What ethical rules does a Colorado lawyer have to satisfy to practice virtually or work remotely?

Plain-English summary

Opinion 149 addresses the Colorado Rules a lawyer should consider when practicing virtually, the technically enabled practice the ABA defines as one "beyond the traditional brick-and-mortar firm." The Committee's organizing conclusion is that the absence of a physical office creates new practical issues but does not alter the underlying duties: the same Rules apply whether the lawyer works in an office or remotely. It works through Rule 1.1 (competence), Rule 1.3 (diligence), Rule 1.4 (communication), Rule 1.6 (confidentiality), Rules 5.1 and 5.3 (supervision), and Rule 5.5 (unauthorized practice), comparing each to ABA Formal Opinions 495 and 498 and to opinions from Wisconsin, Virginia, and other states.

On competence, the opinion notes that Colo. RPC 1.1 Comment [8] tells lawyers to keep abreast of changes in "communications and other relevant technologies," but, unlike ABA Model Rule 1.1 Comment [8], the Colorado comment does not expressly reference assessing the "benefits and risks" of technology; the Committee recommends Colorado lawyers follow the best practices it lists anyway. On diligence, it reads Rule 1.3 (and Comment [5]) to support, as a best practice, a contingency or succession plan, because a lawyer's physical separation from others heightens the risk that no one notices an unexpected incapacity, cross-referencing CBA Formal Op. 147. On communication, it concludes nothing in Rule 1.4 limits the duty to face-to-face contact, but a lawyer must make sure a client can use the chosen media and that communications are actually received and understood, not merely posted to a portal. On confidentiality, it applies Rule 1.6(c)'s "reasonable efforts" standard and the Comment [18] factors, treating the analysis as fact-specific and noting that no breach is an automatic violation; the rule requires reasonable efforts, not guaranteed security.

The supervision and unauthorized-practice sections carry the opinion's sharper warnings. Under Rules 5.1 and 5.3, managing and supervising lawyers must tailor policies so remote lawyers and nonlawyer staff handle work competently and securely, including monitoring personal-device use, requiring strong passwords and VPNs, and enabling remote wipe of lost devices. Under Rule 5.5, the opinion flags the scenario of a Colorado-licensed lawyer working remotely from a state where the lawyer is not admitted: following ABA Formal Op. 495, the Committee declines to decide other states' law but concludes that if the other jurisdiction treats remote work there as unauthorized practice, Rule 5.5(a)(2) would also prohibit it, so the lawyer must check that state's rules. A closing best-practices section addresses hardware and software, file access and cloud storage, videoconferencing, document exchange and encryption, and listening-enabled devices such as smart speakers.

In practice

The opinion holds that a Colorado lawyer practicing virtually is bound by the same competence, diligence, communication, confidentiality, and supervision duties as a lawyer in a physical office, with the practical application of each duty turning on the technology and work environment the lawyer uses. It treats much of its detailed technology guidance (firm-issued hardware, multi-factor authentication, encryption choices, disabling smart speakers, confirming clients receive and understand communications) as recommended best practices rather than freestanding requirements, while grounding the mandatory core in Rules 1.1, 1.3, 1.4, 1.6, 5.1, 5.3, and 5.5. Its most concrete operative conclusion is the Rule 5.5 point: a Colorado lawyer who works remotely from a jurisdiction where the lawyer is not admitted must determine whether that jurisdiction permits it, because if it does not, the conduct can violate both that state's law and Colo. RPC 5.5(a)(2).

Common questions

Q: Do different ethics rules apply when I practice virtually?

A: No. The opinion concludes the Colorado Rules "apply uniformly to lawyers who work in physical offices and those who practice virtually." Virtual practice changes the practical application of the duties, not the duties themselves.

Q: Can I work remotely from another state where I am not licensed?

A: Only if that state allows it. Following ABA Formal Op. 495, the opinion concludes that if the jurisdiction where you are physically working treats remote practice there as the unauthorized practice of law, Rule 5.5(a)(2) also prohibits it; the opinion lists states that have addressed the issue by rule or by opinion and tells lawyers to check the destination jurisdiction's law.

Q: What does confidentiality require when I work remotely?

A: Reasonable efforts, judged on the facts. The opinion applies Rule 1.6(c) and the Comment [18] factors (sensitivity of the information, likelihood and cost of safeguards, and so on) and concludes the rule does not mandate specific security steps in every case and does not make every breach an automatic violation.

Q: Do my supervision duties change if my team works remotely?

A: They do not diminish, and may increase. Under Rules 5.1 and 5.3 the opinion says supervising lawyers must tailor policies so remote lawyers and nonlawyer staff work competently and securely, including monitoring device use, requiring strong passwords and VPNs, and being able to remotely wipe lost or stolen devices.

Q: Does the opinion say I must have a succession plan to practice virtually?

A: It frames a contingency or succession plan as a best practice supported by the diligence duty, not a technical requirement of Rule 1.3. The opinion notes physical separation heightens the risk that an unexpected incapacity goes unnoticed and points to CBA Formal Op. 147 for the details.

Background and rules framework

The opinion interprets Colo. RPC 1.1 (competence, with Comment [8] on technology), 1.3 (diligence, with Comment [5] on succession planning), 1.4 (communication), 1.6 (confidentiality, with Comments [18] and [19]), 5.1 and 5.3 (supervision of lawyers and nonlawyer assistants), and 5.5 (unauthorized practice). It compares the Colorado rules to their ABA Model Rule analogs throughout and draws on ABA Formal Opinions 495 (lawyers working remotely), 498 (virtual practice), 477R (securing client communications), 482 (disasters), and 483 (data breach), along with state opinions from Wisconsin, Virginia, and others.

Citations and references

Rules of Professional Conduct:

• Colo. RPC 1.1 / Model Rule 1.1 (competence; Comment [8] technology)
• Colo. RPC 1.3 / Model Rule 1.3 (diligence; Comment [5] succession planning)
• Colo. RPC 1.4 / Model Rule 1.4 (communication)
• Colo. RPC 1.6 / Model Rule 1.6 (confidentiality; Comments [18]-[19])
• Colo. RPC 5.1 and 5.3 / Model Rules 5.1, 5.3 (supervision of lawyers and nonlawyer assistants)
• Colo. RPC 5.5 / Model Rule 5.5 (unauthorized practice of law)

Statutes:

• C.R.S. § 6-1-716 (security-breach notification); C.R.S. § 6-1-713 and 6-1-713.5 (disposal and protection of personal identifying information)

Other opinions cited:

• ABA Formal Op. 498 (2021): virtual practice
• ABA Formal Op. 495 (2020): lawyers working remotely
• ABA Formal Op. 477R (2017): securing communication of protected client information
• ABA Formal Ops. 482 (2018) and 483 (2018): disasters; electronic data breach
• Wisconsin Formal Op. EF-21-02 (2021); Virginia LEO 1872 (2019); Virginia LEO 1791 (2003)

See also

• CBA Formal Op. 147: Succession Planning
• CBA Formal Op. 141: Data Breach Duties

Source

• Landing page: https://www.cobar.org/ethicsopinions
• Original PDF: https://www.cobar.org/Portals/COBAR/Repository/ethicsOpinions/Op 149 -- Virtual Law Practice (Clean).pdf