Technological innovation is reshaping the practice of law in ways that didn’t seem possible 10-15 years ago. As recently as the turn of this most recent century, and, if you needed a lawyer you were likely to seek a word-of-mouth referral from family, friends or perhaps from another professional you did business with. Upon receiving a recommendation, you would then probably call the office and arrange for an in-person meeting at a law firm. For many practices, the rapid pace of technological change seems to have confined this whole process to history. Today, those seeking a lawyer are more likely to Google an attorney. Even if you ask for a referral, you will undoubtedly Google you attorney for any obvious complaints or ethical issues and may even review one of the many sites that rank or rate attorneys. Further, you may not meet the lawyer at his law office but may work over the phone or through e-mail. In fact, the attorney may not even have a traditional brick and mortar office and may work out of a virtual office by making use of SaaS (Software as a Service – think of Google Apps like Google Docs or Gmail) and other cloud-based solutions.
Like a number of regulations that weren’t originally set up to respond to the pace of technological innovation, many state’s attorney ethics rules either haven’t addressed these developments or have done so in a way that makes adhering to the rules something that practitioners need to keep front of mind.
Here’s a Shock: Lawyers (Sometimes) Can and Do Provide Legal Services Online
In many jurisdictions they can, but that was not always the case. Consider the respected and local New Jersey Bar which, until February 1, 2013, required an attorney to maintain an exclusive and bona fide brick and mortar office in the state. New Jersey, however, has since waived the requirement of a “fixed physical location” and now permits licensed attorneys to practice out of a virtual office provided that the attorney structures the office so that, “prompt and reliable communication with and accessibility by clients other counsel and judicial and administrative tribunal before which the attorney may practice…”, is assured.[1] Pennsylvania recognized this trend more quickly than its neighboring state and has permitted virtual offices since at least 2010. The ethics opinion defined a virtual office as, “a law office that exists without a traditional physical counterpart, in which attorneys primarily or exclusively access client and other information online, and where most client communications are conducted electronically, e.g., by email, etc.” Guidance provided by the decision indicates that Pennsylvania attorneys may:
- Operate a virtual law practice from a home office even if the home office is not located within the physical borders of Pennsylvania
- Refrain from listing the physical address of his or her virtual office in official letterhead or advertisements
However, at this time, an attorney in Pennsylvania may not explicitly claim that providing services through a virtual office permits lower costs and fees than a traditional practice.
Some Jurisdictions Limit the Use of Virtual Offices
New York has taken an interesting and a somewhat contradictory approach to the use of a home or virtual office. In the state both resident and non-resident attorneys are technically permitted to avail themselves of a virtual arrangement provided that they are licensed in New York. However an attorney who is not a resident of the state of New York must also maintain “office for the transaction of law business” in New York. The office space can be shared, but it must be a physical location. This requirement has prompted a Constitutional challenge of the requirement by a New Jersey lawyer under the Privileges and Immunities Clause of the U.S. Constitution. The SDNY initially granted summary judgment in favor of the plaintiff because it determined that the rule placed an impermissible burden on the fundamental right to practice law and that the state did not establish that a substantial state interest existed or the nexus between that interest and the statute. the Appeal court reversed finding that the law implicated significant state interests. The appeals court certified a controlling question of state law:
Under New York Judiciary Law 470, which mandates that a nonresident attorney maintain an “office for the transaction of law business” within the state of New York, what are the minimum requirements necessary to satisfy that mandate?
The court has not foreclosed the possibility that New York’s law violates the U.S. Constitution. It will retain jurisdiction over the matter pending the New York Court of Appeals’ answer to the certified question. However in the interim attorneys who practice in New York but reside in a neighboring or different state are advised to proceed with caution regarding a virtual or home office, if at all.
The court has not foreclosed the possibility that New York’s law violates the U.S. Constitution. It will retain jurisdiction over the matter pending the New York Court of Appeals’ answer to the certified question. However in the interim attorneys who practice in New York but reside in a neighboring or different state are advised to proceed with caution regarding a virtual or home office, if at all.
