CABAR 2012

May a California lawyer run a virtual law office where all client communication and storage are handled through a third-party cloud vendor's portal, and what does she have to do to comply with her ethical obligations?

Short answer: Per California Formal Opinion 2012-184, the Rules of Professional Conduct do not impose greater duties on a VLO than on a traditional office, but the cloud-only structure triggers specific due-diligence steps on vendor selection, client identity and comprehension, and supervision.

Disclaimer: Advisory only. Not binding precedent.

About this page: The plain-English summary, reader guidance, and Q&A below were written by Ezel based on the official ethics opinion. The original opinion (linked at the bottom of this page, or PDF in the sidebar) is the authoritative source for any reliance.

View original ethics opinion (PDF)

State Bar of California COPRAC Formal Opinion 2012-184: Virtual Law Office in the Cloud

Short answer: The opinion concludes that the Business and Professions Code and the Rules of Professional Conduct do not impose greater or different duties on a virtual law office practitioner operating in the cloud than on a traditional office, but a VLO practitioner may be required to take additional steps to confirm compliance with confidentiality, competence, communication, and supervision duties given the issues distinct to cloud-only practice.

Disclaimer: This is an advisory ethics opinion. Advisory opinions are not binding; they interpret the State Bar of California's rules of professional conduct and are persuasive authority. This summary is for research purposes only and is not legal advice. Verify current rules before acting on any specific guidance.

About this page: The plain-English summary and Q&A below were written by Ezel based on the official opinion. The opinion text is reproduced at the bottom; the official source (linked) controls.

View original opinion

Plain-English summary

The opinion analyzes whether Attorney, a California solo practitioner, may operate a virtual law office in which all client intake, communications, and document storage occur solely on a password-protected, encrypted internet portal hosted by a third-party vendor, with no telephone or in-person contact. The committee concludes the VLO structure is permissible, but the cloud-only nature triggers additional duties.

On confidentiality (under former Rule 3-100 and Business and Professions Code section 6068(e)(1)), the committee, building on California State Bar Formal Opinion 2010-179 and ABA Formal Opinion 08-451, holds that Attorney must exercise reasonable due diligence both in selecting and in continuing to use the VLO vendor. The factors to weigh include vendor credentials, data security, jurisdictional movement and possible subcontracting of data, supervision capacity, and the terms of the vendor contract. Attorney need not be a technology expert but must have a basic understanding of the technology or consult someone who does. Attorney should also consider whether the structure requires client disclosure and consent.

On competence and communication (under former Rules 3-110 and 3-500), the committee identifies six specific points. (1) Intake must establish that the prospective client is in fact the actual prospective client (or an authorized representative), addressing the absence of face-to-face or phone contact. (2) Intake must include enough information for Attorney to decide whether the matter is one Attorney can handle competently through a cloud-only VLO at all. (3) On any matter requiring client understanding, Attorney must take reasonable steps to confirm the client comprehends the legal concepts and advice, particularly without non-verbal or verbal cues. (4) Attorney must keep the client reasonably informed of significant developments and ensure the client actually receives portal-posted information in a timely manner. (5) Attorney must have a reasonable basis to believe the client has sufficient technological access and ability. (6) If competence cannot be maintained, Attorney must decline or withdraw under former Rules 3-110 and 3-700, with the option of narrowing the scope of representation per ABA Formal Opinion 11-458 when permitted.

The committee finally addresses supervision (former Rule 3-110 Discussion), noting that even with physically separated personnel, Attorney must take reasonable measures to ensure every subordinate complies with the rules.

The opinion expressly does not address unauthorized practice issues raised by VLO accessibility across jurisdictions.

In practice

Under California's rules as they stood at the time of the opinion, the operational checklist runs in three layers. First, vendor due diligence: assess credentials, data security including encryption and transmission across jurisdictional boundaries and potential subcontractors, supervision ability, and contractual terms; reassess periodically. Second, client-facing process: identity verification at intake, matter-by-matter analysis of whether the matter can be handled competently in a cloud-only VLO, communication-comprehension confirmation, and a reasonable basis to believe the client can use the portal. Third, internal supervision and termination logistics: subordinate-supervision practices and contract-side preparation for releasing client electronic property under former Rule 3-700(D) and California State Bar Formal Opinion 2007-174 (metadata stripping). The committee does not opine on unauthorized practice. Verify against current Rules 1.1, 1.6, and 5.3 before relying on this framework.

