A law firm’s nonlawyer assistants are frequently the unsung heroes of the office.
But attorneys must remember that, despite their nonlicensed status, law firm support staff must still comply with the Rules of Professional Conduct, including the duty of confidentiality.
The duty of confidentiality imposed upon attorneys by Missouri Rule of Professional Conduct 4-1.6 is extensive. Comment  to the rule states that, absent one of the limited exceptions set forth in 4-1.6(b), attorneys are required to protect all information related to the representation, whatever its source.
Rule 4-5.3 extends this duty of confidentiality to nonlawyer assistants as well by requiring attorneys to make reasonable efforts to ensure that the law firm puts policies in place to guarantee that the conduct of the attorneys’ nonlawyer assistants comports with the attorneys’ own ethics obligations under the rules. In the recently published Missouri Informal Advisory Opinion 2017-02, Legal Ethics Counsel’s Office addressed the question of what an attorney’s duties are when a nonlawyer assistant discloses confidential client information to third parties and opposing parties in violation of these rules.
The Opinion points to Comment  of Rule 4-5.3 which imposes responsibility on the attorney for any conduct by a nonlawyer assistant which violates the Rules of Professional Conduct if the attorney ordered or ratified the conduct or the attorney knew of the conduct at a time when consequences could have been avoided or mitigated but failed to take reasonable remedial action. This means that, even if the nonlawyer assistant’s disclosure came as a complete surprise to the attorney, he or she would still need to ensure that proper mitigating steps were taken as quickly as possible to avoid a violation of the rule.
The required mitigating steps are dependent upon the circumstances of the disclosure of confidential information.
It could be necessary to contact the parties to whom the information was revealed or to inform others regarding the disclosure.
In active litigation matters, it may also be necessary to notify the court or opposing counsel depending on the effect the disclosure might have on the matter. Further mitigating actions may also be necessary if the nature of the disclosure would require them.
In addition, it would be prudent to ensure all steps taken are documented as well as possible. This documentation could be important evidence of the attorney’s compliance with the rules if, as a result of the disclosure, the attorney finds him or herself in front of either the Office of Chief Disciplinary Counsel or a malpractice jury down the road.
One step which must be taken regardless of the nature of the disclosure or its possible consequences is notification to the client.
In order to comply with Rule 4-1.4 regarding client communication, an attorney must ensure that the client is fully apprised about the disclosure to allow the client to make informed decisions about the representation.
In some situations, the breach of the duty of confidentiality may give rise to a malpractice claim against the attorney. If that is the case, client notification needs to include an explanation of the nature of the potential malpractice claim and an advisement of the client’s right to seek independent representation.
Attorneys should remember that any conversation between an attorney and client which seeks to settle a potential malpractice claim must comply with Rule 4-1.8(h). An actual settlement must comply with the requirements of Rule 4-1.8(a). Additionally, if the attorney wishes to continue representation of the client in that or any other matter where a potential malpractice claim is present, the attorney must obtain a conflict of interest waiver from the client.
While it is important to consider which steps must be followed if an employee divulges confidential client information, the best practice would be to put procedures in place which would prevent such a disclosure from ever occurring at all. To that end, proper employee training is key.
Nonlawyer assistants and support staff must understand the duty of confidentiality and all other duties imposed upon an attorney and a law firm by the Rules of Professional Conduct. Because the duty of confidentiality attaches not only to information which was shared in confidence but to everything related to the representation, nonlawyer assistants must be educated regarding proper responses to phone calls and emails from third parties fishing for information regarding the representation.
Even the fact of representation itself is confidential, and a lawyer’s support staff should take care to avoid any disclosures.
When thinking about employee training, attorneys should remember that nonlawyer assistants may make inadvertent disclosures as well, particularly when dealing with information electronically.
ABA Formal Opinion 477 which was published in May of this year talks about the importance of understanding security issues as they relate to communicating client information via email and other electronic means.
Inadvertent disclosures of confidential client information can occur through social media, the firm’s website, or any number of online sources. In this highly digital age, it is essential for law firms to have cybersecurity plans and social media policies in place and to properly train all employees regarding those policies. These plans should be developed with the assistance of a vetted cybersecurity expert.
Law offices should also develop procedures which will assist in the discovery of and response to disclosures of confidential information.
Evidentiary rules dealing with the attorney-client privilege require attorneys and parties who wish to assert privilege over inadvertently disclosed information to take action to protect privileged information and to take steps to remedy disclosure of same. Having documented office procedures in place can bolster the argument that privilege of the information was not waived by the inadvertent disclosure. See, for example, Gray v. Bicknell, 86 F.3d 1472, 1482 – 1484 (8th Cir. 1996).