However certain states have issued restrictions regarding use of a virtual office. Virgina addressed a number of issues regarding a virtual law practice including ensuring that statements regarding the character and nature of the location and its employees is accurate. In 2013, Delaware suspended a well-known Pennsylvania attorney for two years because although he was licensed in Delaware, “all of [his] work aside from meeting clients, court room appearances and depositions are conducted at [his] home [in Pennsylvania].” Further, the attorney did not have any employees at his Delaware location and his books and records were found to be deficient.
What About Confidential Client Data Floating Around in the Cloud?
First, it is important that we understand exactly what the cloud is and what the cloud is not. The cloud, despite its name, is not an amorphous notion. Rather, the cloud is nothing more than a remote server that is accessed through the internet or intranet that an authorized user can utilize to run applications or store information. Running applications and storing data in the cloud, read: on a remote server, permits access from anywhere you have an internet connection and reduces the barrier of entry for small law firms as firms can pay monthly for services rather than making large capital investments in servers and dedicated IT support. The New Jersey Ethics Committee in Opinion 701 recognizes potential additional benefits to the client as, “a lawyer’s ability to discharge those duties may very well be enhanced by having client documents available in an electronic form that can be transmitted to him instantaneously through the Internet. We also note the recent phenomenon of making client documents available to the client through a secure website. This also has the potential of enhancing communications between lawyer and client, and promotes the values embraced in RPC 1.4.” Therefore storage of client data in the cloud is permissible in New Jersey provided that the attorney proceeds with reasonable care by utilizing available technology to protect against infiltration attempts. Use of cloud computing services are likewise permissible in Pennsylvania provided reasonable care is exercised to ensure that cloud data remains confidential and reasonable safeguards are maintained. However do keep in mind that for certain documents, most notably wills, digital storage may not be possible due to legal requirements. In these circumstances you should refer to your state’s requirements for the safekeeping of client information and property along with the requirements for the document itself.
How You Handle a Data Breach Could Make or Break Your Practice
While the legal requirements for each state vary, it is essential that your firm has a plan of action should a data breach occur. At minimum, you should:
- Set up a system to alert you of the breach – Being in the loop at the beginning can greatly improve your response to this potential crisis. Rapid notification will provide more time to assess the breach and ensure that the vulnerability is closed as quickly as possible. Clients can be notified sooner and may be able to take action to minimize the breach’s impacts
- Understand what technical services your cloud provider provides – Don’t wait until there’s a crisis to find out that you’re on your own. Ask your cloud provider today what measure they will take, including if an investigation will occur, if there were to be a breach.
- Have a client notification plan ready to go – When client data has been improperly accessed, a lawyer must take steps to minimize the damage caused. Being able to promptly notify clients so that they can take corrective action may make the difference between an inconvenience and a disaster.
- Does your cloud provider have insurance? – If you are working with a small IT firm, their assets may not be able to cover the potential damage a breach of client data may cause.
As the individual State bars continue to adapt to technology and permit more widespread use of technology, it is essential that you and your firm understand the changes and, when appropriate, integrate them into your daily practice. Understanding the evolving ethics rules can improve your ability, as required under RPC 1.1, to provide competent counsel to your clients and enhance your ability to communicate with your clients as required by RPC 1.4. Further, your law firm’s website may introduce your firm to a person who would not have otherwise located it. Finally your leveraging of online tools and resources may permit your firm to serve a broadened client base while permitting you to maintain a better work/life balance. The relaxation of the virtual office rule and the benefits offered by digital cloud storage provide new business opportunities to tech-savvy lawyers. However it is essential that attorneys tread carefully when leveraging digital resources. Before you take action online, be sure that a legal or ethical rule does not prohibit it. However the broad trend has seen rules crafted that breathe significant opportunity into digital efforts including online marketing, use of a virtual office and cloud document storage.
[1] To practice out of a virtual office an attorney domiciled in New jersey must also: “designate one or more fixed physical locations where client files and the attorney’s business and financial records may be inspected on short notice by duly authorized regulatory authorities, where mail or hand-deliveries may be made and promptly received, and where process may be served on the attorney for all actions, including disciplinary actions, that may arise out of the practice of law and activities related thereto.”
Craig Toncic is an attorney and member of Majux’s SEO for law firms team.
