Category: Confidentiality

  • Death, Succession Planning & the Virtual Law Office

    Death.  The issue recently crept up in a presentation I gave about virtual law practice.  Then, the question that most of us like to avoid came up again on a personal level when in December I needed open surgery myself and in preparation started questioning what would happen to my virtual law office if I weren’t around to handle things. 

    What happens to a completely virtual law office upon the death of a solo, virtual practitioner? 

    All lawyers are aware that they need to have some form of succession planning in place.  In fact, some would argue that it is unethical practice not to have a plan in place that protects your clients and their property that is entrusted into your care.  

    ABA Formal Opinion 92-369 provides that “[t]he sole practitioner should have a [succession] plan in place.” For solo practitioners this issue is even more critical because there may not be anyone else involved in the day to day practice that would know how to notify clients of the death of their lawyer or even how to access the client’s files in order to return their property.  For a virtual law office that is completely web-based, the other issue is that the law office data is hosted in the cloud.  Without some plan in place, how does the SaaS provider know how to proceed?

    A sample scenario: An attorney who operates a completely web-based virtual law office dies unexpectedly without a plan in place.  The SaaS provider sends the attorney’s invoice for the service each month as usual and then follows up with late notices when it does not receive any payment or response from the attorney.  The attorney’s clients are still able to access their secure homepages on the virtual law office, but are not receiving any online responses from the attorney.  (more…)

  • CA Ethics Opinion: Duty of Confidentiality & Use of Wireless

    The California State Bar has published its newest ethics opinion, FEO 2010-179, related to the use of technology in law practice, specifically addressing the attorney’s duty of confidentiality to clients when using technology that may be accessed by a third-party.  Given the wording of the opinion, this could include everything from an attorney using wireless to connect to the Internet to any cloud computing application used to store or transmit law office data. 

    The specific scenario that the opinion poses will be familiar to those of us engaging in virtual law practice and who deliver legal services online:  The attorney takes his or her firm-provided laptop to a cafe and accesses the public wireless to transmit information to the client and to conduct legal research on a case. The attorney in the scenario also takes his or her work laptop home and conducts work using a personal home wireless connections.  What does the attorney have to do to ensure that he or she is upholding the duty of confidentiality and competence to the client? 

    The opinion was published in December 2010 after an extended period of review and specifically phrases the issue as:

    Does an attorney violate the duties of confidentiality and competence he or she owes to a client by using technology to transmit or store confidential client information when the technology may be susceptible to unauthorized access by third parties?

    (more…)

  • Legal Cloud Computing Association Forms, Responds to ABA 20/20 Ethics Commission

    I’m excited to announce the formation of the Legal Cloud Computing Association (LCCA).  See the formal press release below my comments. 

    About two years ago when I was owner of VLOTech, Larry Port of Rocket Matter reached out to me, Jack Newton (Clio) and Richard Granat (DirectLaw) about forming a group to address the concerns that legal professionals had surrounding cloud computing.  At the time, we were noticing the many questions about cloud computing and security that would pop up on different practice management listservs.  We were concerned with the fact that so many attorneys didn’t seem to know much about cloud computing basics or where to go to get the answers.  The group loosely communicated back and forth on a Google group and over the phone about the best ways to educate the legal profession about the risks and benefits, but did not take any action until this fall when the ABA 20/20 Ethics Commission published its issues paper related to cloud computing.  

    I think it’s remarkable that these competing companies were able to organize an association and collaborate to draft a comment to submit to the Ethics Commission in response to the issues papers.   Since VLOTech was acquired by Total Attorneys last fall, David Dahl, the CTO of Total Attorneys, has taken over my role in the LCCA.  However, I was able to join in where I could and offered suggestions as a practicing attorney who uses cloud computing on a daily basis.  I expect that other cloud computing providers will get involved in the group as well adding to its knowledge base and expanding its ability to provide educational content to the profession.   I look forward to the LCCA continuing to take a role in helping to provide balanced technology education to the profession. 

    Below is the formal press release which links to the comment they submitted to the ABA 20/20 Ethics Commission addressing the following points:  1)  Desired form of the Committee’s Recommendations, 2) Minimal Set of Technology Standards for Cloud Computing Providers, 3) Model Terms of Service for Cloud Computing Providers, 4) Is Cloud Computing Outsourcing?, and 5) Cloud Computing Security vis-à-vis E-mail Security. 

