Remote and hybrid work is now part of ordinary law practice. In March 2021 the ABA issued Formal Opinion 498, which addresses the ethical considerations of virtual practice. It does not announce new rules. It applies existing duties, including competence, communication, confidentiality, supervision and unauthorized practice concerns, to the realities of working from somewhere other than the office.
This post turns the opinion's main themes into a checklist for firm administrators. It is not legal advice. State bars may differ, so confirm requirements where you practice.
What the opinion emphasizes
In general terms, Opinion 498 discusses that lawyers working virtually should consider the following: how they communicate with clients, how they protect confidentiality in remote settings, how they supervise lawyers and staff who are not physically present and how they keep client files accessible and secure. It also reminds lawyers that technology competence under Rule 1.1 includes understanding the tools used for virtual work.
Confidentiality at home
The opinion discusses reasonable efforts to prevent unauthorized access to client information in a home environment. Translate that into a home office checklist.
- Use a firm-managed device where possible, and not a shared family computer.
- Encrypt and lock devices, with automatic screen lock.
- Secure the home network: updated router firmware, a strong Wi-Fi password and a separate network for guest and smart devices if possible.
- Use a VPN or secure access tool for firm resources.
- Protect conversations. Be mindful of smart speakers and virtual assistants that may listen, and take client calls where family members and visitors cannot overhear.
- Handle paper carefully. Decide whether printing at home is allowed, and require a locked place and secure shredding.
- Do not mix accounts. Keep personal email and cloud storage separate from firm business.
Communication tools
Video and messaging platforms were adopted quickly in 2020, sometimes with little review. Evaluate each tool as you would any vendor.
- Use business-grade accounts with settings that restrict recording, sharing and guest access.
- Require passcodes or waiting rooms for client meetings.
- Know where recordings and transcripts are stored and who can access them.
- Decide which tools are approved for client communication and tell staff.
- Check terms about how the provider uses data.
Rule 1.4 on communication also applies: make sure clients can reach you and understand how you will communicate.
Supervision of remote staff
Rules 5.1 and 5.3 require reasonable supervision of lawyers and nonlawyers. Remote work makes this harder to see, so formalize it.
- Set expectations for availability and response times.
- Hold regular check-ins and team meetings.
- Provide a way for junior staff to ask questions without friction.
- Review work product consistently, not just when something goes wrong.
- Train remote staff on security policies, and retrain after incidents.
- Make sure people know how to report a lost device or suspicious message promptly.
Access to client files
The opinion discusses the importance of being able to access client files and keeping them secure. That makes the cloud-versus-local decision a compliance question too.
- Prefer cloud document management with access controls over local copies.
- Make sure backups cover remote-worker data.
- Have a plan for continuity if a lawyer becomes unavailable, such as a designated person with the ability to access critical files.
Practicing across state lines
Remote work raises questions about where a lawyer is physically located and where the lawyer is licensed. The opinion touches on unauthorized practice and advertising considerations. If attorneys work from another state, check the relevant jurisdictions' rules and consult ethics counsel.
Mail, deliveries and the office address
Decide how mail is received and scanned, how process is accepted and how the firm's public address is presented. Make sure someone is responsible and that it is secure.
A policy outline
A concise remote work policy might cover: approved devices, approved tools, home network requirements, handling of paper, confidentiality in the home, supervision and check-ins, incident reporting and a signed acknowledgment. Review it annually.
A checklist for administrators
- Inventory remote devices and confirm encryption and management.
- Confirm MFA and conditional access for remote sign-ins.
- Review approved communication tools and settings.
- Provide remote-specific security training.
- Document the policy and acknowledgments.
- Test your ability to operate if the office is closed.
Support
Counsel Cyber helps firms set up secure remote work, from device management to access policies. If you would like a gap review against this checklist, we can help.