Common questions

Q: Can a California lawyer run a cloud-based virtual law office?

A: Per the opinion, yes. The committee holds that a VLO is permissible so long as the lawyer satisfies the same duties of confidentiality, competence, communication, and supervision that govern any practice, with additional steps responsive to the cloud-only setting.

Q: Does the lawyer have to disclose to the client that an outside vendor handles the data?

A: Per the opinion, the lawyer should consider whether her ethical obligations require appropriate disclosures and client consent to the fact that an outside vendor is providing the technological base and will be receiving and storing confidential information.

Q: What does the committee say about vendor data crossing borders?

A: Per the opinion, data in the cloud may travel across jurisdictional boundaries, including internationally, as a matter of course, and may be stored on servers outside the United States or subcontracted to other vendors. The lawyer should address and minimize this exposure when contracting.

Q: Does the opinion require the lawyer to become a technology expert?

A: Per the opinion, no. The committee, citing California State Bar Formal Opinion 2010-179, says the lawyer must have a basic understanding of the protections afforded by the technology she uses and, if she lacks the necessary competence, seek additional information or consult an information technology consultant.

Q: Can every type of matter be handled in a cloud-only VLO?

A: Per the opinion, no. The committee says some practices may be amenable to this VLO and others likely are not, and lawyers should make a matter-by-matter analysis. The committee gives the example that simple will drafting or tax advice may be possible while litigation defense likely is not.

Q: What happens when representation ends and the client wants the file?

A: Per the opinion, the lawyer must release to the client the electronic versions of all papers and property in question at the lawyer's expense, after stripping each document of metadata containing confidential information belonging to other clients, citing former Rule 3-700(D) and California State Bar Formal Opinion 2007-174.

Background and rules framework

The opinion interprets former Rules 1-100, 1-300, 1-310, 3-100, 3-110, 3-310, 3-400, 3-500, 3-700, and 4-200, together with Business and Professions Code section 6068(e), (m), and (n) and sections 6125-6127, 6147, and 6148. It builds directly on California State Bar Formal Opinion 2010-179 on technology, confidentiality, and competence, and on California State Bar Formal Opinion 2007-174 on electronic client files. The current California analogues are Rules 1.1, 1.4, 1.6, 1.16, 5.3, and 8.4.

Citations and references

Rules of Professional Conduct (former, in effect at time of opinion):

Former California Rules 1-100, 1-300, 1-310, 3-100, 3-110, 3-310, 3-400, 3-500, 3-700, and 4-200

ABA Model Rules and opinions (referenced for guidance):

ABA Formal Opinion 08-451 (outsourcing)
ABA Formal Opinion 95-398 (third-party providers)
ABA Formal Opinion 11-458 (limited-scope representation)
ABA Model Rules 1.2(c), 5.1

Statutes:

California Business and Professions Code section 6068(e), (m), (n)
California Business and Professions Code sections 6125, 6126, 6127, 6147, 6148

Cases:

Calvert v. State Bar (1991) 54 Cal.3d 765, communication and competence
Butler v. State Bar (1986) 42 Cal.3d 323
Birbrower, Montalbano, Condon & Frank v. Superior Ct. (1998) 17 Cal.4th 119
Nichols v. Keller (1993) 15 Cal.App.4th 1672, limited-scope duty
Crane v. State Bar (1981) 30 Cal.3d 117, attorney supervision
Henderson v. Pacific Gas & Electric Co. (2010) 187 Cal.App.4th 215
Farnham v. State Bar (1976) 17 Cal.3d 605
Bluestein v. State Bar (1974) 13 Cal.3d 162

Other opinions cited:

California State Bar Formal Opinion 2010-179 (technology, confidentiality, and competence)
California State Bar Formal Opinion 2007-172 (credit-card payments)
California State Bar Formal Opinion 2007-174 (electronic client files and metadata)
California State Bar Formal Opinion 1971-25 (outside data-processing centers)
California State Bar Formal Opinion 1984-77 (language barrier and comprehension)
Los Angeles County Bar Association Formal Opinion 374 (1978)
New York State Bar Association Opinion 842
Pennsylvania Bar Association Formal Opinions 2010-200 and 2011-200
ABA Section "Suggested Minimum Requirements for Law Firms Delivering Legal Services Online" (2009)