    Legal Cloud Computing Association Press Release

  • Update: Alabama Ethics Opinion Permits Use of Cloud Computing For Client Data

    Alabama State Bar Ethics Opinion 2010-02, “Retention, Storage, Ownership, Production and Destruction of Client Files”

    This opinion addresses the following issues: 1) file retention policies; 2) how long a file should be retained; 3) what constitutes a client’s file; 4) what parts of the file can be destroyed; 5) the ethical considerations related to electronic data; 6) in what format and how the client’s file should be delivered; and 7) if the client can be charged for the cost associated with copying the file.

    Specifically addressing the use of cloud computing in practice management, the Ethics Opinion uses the “reasonable care” standard and covers the benefits as well as the potential risk.  The opinion refers to the Nevada State Bar Formal Opinion No. 33 and Arizona State Bar Opinion 09‐04 approving of third-party storage of law office data.    

    From the opinion: (more…)

  • Adapt or Get out of the Way: Standards to Protect Client Property/Confidentiality Change

    Last week during a guest lecture on virtual law practice at the University of Dayton School of Law, the subject of protecting client property and confidentiality of client data in electronic communications came up again.   My prediction (perhaps overly optimistic) is that in the next few years the state bars will recognize that unencrypted email communication between attorney and client is not the highest standard.  The state bars will look at the newer data privacy laws in Nevada and Massachusetts and  reconsider why attorneys should be using unencrypted email in our profession while other business professionals are required to encrypt personal client data. 

    The standard that the ABA Model Rules of Professional Conduct and most state bars take is encapsulated in Rule 1.6 (a) of the ABA’s Model Rules of Professional Conduct.  This rule states “[a] lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation.…”  Specifically comment 17 to this rule provides that lawyers must take “reasonable precautions” to safeguard confidential information and prevent it from going to unintended recipients during the transmission.   The ABA Formal Opinion No. 99-413 added in March 10, 1999 specifically allows for the use of unencrypted email. 

    “Reasonable precautions.”  What qualifies as “reasonable” should change as technology to communicate with our clients and other professionals develops and security risks in those electronic methods are exposed.  (more…)

  • Review of PA Ethics Opinion on Virtual Law Offices

    Entitled “Ethical Obligations on Maintaining a Virtual Office for the Practice of Law in Pennsylvania”, the PA Bar Association Committee on Legal Ethics and Professional Responsibility published its FEO 2010-200 this month.  The opinion is in stark contrast to the out-dated thinking in the ethics opinion discussing virtual law offices published this past spring by its neighboring state of New Jersey.

    FEO 2010-200 defines virtual law office (VLO) as

    “a law office that exists without a traditional physical counterpart, in which attorneys primarily or exclusively access client and other information online, and where most client communications are conducted electronically, e.g., by email, etc.”  

    The opinion recognizes that there are different forms of virtual law practice and specifically states that it is not addressing issues related to “client portals” or cloud computing because both traditional and virtual offices may use these. 

    There are several questions that the 14 page opinion addresses including the following: 1) whether an attorney may operate a VLO in the state, 2) using a VLO to work from home or or in locations outside PA, 3) listing a physical address in ads for the VLO or letterhead, 4) using a PO box as the address, 5) if a geographic location must be given to the client letting them know where the attorney will handle the services or meet with them, 6) for a multiple attorney firm, if it is necessary to disclose all of the cities and states from which those attorneys are performing their services, 7) if the firm or attorney with a VLO can claim that fees are lower than a traditional law office, 8 ) compliance with the duty of confidentiality, 9) if the attorney does not meet face to face with clients, if there are other steps required to confirm client identity and handle issues such as diminished capacity.   In clear format, the opinion then lists the direct answers to each of these issues before jumping into its analysis of the PA rules of professional conduct as applied to VLOs. (more…)

  • New ABA Ethics Opinion on Websites

    The ABA has published a short description of its efforts to examine the impact of technology, including cloud computing & SaaS, social media and websites, and has released a new ethics opinion related to attorney websites.  

