Protecting and Securing Confidential Client Data

Law firms are entrusted with the most sensitive and valuable information the release of which may be devastating for affected clients, as well as for the firm. In light of state and federal legislation regulating health, financial, and technology secrets, a law firm may face criminal, regulatory, or disciplinary proceedings from an unauthorized release of information. A law firm may also face civil claims, ranging from breach of contract and fiduciary duty to malpractice, defamation, or other torts. Law firms may lose loyal clients, or jeopardize the privacy and financial interests of loyal employees.

Despite these realities, law firms generally do not employ, or enforce the level of security that certain clients -- particularly those dealing with heavily regulated or confidential information -- use and take for granted in their own operations. By way of example, at any company that has defense contracts with the U.S. government, the following would be typical:

• closely monitored entry to the facility, including computerized I/D cards and video surveillance;

• prohibition of all personal electronic devices (including cell phones) within the facility;

• use of a dual computer system, a "public" computer with access to the internet, and a "confidential" computer linked only to a closed network. Both computers have encrypted drives. Both computers also require complex and regularly changing passwords, and their use is monitored;

• observance of strict protocols on moving information between confidential and so-called public computer systems. An unauthorized movement of information could result in immediate discharge -- and potential prosecution;

• issuing encrypted laptops scrubbed of data for all travel, and perhaps an encrypted flash drive;

• when confidential information needs to be discarded, it is placed in special containers handled by custodians who, like all other employees and contractors, have signed confidentiality agreements and received special training, and whose activities are monitored;

• when employees travel they will not have remote access to the confidential network.

To Continue Reading: Click Here
----------------------------------------------
Source: Law.com
By: Anthony Davis and Michael P. Downey