct due diligence in researching a technology providers and cloud-based solution.  (The report refers to “third party service providers” which includes cloud computing but is much broader in scope.)

    2)       Review of potential changes in the Law Society Rules to ensure that its regulatory functions are kept up to date with the changes in technology.  (Canadian legal professionals are subject to audits of law office records by their governing body whereas most state bars in the United States do not have this investigatory function.)

    3)      Methods that lawyers and law students might be educated to improve understanding of their responsibilities when using technology.

    The report advocates that clear guidelines are needed to assist lawyers in making the decision about what type of technology to use and which providers to trust.  Here is a brief overview of what the Report recommends. Even if you are not practicing law in Canada, these are good recommendations to consider as you conduct your “due diligence” in researching any tech-related practice management decision. (more…)

  • Proposed NC Ethics Opinion on Cloud Computing Returned to Subcommittee

    The Ethics Committee at the North Carolina State Bar voted to send the proposed formal ethics opinion 6 (FEO 6), entitled “Subscribing to Software as a Service While Fulfilling the Duties of Confidentiality and Preservation of Client Property” back to the subcommittee to reconsider responses they received to inquiries #1 and #2.

    Both of these inquiries contained worrisome minimum requirements for the use of cloud computing that many of the technology providers and attorneys using cloud computing are not certain can be practically implemented without resulting in severe restrictions on the use of a wide number of cloud-based applications.

    The Ethics Committee received responses from groups such as ILTSO and the LCCA as well as from individual attorneys both licensed in NC and across the country.  You may read the LCCA’s detailed response on their website. Some of the responses from individuals included:

    – Nicole Black, author of the soon-to-be published by the ABA/LPM Cloud Computing for Lawyers, provided this response;

    – Erik Mazzone, Director of the Center for Practice Management at the North Carolina Bar Association, wrote about the opinion on his Law Practice Matters blog;

    – Richard Granat, co-chair of the ABA eLawyering Task Force, wrote critically of the proposed opinion on his elawyering blog; and

    – I posted the comments that I submitted to the Committee on this blog a few months ago.

    We should have some idea by the end of October about the revisions, if any, that will be made to the proposed opinion by the subcommittee.

     

  • Top Ten Basic Security Practices for a Virtual Law Office

    I love SaaS.  I depend on SaaS to operate my virtual law office.  I support an attorney’s right to choose their own practice management tools and make their own business decisions whether it’s in the cloud or in a filing cabinet.  But there are responsibilities that come along with choosing any practice management system and that means sticking to your own security policies and best practices.

    I’m a solo virtual lawyer, so the burden is on me alone.  Larger practices can designate an associate or hire an IT consultant to keep them up to date and to make any necessary security policies and safeguards.  Regardless of where you are engaging in virtual law practice, it’s always good be reminded of some basic security practices for delivering legal services online.  Here is my list of the top ten basic security practices for a virtual law office:

    1) Keep up to date on the security issues. Read Lifehacker, Slashdot, TechCrunch, etc.

    2)  If you use wireless networking, ensure that all wireless traffic is encrypted with WPA2.

    3)  Keep antivirus software and all software patches updated and turn on the software firewall for the computer.

    4) Use a safer browser, such as Mozilla with the NoScript add-on installed.  Or use another pop-up blocker. Do not use free Wi-Fi hotspots when using any cloud computing application remotely.  Use a cellular phone modem adapter instead.  I just got the 4G wireless hotspot which I highly recommend.  This also serves as backup internet access in my home office as well.

    5)  Never write down usernames and passwords.  Create strong passwords and change them regularly.  Use Keepass or other password management tool and generator.

    6) Go straight to privacy/account settings in any cloud-based application immediately after you register for and change the defaults for better protection.  Then check back occasionally to make sure they haven’t changed their privacy setting options again.

    7) Watch your back when you work in a public place to make sure the person behind you isn’t able to watch your screen as you enter your username and password or your client’s social security number.

    8) Encrypt your hard drive with Truecrypt, free open source encryption software.  Easy to use, free, protects you if your laptop is stolen.  Backup daily with an external hard drive with Truecrypt on it in addition to regular cloud-based backups.

    9) Make sure that the applications you are using to store and transmit confidential law office data are encrypted.  Look for HTTPS in the URL before proceeding.  Don’t enter data unless you know it will be encrypted.

    10) This isn’t going to be a popular one, but be wary of doing a lot of confidential work on your iPad with just any app.  With my virtual law office, I can open the browser and work in https, but other apps, especially iPad and other mobile device apps, do not have this level of security.  Unencrypted email is permitted by the state bars as exercising reasonable care, but most of us know better.  Text messaging your client is not a wise idea for a lot of reasons.

     

  • Feedback on SaaS Ethics Opinion

    Below is the text from my letter to the NC Bar Ethics Committee regarding their proposed ethics opinion on the use of Software as a Service (SaaS) in law practice management.  The Committee has received only two comments so far.  This is an important issue that will have a big impact on attorneys in NC and potentially elsewhere if other state bars follow this example.