    Last week I wrote a post about the Commission’s call for comments related to cloud computing and protecting client confidences.  On October 14th, they will hold a public hearing to gather information from interested individuals and entities on the subject.  

    The ABA’s review of technology in law practice management is being conducted through the ABA Commission on Ethics 20/20 created in 2009 by then ABA President Carolyn Lamm.  One goal of the commission is to review the ABA Model Rules of Professional Conduct to see if revisions are needed given the changes that technology has brought to the practice of law.  Part of this review also involves an examination of the regulation of attorneys in our country and how the current system may or may not be working well given the increase in globalization of law firms, outsourcing trends and the use of technology to facilitate these practices.   

    More recently, the ABA has released a new ethics opinion pertaining to attorney websites.  The opinion was issued on August 5 of this year, but has only now been posted online.  Formal Opinion 10-457 covers the use of a website by an attorney as a way to communicate with prospective clients.  (more…)

  • Call for Comments – ABA Ethics 20/20 Commission Reviews Cloud Computing and Client Confidentiality

    This afternoon the ABA Commission on Ethics 20/20 sent an email through the listserv announcing a public hearing in mid-October in Chicago.  The Commission is looking for comments on two topics: 1) “Client Confidentiality and Lawyers’ Use of Technology” and 2)  “Lawyers’ Use of Internet Based Client Development Tools.”  I’ve uploaded the first of these issues papers which you can review here: 


    ABA Ethics Commission 20/20: For Comment: Issues Paper Concerning Client Confidentiality and Lawyers’ Use of Technology

    Most of the issues discussed in this paper have some impact on virtual law practice.  One of the Commission’s suggested options for action is to “propose amendments to the Model Rules of Professional Conduct, such as Model Rules 1.1 (competency), 1.6 (duty of confidentiality), 1.15 (safeguarding client property), or the comments to those Rules.”  

    Therefore, it’s important that those of us interested in the delivery of legal service online take the time to read this paper, and if there is a perspective that is missing, to submit a comment before the deadline of December 15, 2010.   I contributed Chapter Three of my book and may submit a comment as well after I’ve had time to review and digest the two issues papers again.

  • Ethics Considerations: Guest Post on Mass. LOMAP Blog

    The final guest post in my three-part series for the Massachusett’s Law Office Management Assistance Program (LOMAP) has posted on the blog.  This final post covers ethics considerations in virtual law practice including both the attorney’s responsibility to thoroughly research their software provider as well as best practices for the ethical management of a virtual law office.  

    Below is the introduction to the post.  Many thanks to Jared Correia for the opportunity to share my research and writing with the readers of the LOMAP blog.

    From the guest post:

    The delivery of legal services online carries with it a number of ethical concerns; however, these ethical concerns are not all that unlike those that have traditionally been addressed by offline law firms. The online lawyer is able to mitigate risks associated with virtual law practice just as a traditionally-practicing attorney would with an offline practice when, for example, installing and using software for law practice management. There are two separate categories of ethics matters to address in connection with the virtual practice of law. The first pertains to the attorney’s duty in selecting the service provider that will be setting up, hosting and maintaining the virtual law practice. With any cloud computing service, there are precautions that must be observed in researching and choosing a software provider. The second category of potential ethics concerns relates to the attorney’s daily operation of the virtual law office; and, the focus there is on ways to mitigate potential malpractice risks when working with clients online. Further issues related to each category are discussed in greater detail below; and, in addition, suggestions are made and additional resources are pointed to, for further guidance.

    You can read the rest of the guest post on the LOMAP blog.

  • Does the Internet Make You Feel Risky?

    Oh, yet another excuse to not take responsibility for individual action and blame it on the technology instead.  *sigh* 

    Seriously, this article just annoyed me to no end.  The National Law Journal published an article entitled “Lawyers’ Ethical Stumbles Increase Online” and then proceeded to give the most outrageous example of an incredibly irresponsible attorney using email to share pictures of a deceased individual from a case along with lewd commentary of his own in the email. 

