Can a Maine lawyer use off-site vendors for transcription and computer backup if their technicians can access confidential client data?

Plain-English summary

An attorney asked whether using third-party vendors to transcribe voice recordings and store off-site backups of firm data, which exposes confidential client information to technicians and transcribers outside the lawyer's direct control, violates the duty of confidentiality, and what safeguards would make the practice permissible. The Commission concludes that, with appropriate safeguards, a lawyer may use remote transcription and server-backup services without violating the confidentiality obligation.

The opinion grounds the analysis in former Maine Bar Rule 3.6(a) (reasonable care and skill), Rule 3.6(h)(1) (the duty not to disclose confidential information), and Rule 3.6(h)(2) (the duty to use reasonable care to prevent lawyers and nonlawyers "employed or retained by or associated with" the lawyer from improperly disclosing protected information). It reads Rule 3.13(c) to reach nonlawyers retained by the lawyer, requiring reasonable efforts to ensure their conduct is compatible with the lawyer's professional obligations. The primary responsibility for file integrity and confidentiality, the opinion states, rests with the attorney even when the work is performed by an outside contractor the lawyer does not directly train or discipline.

Rather than fix a list of acceptable practices in a changing technological field, the opinion offers guidance. At a minimum, the lawyer should ensure the vendor has a legally enforceable obligation to maintain confidentiality, citing ABA Opinion 95-398 and New Jersey Opinion 701. Where the service inherently involves human access (as with transcription), additional contractual terms may be needed so the vendor's staff are trained and understand their personal confidentiality duty, and the lawyer would be well advised to require the vendor to report any inappropriate use or disclosure. The lawyer should also ensure confidential information is conveyed securely; encryption can add protection for highly confidential data in transit, though in some circumstances unencrypted email is reasonable, and the lawyer must evaluate the level of protection each type of information needs.

In practice

Under the former Maine Bar Rules in effect when the opinion issued (the Commission later confirmed in Opinion 207 (2013) that this conclusion carries forward under the Maine Rules of Professional Conduct and extends to cloud computing), the opinion holds that a lawyer may use off-site transcription and backup vendors for confidential client data with appropriate safeguards. The opinion identifies the safeguards as: confirming the vendor has a legally enforceable obligation to keep client data confidential; for services involving human access, contractual terms ensuring the vendor's staff are trained and bound to confidentiality and a duty to report any inappropriate disclosure; and transmitting the data securely, with the lawyer evaluating whether encryption or other measures are warranted for particular information. The opinion frames the lawyer's responsibility for confidentiality as continuing even though the lawyer does not directly supervise the vendor's employees.

Common questions

Q: Can a Maine lawyer store client files with an off-site backup provider?

A: Yes, with safeguards. The opinion concludes a lawyer may use remote server-backup services outside the lawyer's direct supervision without violating confidentiality, provided appropriate safeguards are in place.

Q: What is the minimum safeguard the opinion requires?

A: The opinion states the lawyer should, at a minimum, ensure the company providing transcription or data storage has a legally enforceable obligation to maintain the confidentiality of the client data.

Q: Does the lawyer's duty change because the vendor's staff are not the lawyer's employees?

A: No. The opinion reads Rule 3.6(h)(2) and Rule 3.13(c) to apply to nonlawyers "retained by or associated with" the lawyer, so the lawyer retains the obligation to ensure appropriate confidentiality standards are maintained by the contractor.

Q: Must confidential data be encrypted in transit?

A: Not necessarily. The opinion states encryption can provide additional security for highly confidential data, but in some circumstances unencrypted email is reasonable; the lawyer must evaluate the protection needed for the type of information involved.

Background and rules framework

The opinion interprets former Maine Bar Rule 3.6(a) (reasonable care and skill), Rule 3.6(h)(1) and (2) (confidentiality and the duty to prevent improper disclosure by those retained by the lawyer), and Rule 3.13(c) (responsibility for nonlawyers). These correspond to ABA Model Rule 1.6 (confidentiality), Model Rule 5.3 (responsibilities regarding nonlawyer assistance), and Model Rule 1.1 (competence). The opinion relies on prior Maine Opinions #74 and #134 and on ABA Opinions 95-398 and 99-413, New Jersey Opinion 701, and United States v. Councilman, 418 F.3d 67 (1st Cir. 2005).

