Can a legal-services organization disclose client-identifying information to a public funding agency that demands it as a condition of funding, and is a client consent form enough?

Plain-English summary

Opinion 700 responds to a nonprofit legal-services corporation that serves people with disabilities and receives public and private funding. One public funder required the organization to collect and report client personal information, including identifying data (name, address, phone), demographics, health status (notably HIV/AIDS), and biographical details, and to report each client's preassigned unique record number (URN) to a county HIV consortium after service, which could indirectly reveal the client's identity. Clients are required to sign a consent to disclosure of the URN before receiving services.

The Committee treats In re Advisory Opinion No. 544, 103 N.J. 399 (1986) ("In re 544"), as the definitive authority. In re 544 held that client identity may not be disclosed to any private or public funding agency absent appropriate consent or other legal justification, because a client's identity is information relating to the representation protected by RPC 1.6. The Court allowed that the result could differ if a statute or valid rule or regulation clearly required reporting client identity for legitimate governmental purposes, with suitable confidentiality protections.

The Committee does not need to reach the question whether such rules are reasonable or serve legitimate purposes, because the inquirer states that no statute or formally promulgated regulation specifically requires release of the protected information. In the absence of a valid statute or formal rule, an attorney or attorney organization cannot disclose the protected information.

On the consent form, the Committee raises two cautions. First, the form is internally contradictory: it states that permission to report the URN is required before the organization can provide services, yet also states that refusal to sign will not affect entitlement to services. Conditioning services on consent is inherently coercive, and the contradiction must be resolved and removed. Second, under In re 544, any consent must be valid, and a consent form is not valid if it is inherently coercive (services conditioned on signing it) where no law or regulation specifically requires the disclosure in the first place. If such a rule does exist, the disclosure must be made and consent obtained before taking any protected information.

In practice

The opinion holds that, under RPC 1.6 and In re 544 as they stood at the time, a legal-services organization may not disclose client-identifying information (including a unique record number that can reveal identity) to a public funder unless a valid statute or formally promulgated regulation requires the disclosure for legitimate purposes, or the client gives genuinely valid consent. Per the opinion, a consent form is not valid where it is inherently coercive because services are conditioned on signing it and no law requires the disclosure, and an internally contradictory consent form must be corrected. Because this opinion predates the most recent five years, verify the current Rules of Professional Conduct before relying on the specific rule text it describes.

Common questions

Q: Can a funder require us to report client names and data as a condition of funding?

A: Per the opinion, not unless a valid statute or formally promulgated regulation specifically requires reporting that protected client information; client identity is protected by RPC 1.6 under In re 544.

Q: Does a signed client consent form solve the problem?

A: Only if the consent is valid. The opinion states a consent form is not valid if it is inherently coercive, meaning services are conditioned on signing it, in a situation where no law requires the disclosure.

Q: What is wrong with a form that says consent is required for services but refusal will not affect services?

A: The opinion finds that internal contradiction problematic, because conditioning services on consent is inherently coercive, and it must be resolved and removed so the client receives complete candor and clarity.

Background and rules framework

The opinion interprets RPC 1.6, the New Jersey analog to Model Rule 1.6, which protects information relating to the representation of a client; the Committee reads it together with the attorney-client privilege, N.J.S.A. 2A:84A-20, and the controlling decision In re 544. The central point is that client identity itself is protected information that cannot be disclosed to a funder without a valid legal requirement or valid consent.

Citations and references

Rules of Professional Conduct:

• MR 1.6 / NJ RPC 1.6 (confidentiality of information relating to the representation)

Statutes:

• N.J.S.A. 2A:84A-20 (attorney-client privilege)

Cases:

• In re Advisory Opinion No. 544, 103 N.J. 399 (1986) (client identity protected; disclosure to funders barred absent consent or legal justification)

See also

• ABA Formal Op. 473: Responding to a Subpoena for Client Information
• NJ ACPE Op. 701: Electronic Storage and Access of Client Files

Source

• Full text (Justia mirror): https://law.justia.com/cases/new-jersey/advisory-committee-on-professional-ethics/2005/acp700-1.html
• Issuing authority: New Jersey Supreme Court Advisory Committee on Professional Ethics, via the NJ Courts Supreme Court Committees page

Original opinion text

Reproduced from a full-text mirror of the official opinion for research purposes. Spacing around stripped quotation marks has been normalized; the linked official source controls.

