4. Securely Handle Client Data
Law firms are constantly entrusted with personal, privileged information from their clients as part of their role. Protecting this data is a critical requirement and firms should take adequate steps to be able to show a good faith effort was made to protect this information in the event a breach occurs.
Internal Policies
Human error is one of the leading causes of data loss and data breaches, so no matter how strong your firewalls are or how excellent your IT department is, you need to have policies in place to prevent an inadvertent incident.
Enforce using strong and secure passwords, which according to the National Institute of Standards and Technology (NIST) means using 8-64 characters and avoiding common words and phrases. Make sure employees aren’t leaving passwords lying around on sticky notes or in a Word Document. Instead, support using a password manager, a tool that is managed by one master password and holds all passwords in one location, applying them as needed.
To add an additional layer of protection, require two-factor authentication, where the user must enter a code sent to another account or device to verify their identity, wherever possible. Provide regular training on common threats such as phishing and ransomware and provide what steps they should take if they find themselves subject to these schemes. This should be an ongoing, regularly scheduled training given the frequent changes in technology and the approaches hackers take to gain access to data.
Should these policies still result in a breach, you need to have data back-ups available so you can get up and running quickly. If all of your data is completely wiped because you only had a singular instance of it, you could be facing legal malpractice suits for not taking adequate due diligence to prevent an avoidable situation. Implement the 3-2-1 plan to best protect your firm’s data which includes:
- 3 back-ups of the data
- 2 local copies on different types of storage
- 1 off-site location back-up
Vendor Management
Law firms often rely on experts and outside vendors to help fulfill needs such as managed services, document storage, and e-discovery. As part of this interaction, data is often sent to these vendors and frequently includes personal identifying data or otherwise privileged or confidential information. Firms can’t control how their vendors operate, but they still need to reduce the risk of a breach from third-party vendors as much as possible.
To mitigate the chances of a data breach and resulting compliance violation, law firms must evaluate their vendors’ current setup, procedures, and policies for any possible risks. This includes encryption, their data back-ups and redundancies, and who has access to the data.
Storage & Sharing
To keep your data fully safeguarded, it should be encrypted when it’s being stored or at rest to limit any security leaks. This means that even if someone does hack your system and gain access, they’ll only see a scramble of characters.
When sharing confidential information, don’t rely on email. Information sent through email isn’t encrypted and could be intercepted by a third party. Instead, look to a secure document transfer option, such as that offered through a client portal by many practice management programs.
When storing and transferring confidential information, you should be knowledgeable about the rules surrounding personal identifying information (PPI). Some states have specifically enacted statutes that require any companies that do business in the state to encrypt their data in an effort to protect their citizens. This information needs to be adequately protected not only from an ethical perspective, but also to comply with regulatory obligations.