Confidential Client Information: Fill & Download for Free

Not all accountants and/or advisers are subject to the same laws, but as a CPA I am required by state and federal law as well as professional ethics standards to maintain confidentiality of my client's information. Unlike an attorney I can be required to disclose your information subject to a subpoena, but that is the only reason I can disclose your information without your permission.As for a personal opinion, I can't do an adequate job for you if you withhold information from me that is relevant to the work being performed. Add to that the fact that in my experience clients often are not even aware of what is or is not relevant. I would rather you burden me with irrelevant information than risk missing disclosing something important. Although other accountants who are not licensed CPA's may not be subject to the same laws, I can't imagine that any reputable professional is going to stay in business very long if he or she is disclosing confidential client information.

My basic practical answer to the question is that there are no specific information security practices that lawyers must follow in order to fulfill their professional ethics responsibilities.Ansel Halliburton's answer references the correct ABA rule, but the case law on what "reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to" client information (ABA Model Rule 1.6) has never been tested as far as I know. The Model Rule and the comments do not specify any single security measure that lawyers must undertake under any set of circumstances. In practice, while some sensitive clients request their outside counsel follow particular security procedures, I think it would be incredibly difficult to make a case that an attorney violated their professional responsibilities by anything short of an intentional disclosure or something akin to a gross negligence standard or a total disregard for client information security. For example, if an attorney accidentally left a box of clearly marked confidential client documents in a coffee shop, became aware of the incident, took no steps to recover the documents, and failed to alert the client that the documents were lost, there may have been an ethical violation.Here are some situations that I have observed in practice or heard second-hand from other attorneys. I do not believe any of these would rise to the level of an ethical violation under the Model Rules, though they are not best practice. My understanding that these are not ethical violations is based on my personal judgment regarding reasonable information security measures, the reactions of other experienced attorneys, and the frequency with which such events occur.Taking confidential paper documents home from the office in a cardboard box (via means of their personal cars and kept in their shared residence with other family members);Leaving confidential paper documents on printers on open office floors or in unlocked offices or conference rooms (though there is usually a reception desk you would have to get past to get into office spaces);Having confidential client communications using third-party e-mail services, such as Gmail, Yahoo!, or Outlook (many solo practitioners or small law firms use such e-mail services);Storing confidential client documents on personal computers or personal phones;Having confidential client calls in public places (airport lounges, etc.); andWorking on confidential client matters on a laptop in a public place without a privacy screen.In all of these situations, the attorneys still may be taking reasonable measures to protect the client information and are not disregarding client confidentiality, but I don't think anyone would view these activities as best practices for information security. I think the acknowledgement of that reality motivated part of the ABA comment to Model Rule 1.6, which notes that some of the factors to consider in determining the reasonableness of the lawyer's efforts are: "the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use)."

One reason is to protect the people the attorneys represented. Often there is confidential client information being discussed. The other is to protect the reputation of the lawyer. It is easy to bring a claim against a lawyer, there is no minimum standard to file a complaint. As a result, anyone can bring a complaint for any reason. In addition, lawyers are obligated to cooperate in a way that is not typical in other legal proceedings. They have to open up their files to disciplinary counsel regardless of the validity of the complaint. It would be much more difficult to compel cooperation if everything was public from the first moment. Last, the punishment scheme itself requires confidentiality. Punishments begin privately and become public as the offenses become more severe.