182 N.J.L.J. 1126

December 19, 2005

15 N.J.L. 46

January 2, 2006

Advisory Committee on Professional Ethics

Appointed by the Supreme Court of New Jersey

Opinion 700

Advisory Committee on Professional Ethics

Consent and Barring Disclosure of Protected Information

Inquirer is a not-for-profit corporation which receives public and private funding to provide legal assistance to people with disabilities. One public funding source has required the inquirer to collect and disclose to the public agency various client personal information, some of it relating to a particular disability, AIDS. The required disclosures include client-identifying information (name, address, phone number), demographic information (ethnicity, race), health status, and biographical data (e.g., how clients became infected with HIV, whether they use intravenous drugs). According to the inquirer, each client has been preassigned a unique record number, or URN, by the county HIV consortium, before they come to the inquirer for service, and that number is reported to the county consortium after the client has received service, thus potentially indicating the client's name and other identifying information. Each client is required to sign a consent to disclosure of the URN to the consortium before they receive services.

In re Advisory Opinion No. 544 of the New Jersey Supreme Court Advisory Committee on Professional Ethics (hereafter In re 544), 103 N.J. 399 (1986), represents the definitive word concerning permissible disclosure in a non-criminal context of information required to be kept confidential under RPC 1.6 or the attorney-client privilege, N.J.S.A. 2A:84A-20. In re 544 held that

client identity may not be disclosed to any private or public funding agency in the absence of appropriate consent or other legal justification. In so ruling, we determine that a client's identity constitutes information relating to the representation of a client under the current Rules of Professional Conduct and a secret entitled to non-disclosure, if not a protected confidential communication, under the attorney-client privilege and former Disciplinary Rule 4-101(A), which was relied upon by the ACPE in this case.

Id. at 409

The Court also emphasized that the fact that client information that serves to identify the client would clearly be protected under the current Rules of Professional Conduct, RPC 1.6. As noted, this rule accords confidentiality to any information relating to the representation of a client. Manifestly this would include a client's identity.

Ibid.

The Court recognized that there could be exceptions to this bar to disclosure in certain circumstances.

We acknowledge that if by statute or valid rule or regulation information concerning the identity of clients of a legal services organization were clearly required to be reported for legitimate governmental purposes, the analysis and result could well be different. A different conclusion as to the propriety of disclosure might also obtain in the event private funding sources sought client information under enforceable rules or regulations. It can reasonably be assumed that in such a context, the welfare and interests of clients would remain a paramount concern and that the disclosure occasioned by such necessary reporting would be attended by suitable protections reflecting the needs for confidentiality and privacy.

Id. at 411

Under the Court's analysis, an attorney or attorney organization would be required to determine that any disclosure was compelled by reasonable rules clearly requiring such disclosure for legitimate purposes. Id. at 412. The requisite analysis of whether the rules are reasonable under In re 544, and whether there are legitimate purposes, need not be reached in the present inquiry, because the inquirer represents that no statute or formally promulgated regulation specifically requires release of the protected information. In the absence of such a valid legal statute or formal rule, an attorney or attorney organization cannot disclose such protected information.

In the present inquiry, the inquirer uses a client consent form to authorize release of the URN. Two cautions must be made concerning the use of such a consent form.

First, we note a contradiction within the consent form itself. A sentence in its second paragraph declares Permission [for inquirer] to report the URN to [the county consortium] is required before [inquirer] can provide services to any individual. The last sentence of the form, however, states that Refusal to sign will not affect your entitlement to [inquirer's] services. This contradiction is problematic. Conditioning services upon consent is inherently coercive. When such a condition is permissible is addresses earlier in this opinion, but an attorney and attorney organization owe a duty of complete candor and clarity to any prospective or actual client being asked to consent to a waiver of legal rights. This apparent contradiction must be resolved and removed.

Second, under In re 544, any such consent must be valid. We observe that utilization of a consent form would not be valid if it is inherently coercive (i.e., services are conditional upon execution of the form) in a situation where no law or regulation properly or specifically requires disclosure of the protected information in the first place. If there is such a rule, then such disclosure must be made prior to taking any protected information, and consent must be obtained.