Sending a settlement agreement, a tax return or a draft will as an ordinary email attachment is easy, and it is how a large share of law firm documents still travel. It is also one of the weakest links in many firms' confidentiality practices. Email can be misaddressed, forwarded, intercepted when accounts are compromised and stored in places no one planned.
ABA Formal Opinion 477R, on securing communication of protected client information, discusses a risk-based approach: unencrypted email may be reasonable for routine matters, but lawyers should consider the sensitivity of the information and other factors, and may need additional safeguards or client consent in some circumstances. Your state bar may have its own guidance. This article offers practical alternatives and is not legal advice.
Three Ways to Exchange Documents
1. Email attachments
Strengths: Universal and familiar. Everyone can use it.
Weaknesses: Misdirected sends, no control after delivery, copies sit in mailboxes indefinitely and compromised accounts expose everything in them.
Best for: Low-sensitivity documents. Add encryption options for anything more sensitive.
2. Client portals and secure file sharing
Strengths: Documents stay in a controlled location with access logs. Access can be revoked or set to expire. Clients log in with their own credentials and ideally MFA. Many practice-management platforms include a portal, and standalone secure-sharing tools exist as well.
Weaknesses: Clients may find it unfamiliar or ignore notifications. It requires a firm process to use consistently.
Best for: Financial records, medical records, discovery materials, drafts and anything with personal identifiers.
3. E-signature platforms
Strengths: Fast signing, audit trails with time stamps, reminders and reduced paper. Many integrate with practice-management and document systems.
Weaknesses: Phishing emails impersonating e-signature services are common. Signing links sent to the wrong person can be a problem, and the final signed documents must be stored properly.
Best for: Engagement letters, authorizations, settlement documents and many transactional papers, subject to legal requirements for particular document types.
Rules for Choosing and Configuring Tools
- Check vendor security. Ask about encryption, access controls, retention, subprocessors and incident notice, as you would for any vendor handling client data. Model Rule 5.3 covers supervision of outside service providers.
- Require MFA for staff, and for clients where the platform allows.
- Limit link lifetimes. Shared links should expire, and access should end when the matter does.
- Use named recipients, not open "anyone with the link" sharing.
- Turn on audit logs and review them if something goes wrong.
- Integrate with your matter record. Signed and shared documents should land in the matter file automatically.
Teach Clients the Process
Clients are part of your security. A short explanation at the start of an engagement helps.
- Tell them how documents will be exchanged and why.
- Explain that the firm will never ask for sensitive information through unfamiliar links, and show what a genuine portal notice looks like.
- Give them a number to call to verify any request that looks unusual.
This also supports your wire-fraud defenses, since many scams imitate firm communications.
Guard Against Look-Alike Phishing
Fake e-signature and file-share notices are a standard attack. Staff should be taught to:
- Open shared documents by going to the service directly, not through unexpected links.
- Check the sender and the domain.
- Report anything suspicious before clicking.
Handle Sensitive Cases With Extra Care
For particularly sensitive matters, consider added safeguards such as encrypted email with passcodes shared separately, portal-only exchange, and restricted access lists. Discuss preferences with clients and document their choices.
Closing the Loop on Retention
Whatever tool you use, decide where final copies live, how long shared links and portal files remain and who removes them. Review old shares periodically, since forgotten shared links are a quiet source of exposure.
Make the Secure Way the Easy Way
People use whatever is fastest. If the portal takes six clicks and email takes one, email will win. Choose tools that fit your workflow and integrate with the systems your team already uses.
Counsel Cyber helps law firms select, configure and secure client portals, e-signature tools and file sharing within their practice-management environment. If you would like to review how documents leave your firm today, we can map it with you.