Can a law firm let an outside IT vendor access its network and client files without breaking confidentiality rules?

Plain-English summary

The opinion addresses a firm that wants an off-site vendor to manage and monitor its computer network, where the vendor would need access to the network on which electronic client files are stored, whether the server sits at the firm with remote access or physically at the vendor. The Committee frames the issue around two rules: Rule 1.6(a) (confidentiality of information) and Rule 5.3 (responsibilities regarding nonlawyer assistants).

Because the vendor is a nonlawyer who would have access to client files, the opinion concludes the firm must protect those files under Rules 1.6(a) and 5.3 by making reasonable efforts to ensure the vendor has or will institute reasonable procedures to safeguard confidentiality. The opinion aligns this with ABA Formal Op. 95-398 and ABA Formal Op. 08-451, which treat retaining outside service providers as commonplace and strongly advise written confidentiality agreements, and with Massachusetts Bar Op. 05-04 and Section 60 of the Restatement (Third) of the Law Governing Lawyers. It lists reasonable steps such as notifying the vendor of the confidential nature of the information, examining the vendor's policies, and obtaining written assurances that access is limited to technical support and that the vendor will protect all client information.

The opinion also notes that if the vendor breaches confidentiality, the lawyer may be obligated under Rule 1.4(b) to disclose the breach to the client where it is likely to affect the client's position or outcome, and that other laws (such as data-breach notification statutes) may require disclosure. Finally, it concludes the physical or remote nature of the vendor's access is irrelevant so long as adequate safeguards are taken, citing the ABA's view that even unencrypted internet communication does not by itself violate Rule 1.6.

In practice

Under the Illinois Rules, the opinion holds that outsourcing network administration to a third-party vendor is permissible if the firm takes reasonable steps to protect client confidentiality, and it treats a written confidentiality agreement as the advisable mechanism. The opinion further indicates that a vendor's breach may trigger a Rule 1.4(b) duty to inform the client, and that the choice between remote and on-site access does not change the analysis when safeguards are adequate.

Common questions

Q: Can a law firm outsource its IT to a vendor that can see client files?

A: Yes. The opinion concludes the arrangement does not violate confidentiality rules if the firm makes reasonable efforts under Rules 1.6 and 5.3 to ensure the vendor safeguards the client information.

Q: What steps should the firm take with the vendor?

A: The opinion points to obtaining a written confidentiality agreement and assurances that access is limited to technical support, and to examining the vendor's policies for handling confidential information.

Q: Does it matter whether the server is at the firm or at the vendor?

A: No. The opinion concludes the physical or remote nature of the vendor's access is irrelevant so long as adequate safeguards are in place.

Q: What if the vendor leaks client information?

A: The opinion concludes the lawyer may be required under Rule 1.4(b) to disclose the breach to the client if it is likely to affect the client's position or outcome, and that other laws may also require notification.

Background and rules framework

The opinion interprets Illinois Rule 1.6(a) (confidentiality of information), Rule 5.3 (responsibilities regarding nonlawyer assistants, which makes the lawyer responsible for nonlawyer conduct in defined circumstances), and Rule 1.4(b) (keeping the client informed). It relies on ABA Formal Opinions 95-398 and 08-451, Massachusetts Bar Op. 05-04, and Section 60 of the Restatement (Third) of the Law Governing Lawyers.

Citations and references

Rules of Professional Conduct:

• MR 1.6 (confidentiality of information) / IL Rule 1.6(a)
• MR 5.3 (responsibilities regarding nonlawyer assistants) / IL Rule 5.3
• MR 1.4 (communication) / IL Rule 1.4(b)

Statutes:

• Electronic Communications Privacy Act, 18 U.S.C. Section 2510

Other opinions cited:

• ABA Formal Op. 95-398 (1995): outside service providers and client confidentiality
• ABA Formal Op. 08-451 (2008): outsourcing legal and nonlegal services
• Massachusetts Bar Op. 05-04: vendor access to a firm's computer system

See also

• ABA Formal Op. 08-451: Outsourcing Legal and Nonlegal Services
• ABA Formal Op. 498: Virtual Practice
• ABA Formal Op. 477R: Securing Communication of Client Information

Source

• Landing page: https://www.isba.org/ethics/opinions/1001