What are a Pennsylvania lawyer's ethical duties when working from home or another remote location?

Plain-English summary

The opinion responds to the wave of questions that arose when COVID-19 closures forced Pennsylvania attorneys and staff to work from home, often for the first time. It affirms the conclusions of the Committee's earlier Formal Opinions 2011-200 (cloud computing) and 2010-200 (virtual law offices), including that a lawyer may store client confidential material in the cloud and may maintain a virtual law office, provided reasonable care and safeguards are used and the lawyer confirms client identity and addresses diminished-capacity situations. It also adopts the conclusion of ABA Formal Opinion 477R that a lawyer generally may transmit information over the internet using reasonable efforts to prevent inadvertent or unauthorized access, with special precautions required when the nature of the information or an agreement with the client demands it.

The opinion frames remote work as an application of existing rules rather than a new rule. It grounds the duty in Rule 1.1 (competence, including the obligation under Comment [8] to understand the benefits and risks of relevant technology), Rule 1.6 (confidentiality, including the 1.6(d) duty to make reasonable efforts to prevent inadvertent or unauthorized disclosure, and Comments [25] and [26]), and Rules 5.1 and 5.3 (supervision of lawyers and nonlawyers). It stresses that the confidentiality duty is not limited to technology: lawyers who bring paper files home must keep them where unauthorized household members or visitors cannot access them.

Section III sets out best practices as a baseline rather than a checklist of disciplinary requirements, expressly noting that failure to follow them would not necessarily violate the Rules. The opinion describes a fact-based reasonable-efforts standard drawn from ABA Opinion 477R and the factors in the Rule 1.6 comments (sensitivity of the information, likelihood of disclosure, cost and difficulty of safeguards, and effect on representation), and discusses measures such as avoiding public Wi-Fi, using VPNs, two-factor authentication, strong passwords, secured video conferences, backups, encryption, HTTPS sites, and keeping smart speakers out of areas where client conversations occur. It also reminds lawyers of Pennsylvania's Code of Civility during the crisis.

In practice

Under this opinion, a Pennsylvania lawyer working remotely carries the same Rule 1.6 confidentiality and Rule 1.1 competence duties as in the office. The opinion concludes the lawyer must take reasonable precautions to keep client communications and data confidential, measured by a fact-based standard that turns on the sensitivity of the information and the cost and difficulty of safeguards, and must secure both electronic systems and physical files. Supervisory lawyers must, under Rules 5.1 and 5.3, make reasonable efforts to ensure that other lawyers and nonlawyer staff handle client information compatibly with these duties.

Common questions

Q: Do my confidentiality duties change when I work from home?

A: No. The opinion concludes a lawyer working remotely is under the same obligation to maintain client confidentiality as when working in a traditional office.

Q: Do I have to encrypt everything?

A: Not as a flat rule. The opinion adopts a fact-based reasonable-efforts standard from ABA Opinion 477R: strong measures like encryption are warranted for some highly sensitive information, while standard methods may suffice for normal or low-sensitivity matters.

Q: What about paper files and home devices like smart speakers?

A: Both are addressed. The opinion concludes lawyers must keep paper files where unauthorized household members cannot access them, and lists keeping smart speakers such as Alexa or Google assistants out of areas where client conversations occur among reasonable precautions.

Q: Are the best practices in Section III mandatory?

A: No. The opinion states the best practices are a recommended baseline and that failing to follow them would not necessarily constitute a disciplinary violation, though compliance would reflect the reasonable conduct the Rules envision.

Background and rules framework

The opinion interprets Pennsylvania Rules of Professional Conduct 1.1 (competence, including Comment [8] on technology), 1.6 (confidentiality, including 1.6(d) and Comments [25]-[26]), and 5.1 and 5.3 (supervision of lawyers and nonlawyers). It builds on ABA Formal Opinion 477R and the Committee's own Formal Opinions 2011-200 and 2010-200. These rules track the ABA Model Rules of the same numbers, though the opinion notes Pennsylvania did not adopt Model Rule 1.6 Comment [18] in its entirety.

Citations and references

Rules of Professional Conduct:

• Pa.R.P.C. 1.1 and Comment [8]; ABA Model Rule 1.1
• Pa.R.P.C. 1.6, including 1.6(d) and Comments [25]-[26]; ABA Model Rule 1.6
• Pa.R.P.C. 5.1, 5.3; ABA Model Rules 5.1, 5.3

Other opinions cited:

• ABA Formal Op. 477R: securing communication of protected client information
• PBA Formal Op. 2011-200: cloud computing confidentiality
• PBA Formal Op. 2010-200: virtual law office obligations

See also

• ABA Formal Op. 495: Lawyers Working Remotely
• ABA Formal Op. 498: Virtual Practice
• PA Bar Ethics Op. 2022-500: Storing Client Information on a Smartphone
• PA Bar Ethics Op. 2024-100: Third-Party Vendors With Access to Confidential Information
• PA Bar Ethics Op. 2021-100: Remote Practice From a State Where Not Licensed

Source

• Landing page: PBA Ethics Opinions (Public)
• Original PDF: F2020-300.pdf