Citations and references

Rules of Professional Conduct:

• Model Rules 1.6, 5.3, 1.1
• Maine Bar Rules 3.6(a), 3.6(h)(1) and (2), 3.13(c)

Statutes and regulations:

• HIPAA Privacy and Security Rules, 45 C.F.R. Part 164 (cited as an analogy for business-associate safeguards).

Cases:

• United States v. Councilman, 418 F.3d 67 (1st Cir. 2005), unauthorized interception of email violates federal wiretapping law.

Other opinions cited:

• ABA Formal Ops. 95-398 and 99-413; N.J. Sup. Ct. Adv. Comm. Op. 701.
• Maine Prof. Ethics Comm'n Ops. #74 (1986) and #134 (1993).

See also

• ABA Formal Op. 95-398: Nonlawyer Access to a Lawyer's Database
• ABA Formal Op. 08-451: Outsourcing Legal and Nonlegal Services
• Maine Ethics Op. 207: The Ethics of Cloud Computing and Storage

Source

• Landing page: https://mebaroverseers.org/attorney_services/opinion.html?id=86894

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

Issued by the Professional Ethics Commission

Date Issued: June 30, 2008

Question

An attorney has asked for guidance on the ethical propriety of using third party vendors to process and store electronically held firm data. The data would be transmitted to the third parties over a presumptively secure network connection. Processing of firm data may include transcription of voice recordings and transfer of firm computer files to an off-site "back-up" of the firm's electronically held data.

More specifically, the question is whether the use of such services and resources, which may involve disclosure of client information to technicians who maintain the relevant computer hardware and non-lawyer transcribers outside the sphere of the attorney's direct control and supervision, would violate the lawyer's obligation to maintain client confidentiality. The attorney further seeks guidance on what, if any, safeguards would make such practices permissible.

Opinion

While there is no provision of the Code of Professional Responsibility of the Maine Bar Rules that directly addresses this question, several provisions, along with previous opinions of this Commission, provide a framework for our response. We conclude that, with appropriate safeguards, an attorney may utilize transcription and computer server backup services remote from both the lawyer's physical office and the lawyer's direct control or supervision without violating the attorney's ethical obligation to maintain client confidentiality.

Rule 3.6(a) sets forth the general standard requiring the lawyer to "employ reasonable care and skill and apply the lawyer's best judgment in the performance of professional services." More specifically, Rule 3.6(h)(1) sets forth the lawyer's general obligations to maintain client confidentiality:

(1) Except as permitted by these rules, or when authorized in order to carry out the representation, or as required by law or by order of the court, a lawyer shall not, without informed consent, knowingly, disclose or use information (except information generally known) that:

i. Is protected by the attorney-client privilege in any jurisdiction relevant to the representation;

ii. Is information gained in the course of representation of a client or former client for which that client or former client has requested confidential treatment;

iii. Is information gained in the course of representation of the client or former client and the disclosure of which would be detrimental to a material interest of the client or former client; or

iv. Is information received from a prospective client, the disclosure of which would be detrimental to a material interest of that prospective client, when the information is provided under circumstances in which the prospective client has a reasonable expectation that the information will not be disclosed.

Rule 3.6(h)(2) addresses the lawyer's obligation to ensure that others working on the lawyer's behalf in the course of representation who are privy to confidential client information likewise maintain the client's confidences. The rule states: "A lawyer shall exercise reasonable care to prevent lawyers and non-lawyers employed or retained by or associated with the lawyer from improperly disclosing or using information protected by paragraph (1) of this subdivision."

The current question concerning these internet based services arises because transcription and backup services are now available at an attractive cost from companies using personnel working outside the lawyer's office and not subject to the lawyer's direct oversight. This situation leaves the lawyer with no direct control over individuals who have access to confidential client information.

As Rule 3.6(h)(2) makes clear and as we have opined previously, the primary responsibility for file integrity, maintenance, disposition, and confidentiality rests with the attorney employed by the client. See Maine Professional Ethics Commission Opinion # 74 (10/1/86). In this case, although the transcriptionists or technicians maintaining the computer backup files are not employed by the attorney, the directives of Rule 3.13(c) still govern because they also apply to non-lawyers "retained by or associated with a lawyer" and therefore require that an attorney "shall make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that the conduct of these individuals is compatible with the professional obligations of the lawyer."

