Every client file a remote assistant can open is a file the lawyer remains responsible for. The ABA's Formal Opinion 498 says that practicing virtually does not diminish the duty to supervise, and that the duty reaches nonlawyers both within and outside the firm. A small firm can meet those duties with a short, written set of checks.
Key Takeaways
- Give each assistant a personal login, two-step sign-in and access to only the files the job needs.
- Train the assistant on phishing, device rules and what never to send by plain email, and write the rules down.
- Privacy law depends on the content: HIPAA can apply when the firm handles health information as a business associate, and GDPR can apply to personal data of people in the EU.
- The lawyer stays responsible for supervising the assistant, keeping client information confidential and avoiding unauthorized practice of law.
- Check any vendor or agency before sending client data: contract terms, audit reports, breach notice and where the work is done.
Data Security Risks
Working from home adds risks that an office does not have, such as a shared home network, a family member glancing at the screen and a lost laptop. Formal Opinion 498 lists the controls: strong passwords, security updates, antivirus software, encryption, multi-factor authentication, secure Wi-Fi routers and, where it fits, a VPN. It also asks for a clean-desk and clean-screen rule, so that client details are never visible or audible to others during a call.
For files in the cloud, the opinion also says to choose a reputable company and take reasonable steps to keep client information confidential and available to the lawyer.
Regulatory Compliance Challenges
Rules of professional conduct are set state by state, and the ABA Model Rules cited here are the model most states build on, so check your own state's version. Privacy law depends on the content. HIPAA reaches a law firm that handles health information as a business associate of a health care provider or plan, and GDPR can apply to personal data of people in the EU.
Client contracts can add limits. Read engagement letters and any outside counsel guidelines for rules on who may see data and from where, before an assistant abroad gets access.
Ethical Considerations in Outsourcing
Three rules do most of the work. Rule 1.6(c) asks for reasonable efforts to prevent unauthorized disclosure of client information, Rule 5.3 calls for supervision of nonlawyer assistants, and Rule 5.5(a) bars a lawyer from assisting anyone else in the unauthorized practice of law.
Pay deserves a check too. Rule 5.4(a) says a lawyer or law firm shall not share legal fees with a nonlawyer, with listed exceptions, so pay the assistant a salary or a fixed fee and check your state's rule before tying pay to fees. Whether a client must be told about an outside provider depends on the engagement terms and your state's rules, so read both.
Protecting Confidential Client Information
Five habits protect the file:
- Tell clients how their information is handled, and get their agreement where the engagement terms or your state's rules call for it.
- Use secure tools for files and messages, and see our guide to the best communication tools for working with virtual legal assistants for options.
- Train the assistant on confidentiality, phishing and your device rules, and repeat the training when the rules change.
- Review who can open what, and what they opened, on a set schedule.
- Keep access controls and audit trails switched on in every system the assistant uses.
Vendor Due Diligence and Oversight
Before an agency or vendor gets client data, ask for its security policies, its disaster recovery plan, an independent audit summary if it has one, and how it screens its staff. Formal Opinion 498 says lawyers may rely on outside support staff and vendors but must ensure that they comply with the duty of confidentiality, and it suggests a confidentiality agreement. In the contract, settle who owns the work product, what happens to your files at the end and how fast the vendor must tell you about an incident.
Our guide on how to find a reliable virtual legal assistant covers the selection step.
Developing a Comprehensive Security Framework
A framework can fit on one page:
- Encrypt files in storage and in transit, and send sensitive documents through secure links.
- Set remote-access rules: two-step sign-in, a VPN on shared networks and a policy on personal devices.
- Ask a qualified third party to review your setup on a schedule that matches how sensitive the files are.
- Keep an incident plan with names, steps and a call list for notifying clients.
- Screen everyone with access, and repeat security training each year.
Review the plan every year, and again after any incident, so it keeps up with how the firm actually works.
Frequently Asked Questions
What Are the Cost Savings Associated With Legal Assistant Outsourcing?
Savings usually come from workspace and pay-scale differences, and security is a cost too, so budget for software seats, device policies, training and reviews. Through us you pay a one-time $1,997 recruitment fee and then the assistant's monthly salary directly. Price the safeguards with the salary.
How Can Law Firms Ensure Consistent Quality From Outsourced Assistants?
Check references, test candidates on real work and review output on a schedule. Write standards for the work, review a sample each week at first and keep a log of corrections, so that a repeated mistake becomes a new line on a checklist.
What Are the Benefits of Using a Legal Outsourcing Service Versus Freelancers?
A service can handle recruiting and vetting, and sometimes replacement, while a freelancer gives you direct control and more vetting work. Through us you hire the assistant directly, and we replace unsuccessful hires in the first 3 months at no extra cost. Compare the best virtual legal assistant companies on screening, contract terms and security.
How Do Law Firms Handle Intellectual Property Concerns in Outsourcing?
Put ownership in writing. The agreement should say that all work product belongs to the firm and its client, that confidentiality continues after the engagement ends, and that the assistant keeps no copies and uses no client material for anything else. Add a return-or-delete clause.
Can Outsourced Legal Assistants Attend Client Meetings or Court Hearings?
They can join a video meeting to take notes if the attorney wants them there. Court hearings are for attorneys, since nonlawyer staff generally may not represent clients in court, according to the ABA's guidance for lawyers who use paralegals.
Final Thought
Write one page first: who can open what, how they sign in, what they may send and how you will hear about a problem. Then book a free consultation if you want help matching the role to those rules.