By Matthew Santoni

Law360 (April 13, 2020, 10:06 PM EDT ) Working from home during the coronavirus pandemic requires attorneys to take extra care to protect the confidentiality of client and case information, keeping it safe electronically and when discussing matters outside the cloistered confines of their law offices, the Pennsylvania Bar Association warned in a formal opinion.

The opinion, issued Friday by the bar association's committee on legal ethics and professional responsibility, emphasized that working from home could create additional obligations for electronic security, and recommended precautions such as keeping privileged conversations and files in an area out of earshot of family members, visitors or "smart home" devices.

"When Pennsylvania Governor Tom Wolf ordered all 'non-essential businesses,' including law firms to close their offices during the COVID-19 pandemic ... in many cases, attorneys and their staff were not prepared to work remotely from a home office, and numerous questions arose concerning their ethical obligations," the opinion said. "An attorney working from home or another remote location is under the same obligations to maintain client confidentiality as is the attorney when working within a traditional physical office."

The opinion affirmed and incorporated some of the association's guidance from prior opinions on using cloud-based software and storage, and operating a "virtual office," such as making sure that attorneys keep up to date on technology and how to use it securely.

It was the first time any state bar association had tried to comprehensively address all the issues that arise when practicing law from outside the law office, said Daniel J. Siegel, co-vice chair of the committee and author of much of the opinion.

"The goal was to put it all in one place, where lawyers could get reasonable guidance," Siegel told Law360. "It's the first opinion that really addresses the entire combination of factors that lawyers working outside their physical offices could see."

At a minimum, the opinion said, attorneys need to take precautions to minimize the risk of accidentally disclosing confidential information to hackers and eavesdroppers, that their data is securely stored and backed up, and that remote workers know their obligations under the Rules of Professional Conduct.

"An attorney must safeguard electronic communications, such as email, and may need to take additional measures to prevent information from being accessed by unauthorized persons," the opinion said. "For example, this duty may require an attorney to use encrypted email, or to require the use of passwords to open attachments, or take other reasonable precautions to assure that the contents and attachments are seen only by authorized persons."

A "best practices" section of the opinion had broad recommendations, including that firms use virtual private networks, or VPNs, when remotely accessing and working with privileged information; take extra care to verify the identities of anyone who has access to information; keep confidential information saved only on the office's servers and not on personal devices; and use extra security measures like encryption and two-factor authentication when logging into the firm's systems.

Like many organizations and experts tackling the logistics of working from home, the association recommended that lawyers protect the confidentiality of their conversations and any physical files by having their home or remote work space or file storage in a separate, secure area, if possible.

"Lawyers working from home may be required to bring paper files and other client-related documents into their homes or other remote locations. In these circumstances, they should make reasonable efforts to ensure that household residents or visitors who are not associated with the attorney's law practice do not have access to these items," the opinion said. "This can be accomplished by maintaining the documents in a location where unauthorized persons are denied access, whether through the direction of a lawyer or otherwise."

Conversations about privileged information should be kept from where they could be overheard, whether by human ears or electronic ones, the opinion said, singling out voice-activated devices like Amazon's Alexa that can listen in on and record conversations which, though ostensibly not linked to the identity of the speakers, could contain enough information to connect them back to the parties involved.

"When speaking on a phone or having an online or similar conference, attorneys should dedicate a private area where they can communicate privately with clients, and take reasonable precautions to assure that others are not present and cannot listen to the conversation," the opinion said. "For example, smart devices such as Amazon's Alexa and Google's voice assistants may listen to conversations and record them. Companies such as Google and Amazon maintain those recordings on servers and hire people to review the recordings."

And the opinion also warned lawyers to take care with video-conferencing, noting that as the practice became more popular amid coronavirus quarantines, it became more popular for hackers and crashers to target those virtual meetings.

Siegel noted that he had been personally warning attorneys against the Zoom platform in particular, and the opinion included recommendations from the FBI on mitigating the threat of "teleconference hijacking threats." Those included not making any meetings public, requiring passwords to control who has access, not posting links to the conference publicly and restricting access to screen-sharing.

As someone in a small firm who was tech-savvy, Siegel said he personally was equipped and ready when the state ordered law offices closed, but said he hoped the bar association's guidance would help attorneys who were less prepared for the sudden shift.

"A lot of these issues hit harder on solo and small firms; they don't always have the infrastructure and support staff," he said. "We knew what to do; we didn't skip a beat, but we're certainly not the rule."

--Editing by Brian Baresch.

For a reprint of this article, please contact reprints@law360.com.