In Kentucky, may a law firm send its detailed insurance-defense bills to the insurer's outside auditing company without the insured client's informed consent?

Plain-English summary

A law firm defended insureds and learned the insurer wanted the firm's detailed bills reviewed by an outside audit company (and also asked the firm to let the auditor review bills the firm sent to unrelated insurers). The Committee analyzed the questions under KRPC 1.8(f) (third-party compensation), KRPC 1.5(b) (communicating the basis of the fee), and KRPC 1.6 (confidentiality). It accepted, for the sake of argument, that an insurer may audit a lawyer's charges and may delegate auditing to a third party, but emphasized that the lawyer's relationship with the insured is an attorney-client relationship governed by the rules.

While historically a lawyer's bills sent to the insurer were impliedly authorized under KRPC 1.6(a), the Committee observed that modern bills are detailed and may reveal the nature of the legal services, legal research, strategic decisions, and even embarrassing information about the insured, with some audit firms building databases from that information. Agreeing with South Carolina Bar Op. 97-22, the Committee concluded a lawyer may submit bills directly to a third-party auditor only with the informed consent of both the insured and the insurer, and only so long as the lawyer reasonably believes doing so will not substantially and adversely affect the representation.

On the second question, the Committee concluded the firm may not release other clients' billing records to the auditor without those clients' full and informed consent, noting that obtaining such consent could prove problematic given the absence of benefit to those clients and the potential for misuse, and that full disclosure would have to explain the type of information involved and the potential legal effects, including waiver of privilege and work product (citing United States v. MIT (1st Cir. 1997)).

Currency note

This opinion was issued in 1998 and predates the Kentucky Supreme Court's substantial 2009 revisions to the Rules of Professional Conduct (SCR 3.130), under which Rules 1.8(f) and 1.5(b) cited here were amended. The Kentucky Bar Association notes that lawyers should consult the current version of the rules before relying on this opinion. Treat this page as historical context, not current guidance. Verify against the current rules before relying on any specific rule, deadline, or requirement mentioned here.

Common questions

Q: Could a Kentucky firm send detailed defense bills to the insurer's outside auditor?

A: Per the opinion, only with the informed consent of both the insured and the insurer, and only if the lawyer reasonably believed it would not substantially harm the representation.

Q: Why did detailed billing raise a confidentiality problem?

A: The opinion concluded modern bills may reveal the nature of services, legal research, strategy, and even embarrassing information about the insured, so disclosure to an auditor implicated KRPC 1.6.

Q: Could the firm let the auditor review other clients' bills?

A: Per the opinion, not without those clients' full and informed consent. The Committee noted such consent could be hard to obtain given the lack of benefit and the risk of misuse.

Q: What did informed consent have to cover?

A: The opinion concluded full disclosure had to explain the type of information involved and the potential legal effects, including waiver of the attorney-client privilege and work product.

Background and rules framework

The opinion interprets KRPC 1.8(f)(3) (a third-party payer arrangement must protect client information under Rule 1.6; the Model Rule 1.8 counterpart), KRPC 1.5(b) (communicating the basis or rate of the fee; Model Rule 1.5), and KRPC 1.6 (confidentiality; Model Rule 1.6), in the tripartite insurance-defense setting.

Citations and references

Rules of Professional Conduct:

• MR 1.8 / KRPC 1.8(f)(3) (third-party compensation; protection of client information)
• MR 1.5 / KRPC 1.5(b) (communicating the basis of the fee)
• MR 1.6 / KRPC 1.6 (confidentiality)

Cases:

• United States v. MIT, 129 F.3d 681 (1st Cir. 1997), waiver of privilege through disclosure to an auditor
• American Insurance Association v. Kentucky Bar Association, 917 S.W.2d 568 (Ky. 1996), insurer control and defense lawyers

Other opinions cited:

• South Carolina Bar Op. 97-22; Utah Op. 98-03 (1998): consent required for disclosure to a billing auditor
• KBA E-340 (1990): conflicts and coverage disputes

See also

• KBA Ethics Op. E-409: Disclosure of Legal Billing Information to the Insurer's Outside Auditor
• KBA Ethics Op. E-416: Insurer-Prescribed Case-Handling Guidelines in Insurance Defense

Source

• Landing page: https://kybar.org/For-Members/Rules-Ethics-Information/Ethics-Opinions
• Original PDF: https://kybar.org/Portals/0/Admin/Ethics%20Opinions/KBA_E-404.pdf

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

KENTUCKY BAR ASSOCIATION
Ethics Opinion KBA E-404
Issued: June 1998

Since the adoption of the Rules of Professional Conduct in 1990, the Kentucky
Supreme Court has adopted various amendments, and made substantial revisions
in 2009. For example, this opinion refers to Rules 1.8(f) and 1.5(b), both of which
were amended. Lawyers should consult the current version of the rules and
comments, SCR 3.130 (available at http://www.kybar.org), before relying on this
opinion.