Rule 3.6(h)(2) implies that lawyers have a responsibility to train, monitor, and discipline their non-lawyer staff in such a manner as to guard effectively against breaches of confidentiality. Failure to take reasonable steps to provide adequate training, to monitor performance, and to apply discipline for the purpose of enforcing adherence to ethical standards is grounds for concluding that the lawyer has violated Rule 3.6(h)(2). See Maine Professional Ethics Commission Opinion #134 (9/21/93). Clearly, when employing any outside contractor to perform law-related services, the lawyer does not directly train, monitor, and discipline the employees of the service provider; however, the lawyer retains the obligation to ensure that appropriate standards concerning client confidentiality are maintained by the contractor. The precise parameters of what constitutes "appropriate standards" are not defined in the rules or opinions, but are based on reasonable efforts to prevent the disclosure of confidential information.

With the pervasive and changing use of evolving technology in communication and other aspects of legal practice, particular safeguards which might constitute reasonable efforts in a specific context today may be outdated in a different context tomorrow. Therefore, rather than attempting to delineate acceptable and unacceptable practices, this opinion will outline guidance for the lawyer to consider in determining when professional obligations are satisfied.

At a minimum, the lawyer should take steps to ensure that the company providing transcription or confidential data storage has a legally enforceable obligation to maintain the confidentiality of the client data involved.[1] See ABA Ethics Opinion 95-398 (lawyer who allows computer maintenance company access to lawyer's files must ensure that company establishes reasonable procedures to protect confidentiality of information in files, and would be "well-advised" to secure company's written assurance of confidentiality); N.J. Sup. Comm. Prof. Ethics Opinion 701 ("Lawyers may maintain client files electronically with a third party as long as the third party has an enforceable obligation to preserve the security of those files and uses technology to guard against reasonably foreseeable hacking.") .

Footnotes

[1] Although the Privacy and Security Rules of the federal Health Insurance Portability and Accountability Act ("HIPAA"), 45 C.F.R. Part 164, requirements are generally not applicable to lawyers in their obligations to their clients, this law provides very detailed examples of standards intended to protect the confidentiality of patient health information that are now widely in use in the medical field. Under HIPAA, regulated entities that contract with others to provide services involving protected patient information are generally required to have "Business Associate Agreements" with prescribed provisions that detail the contractor's obligations to ensure the confidentiality of the patient information involved.

The contract between a covered entity and a business associate must provide that the business associate will:

(A) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of the covered entity as required by this subpart;

(B) Ensure that any agent, including a subcontractor, to whom it provides such information agrees to implement reasonable and appropriate safeguards to protect it;

(C) Report to the covered entity any security incident of which it becomes aware;

(D) Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term of the contract.
45 C.F.R. �164.314.

Similarly, the Security Rule, 45 C.F.R. �164.302-318, describes various administrative, physical, technical, and organizational security-related safeguards applicable to healthcare entities maintaining protected patient information electronically.

In some circumstances, such as with transcription, human involvement with confidential client information by the contractor's staff is inherent in the service. In that case, additional contractual obligations may be needed to ensure that the contractor's employees or agents who will have direct knowledge of the confidences are adequately trained and understand their personal obligation to maintain the information confidentially. In addition, the lawyer would be well-advised to include a contract provision requiring the contractor to inform the lawyer in the event the contractor becomes aware of any inappropriate use or disclosure of the confidential information. The lawyer can then take steps to mitigate the consequences and can determine whether the underlying arrangement can be continued safely.

Along with taking steps to ensure that the confidential information will be maintained securely by the company providing remote services, the lawyer should also take care to ensure that confidential information is conveyed to the service provider in a secure manner. While data encryption can provide appropriate levels of additional security for highly confidential data in transit in the internet, in some circumstances it may be reasonable to transmit information securely via email without encryption. See ABA Ethics Opinion 99-413 (lawyers may ethically communicate client confidences using unencrypted
e-mail sent over Internet, but should discuss with their clients different ways of communicating client confidences that are "so highly sensitive that extraordinary measures to protect the transmission are warranted"); United States. v. Councilman, 418 F.3d 67 (1st Cir. 2005) (holding that unauthorized interception of email violated federal wiretapping law, thus providing support for a reasonable expectation of privacy in e-mail transmissions). The lawyer will need to evaluate carefully the level of confidentiality protection needed for different types of information transmitted via the internet.