Web-based Management of Client Records
Adopted: July 18, 2008
Opinion rules that client files may be stored on a website accessible by clients via the internet provided the confidentiality of all client information on the website is protected.
Inquiry #1:
Rather than provide clients with hard copies of real estate closing documents, a lawyer would like to upload the files to a secure website and then email a link to his clients with a password so that they can download their files and print them if desired. The lawyer would offer his clients the option of receiving a hard copy of the closing documents rather than access to the website.
Does such a practice comply with the lawyer's responsibilities under the Rules of Professional Conduct?
Opinion #1:
Rule 1.16(d) provides that a lawyer must surrender papers and property to which the client is entitled upon the termination of the representation. Comment [10] to the rule adds that the client it entitled to anything in the file that would be helpful to successor counsel. However, the file documents do not have to be turned over in a paper format. RPC 234 allows lawyers to store client files in an electronic format. With the client's consent, the client's file may be turned over to the client in the form of a computer disk or by emailing a link to the client with a password so that the client can download the files from a website.
If the law firm chooses to use a system that allows clients to access and download their own files at the end of the representation, the confidentiality and security of each client's file must be protected. See Rules 1.6 and 1.15. Therefore, the law firm must enact appropriate measures to ensure that each client only has access to his or her own file. In addition, the law firm must ensure that third parties cannot gain access any client file.
Inquiry #2:
A patent lawyer would like to use a web-based management system that allows both the law firm and corporate clients access to a web-based docketing system. A large part of the lawyer's patent practice is the maintenance of patent dockets. The law firm currently has a docketing system that could be made available to clients via online access. However, the information for all patent clients of the firm is available on the system.
May the patent lawyer protect the confidential information of other clients by contractually obligating the in-house lawyer for a corporate client to view only information specific to his employer? Would the use of a web-based management system be acceptable if the law firm installed a security code access system that allows access only to the specific client's docket information?
Opinion #2:
The use of a web-based management system that allows both the law firm and the client access to the client's docketing information or other information in the client's file is permissible provided the lawyer can fulfill his obligation to protect the confidential information of all clients. A lawyer must take steps to minimize the risk that confidential client information will be disclosed to other clients or to third parties. See RPC 133 and RPC 215. It is not acceptable for one client to have access to another client's information absent client consent. This risk is not cured by an agreement from a client or a client's in-house counsel not to view the confidential information of another client. A security code access procedure that only allows a client to access its own confidential information would be an appropriate measure to protect confidential client information.
If the law firm will be contracting with a third party to maintain the web-based management system, the law firm must ensure that the third party also employs measures which effectively minimize the risk that confidential information might be lost or disclosed. See RPC 133.