    If you are an attorney or IT consultant in NC or even outside the state who uses cloud-based applications, please consider providing the committee with your comments and feedback on the way this opinion should be worded. (more…)

  • Should a SaaS Vendor’s Data Center be an Agent of the Virtual Law Firm?

    Below is a short and to-the-point article that I drafted for the NC Bar Association’s Technical Advisory Committee after our last meeting discussing the proposed NC Ethics Opinion on SaaS.  I wasn’t critical of the opinion at first, until I spoke with a few SaaS vendors and others who explained their positions in greater detail to me.

    If you are licensed in NC and operate a virtual law office, you might want to read the below and consider providing your comments and feedback.  More than one legal SaaS vendor has already indicated that if the ethics opinion is published in its current version, that they will simply pull out of serving the NC legal marketplace.

    Harsh consequences for attorneys practicing here, but also potentially harmful for the public who receive assistance delivered online or from attorneys who use the cost benefits of cloud-computing to make their prices for legal services more affordable.

    _____________________________________________

    The North Carolina State Bar published the revised version of its proposed ethics opinion on the use of SaaS in law practice management on April 21st, entitled, “Formal Ethics Opinion 6: Subscribing to Software as a Service While Fulfilling the Duties of Confidentiality and Preservation of Client Property”.

    Your firm will be in violation of this ethics opinion if it is published as written and your firm uses any of the following products:

    Google (any of their applications or services)

    Yahoo/Hotmail or any other email service attached to a internet service provider, such as Earthlink, Bellsouth, Roadrunner, etc

    Verizon, AT&T, Sprint, T-Mobile

    Lexis or Westlaw for online research and almost all of their other services

    Mozy

    DropBox

    Clio

    Total Attorneys

    Rocket Lawyer

    DirectLaw

    Any other practice management system with a cloud-based component

    Or if your firm engages in the following tasks:

    Email

    Voicemail (Per Erik Mazzone, Director for the Center for Practice Management at the NCBA, “Voicemail on a mobile phone is data hosted on servers owned or contracted by the mobile carrier. The software that enables us to call a number and listen to voicemail is SaaS.”)

    Digital phone’s voicemail services as well as original phone services many of which use voicemail accessible via SaaS.

    Text messaging or SMS

    Online backup or storage

    Online communication with other professionals or clients

    There are two requirements in proposed opinion which may result in the restriction of use by law firms of a majority of the technology software and services that they currently rely on. These provisions are:

    1) “An agreement on how confidential client information will be handled in keeping with the lawyer’s professional responsibilities must be included in the SaaS vendor’s Terms of Service or Service Level Agreement, or in a separate agreement that states that the employees at the vendor’s data center are agents of the law firm and have a fiduciary responsibility to protect confidential client information and client property.” [Emphasis added] ; and

    2) “The agreement with the vendor must specify that firm’s data will be hosted only within a specified geographic area. If by agreement the data is hosted outside of the United States, the law firm must determine that the hosting jurisdiction has privacy laws, data security laws, and protections against unlawful search and seizure that are as rigorous as those of the United States and the state of North Carolina.” [Emphasis added]

    Most software vendors will not sign an agreement assuming this level of liability and agency for client property. Most software vendors will also not restrict their server locations, many of which are georedundant to begin with, to hosting data centers located only in locations with laws as strict as the US and the state of North Carolina. The Legal Cloud Computing Association (LCCA), a group of vendors who provide services to lawyers, and the International Legal Technology Standards Organization (ILTSO) are in the process of writing comments to the NC Bar regarding the negative impact that this opinion will have on legal technology innovation as well as the negative impact that it will have on their customers who practice law in the state.

    There are more practical and realistic ways to address the confidentiality concerns raised in the use of software as a services. It is not practical to expect hundreds of NC practitioners to stop using cloud computing. It is not realistic to expect a technology provider or vendor to assume liability for client property. Minimum requirements should not be imposed on legal practitioners. Instead, this opinion should contain suggestions and guidance for performing due diligence in researching and implementing cloud-based solutions to comply with the rules of professional responsibility.

    There are hundreds of attorneys and law firms in North Carolina that rely on software as a service on a daily basis. If you are one of these firms, please consider writing to the NC Ethics Committee.

  • Revised Proposed Ethics Opinion on SaaS

    UPDATE: CHECK OUT THIS POST by Erik Mazzone, Director of the Center of Practice Management at the NC Bar Association, on his Law Practice Matters blog.  Erik is concerned that the proposed opinion will limit the cloud-based vendors that attorneys in NC can use based on the location of their servers.  While most legal SaaS vendors will probably be in compliance by housing the data on servers located in the States, other non-legal SaaS companies, such as Dropbox, Google, etc., may not be in compliance with the proposed opinion because their servers are located overseas.  Will this proposed ethics opinion have a broader reach than expected? Are these other services really safe to be using with law office data in the first place?  See this post by Information Law Group discussing a recent Ponemon Study about cloud providers and security.

    The North Carolina State Bar published the revised version of its proposed ethics opinion on the use of SaaS in law practice management on April 21st, entitled, “Formal Ethics Opinion 6: Subscribing to Software as a Service While Fulfilling the Duties of Confidentiality and Preservation of Client Property”.