Law Firm represents and defends insureds under liability policies issued by
Insurance Company. Insurance Company sends Law Firm’s bills to an outside audit
company, which is not affiliated with or an employee of Insurance Company. Audit
Company makes recommendations to Insurance Company as to payment or nonpayment.
Law Firm’s bills contain detailed information about the services performed pursuant to
the representation. In addition to this, Insurance Company has asked Law Firm to allow
Audit Company to review the detailed bills which Law Firm has sent to other insurance
companies, unrelated to Insurance Company.
Question 1:

Would Law Firm’s submitting its Insurance Company bills directly to
Audit Company, rather than to Insurance Company, without the law firm’s
obtaining the fully informed consent of the insured, violate the Kentucky
Rules of Professional Conduct?

Answer:

Yes

Question 2:

Would the Law Firm’s submitting other clients’ bills to Audit Company
violate the Kentucky Rules of Professional Conduct?

Answer:

Yes

References:

KRPC 1.8(f)(3), 1.5(b); South Carolina Op. 97-22; Utah Op. 98-03
(1998); For The Defense, Outside Audits and Defense Counsel - Ethical
Considerations 4 (February 1998); United States v. MIT, 129 F.3d 681
(1st Cir. 1997); June 1998 DRI For The Defense, pages 4-5.
OPINION

Rule 1.8(f) provides that “[a] lawyer shall not accept compensation for
representing a client from one other than the client unless: (1) such compensation is in
accordance with an agreement between the client and the third party or the client consents
after consultation; (2) there is no interference with the lawyer’s independence of
professional judgment or with the lawyer-client relationship; and (3) information relating
to representation of a client is protected as required by Rule 1.6.”

Rule 1.5(b) states that “[w]hen the lawyer has not regularly represented the client,
the basis or rate of the fee should be communicated to the client, preferably in writing,
before or within a reasonable time after commencing the representation.”
The basis or rate of the lawyer’s fees is a matter of contract between the client or
the third-party payor. Ordinarily, no question of ethics arises. But see, American
Insurance Association v. KBA, 917 S.W.2d 568 (Ky. 1996). We assume, arguendo, that
a third-party payor may review the lawyer’s charges and conduct appropriate billing
“audits.” We also assume that the insurer may delegate the auditing function to a third
party. We also assume that the insurer and the insured may [subject to regulatory review]
modify the insurance contract to accommodate their respective interests.
On the other hand, the relationship between the insured and the defense lawyer is
an attorney-client relationship governed by the Kentucky Rules of Professional Conduct.
Historically, lawyers have sent their bills to the insurer for payment. The disclosure of
billing information to the insurance company would have been routine, and “impliedly
authorized” by the insurance contract and the nature of the representation.1 See KRPC
1.6(a). However, these bills are now quite detailed, and contain information about the
nature of the legal services performed, information about legal research conducted, and
information which could contain strategic decisions made regarding the handling of the
case. Sometimes legal bills could include information which would tend to embarrass the
insured client. It is reported that some “audit” firms are developing databases from the
insureds’ billing information “to serve larger interests.”2
The Committee agrees with the views expressed in South Carolina Bar Op. 97-22
that a lawyer may submit his or her bills directly to a third-party auditing firm only with
the informed consent of the insured as well as the insurer, and only so long as the lawyer
reasonably believes that doing so will not substantially and adversely affect the
representation of the insured client.
Likewise, the Law Firm may not ethically release other clients’ billing records to
the audit company in the absence of full and informed consent of the clients. We note in
passing that obtaining the full and informed consent of “other clients” could prove
problematic given the absence of benefit to such clients and the potential effects of
misuse or abuse of such information. Full disclosure would presumably include an
elaboration of the type of information that might be found in the records, and the
potential legal effects of disclosure, including waiver of privileges and work product.
See, e.g. United States v. MIT, 129 F.3d 681 (1st Cir. 1997).

1 Caveat: the Committee has noted that some information may not be disclosed to the insurer
without the insured’s express consent. See, e.g., KBA E-340 (1990) (discussing conflicts and coverage
disputes).
2

Letter of concern from Washington Defense Trial Lawyers’ Association to Washington State
Bar dated November 18, 1996, on file with the KBA. Compare the concerns about patients’ medical
information in an era of “managed care.”

Note to Reader
This ethics opinion has been formally adopted by the Board of Governors of the
Kentucky Bar Association under the provisions of Kentucky Supreme Court Rule 3.530
(or its predecessor rule). The Rule provides that formal opinions are advisory only.