ABA Model Rule 1.6 aligned24/7 security operations monitoringAustin, TX ยท Serving TX, AR, LA, OK & KS
(737) 325-2520
(737) 325-2520Schedule a Review

Remote and Hybrid Practice: Confidentiality Away From the Office

Working from home or on the road changes how a firm protects client information. Review the ABA guidance and the practical safeguards for remote lawyers.

3 min readBy Counsel Cyber Team

Remote and hybrid work is now routine at many law firms. Attorneys draft at home, take calls from airports, and review documents from coffee shops. The ethical duties do not change when the office is not under the same roof, but the safeguards that satisfy them often do.

In 2020 the ABA issued Formal Opinion 498 on virtual practice. It discusses how rules on competence, confidentiality, communication and supervision apply when lawyers work remotely. This post draws on it generally and offers practical steps. It is not legal advice; confirm requirements with your state bar.

What the Rules Emphasize

  • Rule 1.1 and Comment 8: competence includes understanding the benefits and risks of the technology used.
  • Rule 1.6(c): make reasonable efforts to prevent unauthorized disclosure of or access to client information.
  • Rules 5.1 and 5.3: supervisors must have measures for ensuring that lawyers and nonlawyer staff comply, including remotely.
  • Formal Opinion 477R: reasonable precautions vary with the sensitivity of the information and the risk.

The recurring theme is reasonable measures, tailored to circumstances. A lawyer reviewing a sealed settlement draft at home needs stronger safeguards than one reading a public docket.

Practical Safeguards by Area

Home networks and Wi-Fi

  • Change the router's default administrator password
  • Use WPA2 or WPA3 encryption with a strong passphrase
  • Keep router firmware updated
  • Separate work devices from smart-home gadgets when possible
  • Avoid public Wi-Fi for confidential work, or use a firm-approved VPN

Devices

  • Use firm-managed laptops with full-disk encryption, endpoint protection, automatic updates and screen locks
  • Limit use of personal devices, and where permitted enforce device management with the ability to wipe firm data
  • Prohibit family members from using work devices

Access and authentication

  • Require MFA everywhere
  • Use a password manager and unique passphrases
  • Use secure remote access methods the firm has approved, not ad hoc remote desktop tools

Physical privacy

  • Work in a place where calls cannot be overheard
  • Be aware of smart speakers and assistants that may listen
  • Position screens away from windows and visitors
  • Lock up paper files and shred rather than recycle

Communication tools

  • Use firm-approved video, chat and file-sharing platforms with appropriate settings
  • Avoid personal email, texting and consumer messaging apps for client matters
  • Use waiting rooms and passcodes for meetings, and confirm who is on the call before discussing confidential matters
  • Treat AI transcription and notetaking tools as requiring approval

Printing and paper

Printing at home creates copies that are easy to forget. Set a policy on printing client documents, secure storage, and disposal.

Travel

Carry minimal data, use privacy screens, never leave devices unattended or in vehicles, and report lost devices immediately.

Supervision at a Distance

Supervisors should ensure that remote staff know the policies, have training, and feel comfortable asking questions. Check in regularly, and make reporting incidents easy. Document policies and training to show reasonable supervision.

Write a Remote Work Policy

A concise policy should cover:

  1. Who may work remotely and where
  2. Approved devices and software
  3. Network and authentication requirements
  4. Handling of paper files and printing
  5. Meeting and call practices
  6. Rules for travel and international work
  7. Lost or stolen device reporting
  8. Consequences for noncompliance

Verify It Is Being Followed

Ask IT to report on device encryption, patch status, MFA enrollment and unmanaged devices. Policies on paper do not equal practice.

Special Situations

  • Working abroad: Some jurisdictions have customs rules, data laws or unauthorized practice concerns. Check before traveling.
  • Shared living spaces: Extra caution is needed with roommates or family members who may overhear or access devices.
  • Client sensitivity: Some clients require specific controls. Track those requirements.

How Counsel Cyber Helps

Counsel Cyber secures remote and hybrid practice for law firms with managed devices, MFA, secure remote access and clear policies. If your remote work rules were written in a hurry, we can help you update them.

More on Legal Ethics and Technology Compliance

Legal Ethics and Technology Compliance

Responding to a Bar Inquiry After a Data Incident: A Readiness Guide

If a data incident leads to a bar inquiry or client complaint, records matter. Prepare your policies, logs and timeline now, with counsel guiding the response.

Legal Ethics and Technology Compliance

Rule 1.6(c) and Cloud Storage: Reasonable Efforts for Client Data

Model Rule 1.6(c) asks for reasonable efforts to protect client information. See how that applies to cloud storage, file sharing and the vendors behind them.

Legal Ethics and Technology Compliance

Supervising Vendors and Staff on Tech: A Rule 5.1 and 5.3 Walkthrough

Model Rules 5.1 and 5.3 reach lawyers who oversee staff and outside vendors. See what supervision can look like for IT providers, paralegals and cloud services.