Ethics and technology
ABA Model Rule 1.6(c) and Cybersecurity
What the ABA Model Rules say about protecting client information, and the practical security steps law firms take to meet that duty.
Protecting client information is not only good business for a law firm. It is part of a lawyer's professional duties. This article summarizes what the ABA Model Rules of Professional Conduct say and the practical steps firms commonly take. It is general information, not legal advice; check your state's rules and ethics opinions.
What Rule 1.6(c) says
In 2012 the ABA added paragraph (c) to Model Rule 1.6, Confidentiality of Information: "A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."
At the same time, Comment 8 to Model Rule 1.1, Competence, was updated to say that a lawyer should keep abreast of changes in the law and its practice, "including the benefits and risks associated with relevant technology."
What counts as reasonable efforts
The comments to Rule 1.6 list factors for deciding whether a lawyer's efforts are reasonable, including:
- The sensitivity of the information
- The likelihood of disclosure if additional safeguards are not used
- The cost of additional safeguards
- The difficulty of implementing them
- The extent to which they would make it harder to represent clients, for example by making a device or software excessively difficult to use
In other words, the rule does not require perfect security. It expects a thoughtful, risk-based approach that fits the information your firm handles.
Related ABA ethics opinions
- Formal Opinion 477R (2017) discusses securing communication of protected client information and supports a risk-based approach, with stronger measures for highly sensitive information.
- Formal Opinion 483 (2018) addresses lawyers' obligations after an electronic data breach or cyberattack, including monitoring for breaches, acting to stop and investigate them, and informing affected clients when required.
State rules vary
Most states have adopted versions of Rule 1.6(c) and the technology comment, and many state bars have issued their own opinions. Your state's rules and opinions are what apply to your firm.
Practical security steps law firms take
Firms commonly translate "reasonable efforts" into concrete controls such as:
- A written assessment of where client information lives and who can access it
- Multi-factor authentication for email and remote access
- Encryption on laptops and secure ways to share files with clients
- Access controls so staff only see the matters they work on
- Due diligence on cloud and software vendors that store client data
- Regular security awareness training for attorneys and staff
- Tested backups and a written incident response plan
Getting help
Our cybersecurity services for law firms put these safeguards in place and document them, and our IT consulting for law firms includes written IT assessments and security policies. Everything is built around how attorneys actually work.
FAQ
Common Questions
Does Rule 1.6(c) require specific technology?
No. The Model Rule requires reasonable efforts and lists factors to weigh rather than specific products. Ethics opinions describe a risk-based approach that fits the sensitivity of the information.
Is this legal advice?
No. This article is general information about the ABA Model Rules. Check the rules and ethics opinions in your state, or consult ethics counsel, for advice about your obligations.
Can you document our security safeguards?
Yes. We provide written IT assessments and security policies as part of our IT consulting for law firms.
Protect Client Information With the Right Safeguards
Get a managed IT quote that includes security built for law firms, or call to talk with our team.