    First of all, this guy is not using social media; he’s using email.  Email use in the law office at all for any communication regarding a case is not secure because it’s typically not encrypted.  Second, given the immaturity of the action, this is probably the same type of individual who goes out to the bar on the weekend with his buddies and discloses confidential information from cases with them while having a few beers.  I don’t think it’s anything related to a new “method” of communicating that caused this breach, just a question of education on the part of the attorney.  The article then goes on to give several other outrageous examples of attorneys misusing everything from email, to Twitter to blogging in isolated incidents.

    Don’t get me wrong. I think it is great that there are so many organizations out there concerned with the use of social media by attorneys.  Surprisingly, there are many attorneys out there that do need guidance on how to use something as simple as email or Twitter to communicate — or refrain from communicating — as the case may be.  I know that the ease of which we chat online through different Internet-based technologies makes it seem like the risk is higher.  But I would disagree and say that it depends on the individual and their knowledge and use of the technology. 

    For me, I’m way better off communicating by writing.  I can edit, re-edit, delete, be absolutely sure what I am saying or sending before it goes out.  Get me on the phone, put me on the spot in front of a group of people and it’s a completely different situation. My tongue ties, I end up saying more than I should or am too shy to speak when I need to, and usually regret my speech or omissions later.   This preference  just depends on your personality and skills.  Not everyone communicates the same way.  

    However, we all learn ways to cope with other methods.  As I practice public speaking more I’m learning to think longer before I speak or to ask if the audience understands me clearly before jumping onto another topic.  Similarly, attorneys who are new to social media and perhaps not as educated about technology and security issues need basic guidance for the best ways to use those methods and they need to practice them – not jump from using a fax machine and phone into marketing their firm on Facebook and Twitter. 

    Just because everyone is using social media doesn’t mean that all attorneys should use it unless they know how to draw the necessary lines that it requires.  That’s one of the downsides to being an attorney – no matter where we go or what we do, we are legal professionals and can’t escape that by going online.  It’s a huge responsibility, almost a burden sometimes when you just want to hop on Facebook and chat with your college buddies about things that you would prefer your clients and colleagues didn’t know about.  But as professionals in this new media, I think we have to be careful about those lines that we draw and remember that even when we are not working on our clients’ case, they are still our clients and we carry that burden of protecting their information. 

    But adding ethics rules restricting the use of social media is not the answer because many of us do use these methods to communicate effectively and efficiently with our clients and other attorneys and we do respect the technology and use it responsibly.  The few bad seeds should not ruin this for the rest of us.  Remember, the methods that we attorneys find to cut costs and more efficiently work with our clients trickles down to the clients in reduced legal fees and more accessible legal services. 

    Legal ethics expert Michael Downey said lawyers’ tendency to be risk-averse seems to fade away on the internet. “They’re disclosing confidences, talking about pending matters, they take potshots … like everyone else,” said Downey, immediate past chairman of the American Bar Association’s Ethics and Technology Committee and a member of the ABA Center for Professional Responsibility.

    Social media must be like a shiny new toy for some attorneys that they are eager to try out and show off.  Maybe that is what makes their actions online seem more “risky.”  Maybe it’s because some of these communication methods so closely connect our personal lives and personalities with our professional that some attorneys have trouble holding their tongues.  I’m not sure, but even Mr.  Downey, cited above, “suspects the current rules ‘are probably adequate.'”  

    My personal opinion is that this is yet another learning phase for our profession that we are smack in the middle of.  The high-profile examples of stupidity cited in this article are the lessons learned by others. These stories will teach other attorneys who are not using the technology responsibly about the risks. 

    For those attorneys who prefer to educate themselves about technology, security and social media BEFORE jumping in (& I highly suspect this is still the MAJORITY of our risk-averse profession), the ABA LPM and state bar associations can provide that education and guidance.  Rules and regulations that will stay in place for years and cover all of us  should not be written as a reaction to a minority of irresponsible attorneys who fail to educate themselves before acting.   There are already outdated rules on the books that hinder the use of technology to deliver legal services online, for example, the bona fide office rule.  

    There are some great books written by and for attorneys on how to deal with social media that have recently come out.  Niki Black and Carolyn Elefant’s book published by the ABA LPM is one example that comes to mind.  I just wish this article had ended by citing one of those books, recommending a resource for attorneys or at least reminding the reader that while there are these bad seeds out there, there are many other attorneys using the Internet ethically and responsibly to serve the public.

MENU