    The direction that this opinion takes provides guidance to the practitioner, rather than attempting to write technology standards into an ethics opinion, which is not the safest place for it.  Instead, the opinion requires that the attorney do a thorough job investigating the technology provider and any agreements with that providers to ensure confidentiality of the client data.  They also include a reference the ILTSO standards in the footnotes of the opinion (www.iltso.org) along with links to other resources for attorneys to accomplish this process. (more…)

  • Video from Presentation at UNC Chapel Hill Law School

    Thank you to NC Jolt for inviting me to speak to law students at UNC School of Law in Chapel Hill last week. Special thanks to 3L John Kivus (@kivus) for making the connections. I appreciated the opportunity to share this topic with the next generation of legal professionals.

    Awesome questions from the attendees as well. I especially liked this one (perhaps for a future blog post?):

    What happens if you are representing a party that is suing Google or Amazon and all your law office data, including their client file, is hosted in the cloud on that company’s servers? Conflicts issues? Security issues?

    The question was more eloquently delivered, but you get the idea. Fun and necessary questions to ponder as we move more of our practices to the cloud.

  • Evolution of the VLO 1.0

    When my husband and I sold VLOTech, our legal software as a service solution that created virtual law offices, to Total Attorneys in the fall of 2009 we were anxious to see some of the items on our development list taken to the next level.   Almost a year and a half later, I’m excited to announce that they are releasing VLO 2.0, the next generation of the VLO concept. 

    I’ve been involved at different stages in the process of rebuilding and adding to the software.  A strong focus on the security of the system and attention to the ethics concerns unique to lawyers have been maintained by the developers at Total Attorneys.  It will be exciting to see the reaction from attorneys to the more user-friendly design and workflow. 

    From April to June anyone interested in test driving the beta version of the VLO can sign up with Total Attorneys for a free trial.  After June when the trial period ends those beta users will be offered a discount price if they wish to continue to use the software. 

    More web-based practice management solutions are entering the legal marketplace and more of them are developing client portals and features to facilitate virtual lawyering.  I’m clearly going to be biased in favoring the VLO 2.0 because it is what I’ve used to build my own practice for going on six years, and it is something that I’ve been able to work on closely with others to grow into what I believe is a solid platform for the online delivery of legal services.  I would encourage anyone interested in the development of technology for virtual law practice to take a close look at the VLO 2.0 beta from Total Attorneys and find out about some of the innovative developments that are coming down the pipeline for that software in the near future.

  • Virginia & the Ethics of Cloud Computing in Law Practice

    James M. McCauley, ethics counsel for the Virginia State Bar, has written an article for the February issue of the Virginia Lawyer Magazine, entitled “Cloud Computing — A Silver Lining or Ethical Thunderstorm for Lawyers?”

    Even if you aren’t licensed to practice in Virginia, I would recommend reading this well-balanced article on cloud computing.  

    McCauley summarizes the benefits of the technology for practice management, but spends the majority of the article answering the questions I’m sure he and other ethics counsel hear all the time from attorneys trying to figure out how to implement cloud computing in their practices.  He starts out by stating that “there is no basis in the Virginia Rules of Professional Conduct for an unqualified prohibition of lawyers managing their office software applications and client data using cloud computing.”   And then explains how Rule 1.6(a) gives attorneys an ethical duty to protect our clients’ confidential information.  From there the discussion moves to concerns about security and reliability of cloud computing.  (more…)

  • Outsourcing and the Virtual Law Office

    A virtual law office relies on a third-party provider to operate.  A legal SaaS provider maintains my virtual law office and the data is hosted on a server that is maintained by another third-party company that has leased its servers to my SaaS provider.  

    By using this form of technology to practice law online, am I “outsourcing” as governed by ABA Formal Ethics Opinion 08-451?  Does my use of a third-party technology provider fall under supervision of “non-lawyers” in Model Rule 5.3? 

    *open can of worms*

    The ABA Ethics Commission 20/20 has raised the question of whether cloud computing should be classified as a form of outsourcing.  This can be found in the issues paper entitled “Client Confidentiality and Lawyers’ Use of Technology.”  ABA Formal Ethics Opinion 08-451 describes a lawyer’s obligations when outsourcing work to lawyers and non-lawyers.  One comment to Rule 5.3 states that the duty to supervise non-lawyers extends to those who serve as independent contractors.

    My position:  Selecting a cloud-based technology solution for practice managment is not outsourcing.  It is a business method, a form of delivery.  Rules 1.6 (duty of confidentiality) and 1.15 (safe-guarding client property) require that attorneys use reasonable care in protecting the confidentiality of their client’s property.  To comply, attorneys must do their due diligence in researching and selecting their SaaS provider and any other third-party services.  This requirement provides adequate regulation for the use of a cloud-based technology in law practice management. State bars may provide their members with guidelines and education about how to handle the selection of technology providers or larger firms may decide to hire IT consultants to help them with these decisions.  (more…)

MENU