Secondary:

Stephanie L. Kimbro, "Virtual Law Practice" (ABA 2010)
Navetta and Forsheit, "Legal Implications of Cloud Computing" (Information Law Group 2009)

Source

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

THE STATE BAR OF CALIFORNIA
STANDING COMMITTEE ON
PROFESSIONAL RESPONSIBILITY AND CONDUCT
FORMAL OPINION NO. 2012-184

ISSUE: May an attorney maintain a virtual law office practice ("VLO") and still comply with her ethical obligations, if the communications with the client, and storage of and access to all information about the client's matter, are all conducted solely through the internet using the secure computer servers of a third-party vendor (i.e., "cloud computing")?

DIGEST: As it pertains to the use of technology, the Business and Professions Code and the Rules of Professional Conduct do not impose greater or different duties upon a VLO practitioner operating in the cloud than they do upon an attorney practicing in a traditional law office. While an attorney may maintain a VLO in the cloud where communications with the client, and storage of and access to all information about the client's matter, are conducted solely via the internet using a third-party's secure servers, Attorney may be required to take additional steps to confirm that she is fulfilling her ethical obligations due to distinct issues raised by the hypothetical VLO and its operation. Failure of Attorney to comply with all ethical obligations relevant to these issues will preclude the operation of a VLO in the cloud as described herein.

AUTHORITIES INTERPRETED: Rules 1-100, 1-300, 1-310, 3-100, 3-110, 3-310, 3-400, 3-500, 3-700, and 4-200 of the Rules of Professional Conduct of the State Bar of California. Business and Professions Code section 6068, subdivisions (e), (m), and (n). Business and Professions Code sections 6125, 6126, 6127, 6147, and 6148. California Rules of Court, Rules 3.35-3.37 and 5.70-5.71.

STATEMENT OF FACTS

Attorney, a California licensed solo practitioner with a general law practice, wishes to establish a virtual law office (VLO). Attorney's target clients are low and moderate-income individuals who have access to the internet, looking for legal assistance in business transactions, family law, and probate law.

In her VLO, Attorney intends to communicate with her clients through a secure internet portal created on her website, and to both store, and access, all information regarding client matters through that portal. The information on the secure internet portal will be password protected and encrypted. Attorney intends to assign a separate password to each client after that client has registered and signed Attorney's standard engagement letter so that a particular client can access information relating to his or her matter only. Attorney plans not to communicate with her clients by phone, e-mail or in person, but to limit communications solely to the internet portal through a function that allows attorney and client to send communications directly to each other within the internet portal.

Attorney asks whether her contemplated VLO practice would satisfy all applicable ethics rules.

DISCUSSION

As a result of ever increasing innovations in technology, the world has moved significantly toward internet communications. The legal services industry has not been untouched by these innovations and the use of technology, including the internet, is becoming more common, and even necessary, in the provision of legal services. The VLO may take many different forms. For the purposes of this opinion, "VLO" shall refer to the delivery of, and payment for, legal services exclusively, or nearly exclusively, through the law firm's portal on a website, where all of the processing, communication, software utilization, and computing will be internet-based.

The Committee recognizes that although VLOs exist and operate only through the use of relatively new technology, the use of such technology itself is not unique to this VLO. The California Business and Professions Code and the Rules of Professional Conduct do not impose greater or different duties upon a VLO practitioner than they do upon a traditional non-VLO practitioner as it pertains to the use of technology.

Attorney's Duty of Confidentiality in Our Hypothetical VLO Is the Same as That of an Attorney in a Traditional Non-VLO, But Requires Some Specific Due Diligence.

A lawyer has a duty to "maintain inviolate the confidence, and at every peril to himself or herself, preserve the secrets of his or her client." (Bus. & Prof. Code, § 6068(e)(1)). With certain limited exceptions, the client's confidential information may not be revealed absent the informed written consent of the client. (Rule 3-100(A); Cal. State Bar Formal Opn. No. 2010-179.)

