Can outside IT staff maintain a law office computer network that holds client confidences without client consent?

Plain-English summary

The inquiry concerned the use of outside agents to maintain computer systems. Specifically, a legal services agency shared a computer network with a parent nonprofit, and the nonprofit's technical personnel needed to access the shared portion of the network for maintenance and related purposes. The committee concluded that this access is permissible under RPC 1.6 without the consent of clients, as long as two requisites are met.

First, the nonprofit's employees involved must be instructed and agree that permission is granted for maintenance of the network only and does not extend to review of any confidential material on the system. Second, any acknowledgment the agency has those employees sign must include that instruction, along with an agreement that any confidential information they encounter incidental to their technical work may not be disclosed.

Currency note

This opinion was issued in 1998, before the Washington State Bar Association's adoption of the 2006 revisions to the Rules of Professional Conduct. Subsequent rule amendments or later opinions may have changed the analysis. Treat this page as historical context, not current guidance. Verify against current rules before relying on any specific rule, deadline, or requirement mentioned here. Washington's RPC 1.6 (confidentiality of information) has been amended since 1998, including provisions addressing reasonable efforts to prevent unauthorized disclosure, so verify the current rule text before relying on it.

Common questions

Q: Can outside IT personnel maintain a law office network that holds client confidences without getting client consent?

A: The committee concluded such maintenance access is permissible under RPC 1.6 without client consent, provided two conditions are met.

Q: What conditions did the committee require?

A: The personnel must be instructed and agree that access is for maintenance only and does not extend to reviewing confidential material, and any acknowledgment they sign must include that instruction plus an agreement not to disclose confidential information they encounter.

Q: Did the committee require client consent before outside techs touch the system?

A: No. It concluded the access is permissible under RPC 1.6 without the consent of clients, so long as the two requisites are satisfied.

Background and rules framework

The opinion applied Washington RPC 1.6 (confidentiality of information), corresponding to ABA Model Rule 1.6. The committee made outside technical access permissible without client consent on the condition that the outside personnel are limited to maintenance, are instructed not to review confidential material, and sign an acknowledgment agreeing not to disclose any confidential information encountered.

Citations and references

Rules of Professional Conduct:

• ABA Model Rule 1.6 (confidentiality of information); Washington RPC 1.6

See also

• WA Ethics Op. 1607: Confidentiality and Fax Machines
• WA Ethics Op. 1822: Caller ID and Confidentiality
• WA Ethics Op. 1837: Shared Office and Staff

Source

• Landing page: https://ao.wsba.org/print.aspx?ID=1041

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

Advisory Opinion: 1848
Year Issued: 1998
RPC(s): RPC 1.6
Subject: Client confidence or secret; computer system maintained by outside agency

I have been instructed by the Rules of Professional Conduct Committee to respond to your ethics inquiry #1848 concerning the use of outside agents to maintain computer systems.

The Committee has reviewed your inquiry and determined the following: the committee is of the opinion that the stated need for [the parent nonprofit's] technical personnel to access the portion of the computer network that the [legal services agency] shares with [the nonprofit] for maintenance and related purposes is permissible under RPC 1.6 without the consent of clients as long as two requisites are met:

1. [The nonprofit's] employees involved must be instructed and agree that permission is being granted for maintenance of the network only and does not extend to the review of any confidential material on that system; and 2. any acknowledgment you propose to have [the nonprofit's] employees sign must include the preceding instruction along with an agreement that any confidential information they encounter incidental to their technical work may not be disclosed.