Disaster preparedness is a hot topic in today's environment. Some natural and some manmade, disasters can range from tornados and tsunamis, to flooding and power failures, to earthquakes and terrorist attacks. The question for lawyers in California is not only how to prepare from a personal safety perspective, but also how to ensure the protection of the clients. While there is no one-size-fits-all answer, there are several ethics rules that come into play in the event of a disaster that affects one's law office. Practitioners are well advised to begin thinking about these issues and putting concrete plans in place.
The recent flooding in Houston illustrates the point. Lawyers in the affected areas reported that they were forced to find alternate facilities and had significant problems trying to reestablish connections with their client and access their electronic data and files. The situation was compounded by the fact that many members of the affected community needed legal services more than ever in the wake of the storms, but the lawyers were often times difficult to reach. In recognition of these challenges, the Houston Bar Association stepped up and provided "Important Harvey Links" on its website, including information for attorneys who wish to assist their colleagues; links for attorneys who wanted to give money; and opportunities for attorneys who wanted to provide pro bono representation to Harvey survivors, among other helpful resources.
It is extremely easy, though, for attorneys who have not been through a life-altering situation like the Houston community to become complacent and neglect to plan ahead. The prudent practitioner, however, not only actively crafts a general disaster response plan, but pays careful and close attention to the effect a disaster may have on the clients and the ethical rules that come into pay. So what are the top tips for protecting clients in these situations? How can California practitioners ensure that they comply with their ethical obligations during these difficult times?
Several rules are particularly applicable. California Rules of Professional Conduct, Rule 3-110 states that an attorney shall not intentionally, recklessly or repeatedly fail to perform legal services with competence. Competence includes the mental, emotional and physical ability reasonably necessary for performance of the services. In addition to competency, an attorney is required to give heavy attention to the duty of confidentiality at all times. This duty is embodied in Business and Professionals Code Section 6068(e), which states that an attorney is required "to maintain inviolate the confidence, and at every peril to himself or herself to preserve the secrets, of his or her client." This is well known to be one of the strongest confidentiality provisions for attorneys in the United States.
On top of this, attorneys have a duty to keep clients informed of significant developments. Rules of Professional Conduct Rule 3-500 requires an attorney to keep a client reasonably informed about significant developments relating to the employment or representation. This is reiterated in Business and Professions Code Section 6068(m), which requires the attorney to respond promptly to reasonable status inquiries of clients and to keep them informed of significant developments in their matters.
Finally, an attorney is required to preserve the identity of funds and the property of a client pursuant to Rules of Professional Conduct Rule 4-100. Specifically, 4-100 requires an attorney to safeguard not only the funds of the client in a trust account, but also identify and label securities and properties of a client and place them in a safe deposit box or other place of safe keeping as soon as practicable.
The aggregate effect of these rules in the disaster context is significant. Even in light of a life-altering disaster, an attorney must act competently, preserve confidentiality, maintain confidentiality, and preserve the client property. This is no small task, but one that is manageable with careful advance planning in place.
The first recommended step is to identify where you will be practicing law in the event that your physical location is impacted by the disaster. This may be your home, the office of a colleague in a non-impacted area, or even a safe place of public accommodation. In the event of a disaster, it is critical to have a secure and workable space in which to review the situation, make attempts to access or recover your electronic data, work with IT professionals, assess deadlines, and notify clients of the circumstances.
The next step in terms of advance planning is ensuring the security and retrievability of your client data. While the ABA Model Rules of Professional Conduct do not generally govern in California, they are helpful to review in determining the appropriate steps to take to secure your data. The ABA amended the Model Rules in 2012 and made certain additions known as the "Technology Amendments," in recognition of the fact that law firms are targets for both hacking and data loss, due to the fact that they obtain and use highly sensitive information. In the disaster context, electronic data may be in serious peril of not only permanent loss, but unauthorized access and compromise.
One of the best known "Technology Amendments" is found in ABA Model Rule 1.6, which requires a lawyer to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. Comment 18 indicates that this section requires a lawyer to act competently to safeguard information relating to the representation of a client against unauthorized access by third parties. In a similar vein, Comment 19 mandates that the lawyer take reasonable precautions to prevent the information from coming into the hands of unintended recipients.
There are also dozens of ethics opinions across the county on the issue of the security of client data. Notably, the State Bar of California issued Formal Opinion 2010-179, asking the question of whether an attorney violates the duties of confidentiality and competence by using technology to transmit or store confidential client information when the technology may be susceptible to unauthorized access by third parties. The opinion concludes that whether an attorney violates his duty depends on a variety of factors, but that an attorney utilizing a particular technology is ethically obligated to evaluate the level of security attendant to the use of that technology and, in particular, assess the possible impact on the client of an inadvertent disclosure of privileged or confidential information work product.
Using these rules and opinions as guidance, attorneys in California should ensure that the protection of the electronic client data extends to situations where a disaster may befall the law firm. Is the data stored in the cloud or off site? Will the data be lost in the event that the law firm is compromised by a disaster? Can it be recovered? Will a disaster compromise the security of the data? In the event of a disaster, what IT professionals specifically can be contacted to discuss the recovery and security of that data?
In addition to these concerns about electronic data, the prudent practitioner also must pay attention to securing hard copy client files and property, per the requirements of 4-100 and best practices. Steps may include ensuring that duplicate electronic copies of paper documents are maintained and storing certain irreplaceable client documents and property -- such as original documents and evidence -- in safety deposit boxes, on-site safes and fireproof filing cabinets. Additionally, a periodic assessment of fire extinguishers, smoke detectors, sprinklers, fire alarms and emergency lighting in areas where these files are maintained is recommended.
Importantly, securing client data is not only best practice, but is increasingly being required by certain sophisticated clients. Law firms are routinely being asked to certify that they have measures in place to protect both electronic and hard copy data and files and verify that they have a disaster readiness plan in place. It can be expected that more and more clients will be making these inquiries as natural and manmade disasters continue to receive high levels of national media exposure.
Finally, and perhaps most importantly, attorneys must be prepared to promptly notify clients in the event of a disaster. This requires having easy and quick access to client lists and contact information and a means of contacting them. In terms of what needs to be communicated, clients should be notified of the circumstances and the potential ramifications of the situation on their case, including the impact on impending deadlines. The lawyer should also be completely candid about his or her short term ability to continue to provide the legal services, especially when the lawyer may be dealing with personal and family matters in the wake of the disaster. With full information in hand, the clients then have the option choosing to seek legal assistance from other attorneys who may not be impacted by the disaster and/or revising their legal strategy in light of the circumstances.
In addition to these advance planning measures, attorneys are advised to assess their insurance situation and the parameters of coverage in the event of certain types of disasters. Consultation with your broker can assist in this process. There are policies that assist in the event of cyber breaches, policies that assist in the event of natural disasters, and policies that assist in the event of damages to files and physical facilities. Delegation of the procurement of insurance to legal assistants or officer managers, without consideration of the necessity of coverage in the event of a disaster, can be perilous and have serious long term consequences.
There are also resources that can help get you started in your planning. As one example, the ABA has a disaster preparedness committee, with various free resources offered to the legal community on its webpage. Many state bar associations also offer helpful materials and tips, as well as opportunities for their attorneys members to assist victims of the disasters. Finally, your legal malpractice insurers may offer resources and planning guides as a benefit under the policy.
There is no perfect solution in the event of a disaster that affects one's law practice. But one thing is certain -- if a disaster hits, it will hit quickly with the high potential for utter chaos. Even minimal advance planning can greatly reduce the likelihood of a situation that will adversely affect your client's legal matters and rights.