In California State Bar Formal Opinion No. 2010-179, this Committee discussed the ethical confidentiality and competency concerns of a practitioner using technology in providing legal services, and the considerations an attorney should take into account when determining what reasonable steps would be necessary to comply with those obligations. While those obligations are the same for attorneys using technology both in a VLO and a traditional non-VLO, due to the wholly outsourced internet-based nature of our hypothetical VLO, special considerations are implicated which require specific due diligence on the part of our VLO practitioner.

Attorney's compliance with her duty of confidentiality requires that she exercise reasonable due diligence both in the selection, and then in the continued use, of the VLO vendor. Attorney should determine that the VLO vendor selected by her employs policies and procedures that at a minimum equal what Attorney herself would do on her own to comply with her duty of confidentiality. Factors to consider when selecting a VLO vendor may include:

A. Credentials of vendor.
B. Data Security.
C. Vendor's Transmission of the Client's Information in the Cloud Across Jurisdictional Boundaries or Other Third-Party Servers.
D. Attorney's Ability to Supervise Vendor.
E. Terms of Service of Contract with Vendor.

Even after Attorney satisfies herself that the security of the technology employed by the VLO provider is adequate to comply with her ethical obligations, Attorney should conduct periodic reassessments of all of these factors to confirm that the VLO vendor's services and systems remain at the level for which she initially contracted.

Finally, Attorney should consider whether her ethical obligations require that she make appropriate disclosures and obtain the client's consent to the fact that an outside vendor is providing the technological base of Attorney's law firm.

The Online-Based Nature of Communication and Delivery of Legal Services Inherent in this VLO Raises Distinct Concerns As It Pertains to Attorney's Fulfillment of Her Duty of Competence.

Just as the duty to maintain a client's confidences is one of the cornerstones of an attorney's duty of competence (rule 3-110), so too is the attorney's ability to effectively communicate with a client a prerequisite to affording competent counsel. (Rule 3-500.)

In our VLO, all services and communications are conducted wholly through the VLO portal on the internet, without any physical meeting, and without any one-on-one contact even by phone. While the Committee believes that such an internet-only, attorney-client relationship, under the right circumstances, can meet all of Attorney's ethical obligations, such an internet-only structure does raise distinct ethics issues as it pertains to communications and competency.

First, Attorney must take reasonable steps to set up her client intake system in such a way that she is receiving from the prospective client sufficient information to determine if she can provide the prospective legal services at issue. Although an attorney in a non-VLO has this same obligation, the lack of face-to-face or even phone communication with the client in our hypothetical VLO may hinder Attorney's ability to make this determination.

Second, Attorney's intake procedures also must include her receipt of sufficient information to make the initial determination of whether she can perform the requested legal services competently in a VLO at all.

Third, once Attorney determines that she has sufficient information to determine that she can provide the legal services at issue, on any matter which requires client understanding, Attorney must take reasonable steps to ensure that the client comprehends the legal concepts involved and the advice given.

Fourth, once Attorney begins the representation, she must keep the client reasonably informed about significant developments relating to the representation, including promptly complying with reasonable requests for information and copies of significant documents.

Fifth, given that individuals have varied understanding of technology and how to use it, attorneys using a VLO must have a reasonable basis to believe that the client has sufficient access to technology and the ability necessary to communicate through Attorney's web-based portal.

Sixth, if after her initial intake, Attorney concludes that she cannot competently deliver legal services to the client through this VLO, Attorney must decline to undertake that representation within this VLO context. (Rule 3-110.) If legal services already have commenced when Attorney determines she cannot competently continue, Attorney must cease further representation through this VLO. (Rule 3-700.)

Finally, in all law offices, including this hypothetical VLO, attorneys have a duty to supervise subordinate attorneys, and non-attorney employees or agents. (Rule 3-110 (discussion par. 1).)

CONCLUSION

The Business and Professions Code and the Rules of Professional Conduct do not impose greater or different duties upon a VLO practitioner operating in the cloud than they do upon attorneys practicing in a traditional non-VLO. While Attorney may maintain a VLO in the cloud, Attorney may be required to take additional steps to confirm that she is reasonably addressing ethical concerns raised by issues distinct to this type of VLO. Failure by Attorney to comply with her ethical obligations relevant to these issues will preclude the operation of a VLO in the cloud as described.

This opinion is issued by the Standing Committee on Professional Responsibility and Conduct of the State Bar of California. It is advisory only.