The Importance of Business Continuity and Disaster Recovery Plans for Attorneys and Their Practices

Andrea: Hello, I’m Andrea Gage-Michaels, Legal Affairs Advisor at Krause Financial Services. Today, I am joined by Christopher Shattuck, the Law Practice Assistance Manager at the State Bar of Wisconsin. Christopher, thank you for talking with us today.

Christopher: Thank you for having me.

Andrea: For today’s discussion, we are going to zoom in on natural disasters and how they affect lawyers and their practices. Christopher, I’m sure you’ve worked with people who’ve faced a disaster before. And when you’ve worked with law firms that have been struck by inclement weather or another disaster, what is the number one regret you hear when lawyers and administrators return to work?

Christopher: Yeah, I think the number one regret comes from the mistaken assumption that a firm’s business continuity or disaster recovery plans adequately address the potential risks associated with a disaster. For instance, there’s a loss of data or inability to restore systems; downtime is longer than expected; there’s a failure to safeguard their data, which might not become relevant or apparent until later. And another item I like to mention, too, is that I think firms confuse business continuity and disaster recovery as the same thing, and they’re two separate things. Business recovery allows you to… or, I’m sorry, business continuity allows you to continue your business operations in the case of a disaster striking your firm. And then disaster recovery really will come in and help you recover any of those systems that are physically destroyed where you have to restore your data. So, one’s making sure you can continue to work in a disaster, like with COVID, right. Everyone still had access to the law firm’s systems. They just had to do it in a different way, right. And then disaster recovery would have, would be in a case like inclement weather, a hurricane, tornado, or fire destroying something.

Andrea: I would think that this kind of situation would be terrifying for any business. But for a lawyer, I think it would be especially difficult. What is a lawyer’s professional and ethical obligation to clients in the days, weeks, and months after a disaster?

Christopher: That is a great question. So, on September 19, 2018, I believe that was the date of the decision, the American Bar Association issued a formal ethics opinion 482, titled “Ethical Obligations Related to Disasters.” And after the ethics opinion was released, many state bar associations published their own articles identifying, you know, there’s this new formal ethics opinion out here. Here’s what it means. Here’s what it does. Here in Wisconsin, our ethics council authored “Disasters and a Lawyer’s Ethical Obligations.” And essentially, the major points of those ethics opinions are in five different category areas. So, communication to the clients–a direct quote from the opinion says, “To be able to reach clients following a disaster, lawyers should maintain or be able to create, on short notice, electronic or paper lists of current clients and their contact information. This information should be stored in a manner that’s easily accessible.” For loss of files, trust account records, and other client property, the opinion says, “To prevent the loss of files and other important records, including client files and trust account records, lawyers should maintain an electronic copy of important documentation.” And then the other areas deal with solicitation and advertising, making sure you’re not violating rules when you’re offering legal services in those areas; being able to continue to represent your clients. And they had a strong statement in there that says, “Lawyers who continue to provide legal services in the area affected by a disaster have the same ethical obligations to their clients as before the disaster.” And if lawyers are unable to render or, I’m sorry, unable to fulfill their ethical responsibilities to clients, they may be required to withdraw from those representations. So, you can see ABA formal opinion 482 represents, in my mind, what a paradigm shift is in that it used to be okay for firms to have paper files and to have some things stored electronically. But formal opinion 482 basically represents a shift in that thinking that lawyers should be able to continue to represent their clients in the case of a disaster striking. And if they can’t, then they must withdraw. And a lot of that comes down to having the ability to have your files electronically stored and access that and continue to provide the same continuity of services.

Andrea: I would think a lot of lawyers might underestimate how long it will take to get up and running, especially with so many people working from home right now. But should firms still be planning how to manage if they find themselves unable to practice for a period of time?

Christopher: Yes. So, firms have–as that formal ethics opinion stated–they have the same ethical responsibilities regardless of whether a disaster strikes. And disaster is one aspect of it. COVID has been another important aspect of this in that if someone is medically unable to provide services for a short term, lawyers have a duty under ABA rule 1.3 to act with reasonable diligence and promptness in representing a client. And comment 5 to that rule says, to prevent neglect of a client matter in the event of a sole practitioner’s death or disability, the attorney has an obligation to prepare a plan in conformity with applicable rules to make sure that they can continue those representations. So, many state bar associations have a registry for attorneys to register a successor or obtain succession planning resources and additionally business continuity and disaster recovery plans. And firms should test these plans. Getting a plan, having a plan, not testing or updating it is of no value to a company. And there may be… an important aspect of it, too, is you may be under specific client requirements to have a business continuity or disaster recovery. When I was in private practice prior to joining the State Bar, we represented several national banking association clients who required this as part of our representation to them, to have the ability to continue our operations or recover lost, or to recover data that was lost as a result of a disaster. So, it’s very important for firms to keep in mind.

Andrea: You also mentioned paper files. Are more firms storing files electronically these days? And is that giving lawyers a false sense of security? I would think that even if they’re electronic, they could still be in jeopardy. And what are the rules for paper documents and original documents that people haven’t had a chance to duplicate? I know, no matter how much lawyers intend to have everything electronic, we still really love our paper.

Christopher: Yes. So, COVID has had a substantial impact on the number of files being stored in the cloud. Most firms, in order to continue to operate, in several states that said attorneys were not essential–they were not even able to go into their office. So, that has definitely had an impact on folks converting to the cloud or looking… businesses taking a look and say, “You know what? We need to be able to operate remotely, and that might be our future for some time. Or maybe that’s what we want to do from a business sense because it’s cheaper to have our employees work remotely than it is to pay for big physical office space.” I don’t think it gives lawyers a false sense of security. Rather, instead, it provides more opportunities for hackers or data thieves. Brian Krebs on krebsonsecurity.com published some recent articles about phishing threats and discussed the Twitter compromise where apparently folks are using social engineering by calling law firms or using the fact that people are working remotely to say, “Hey, I’m from your firm’s IT provider,” or, “I’m in your firm’s IT department. I just sent you a LinkedIn invitation. We need to reset your password.” And then people giving them their actual password then to get access to the systems. Or people calling on the phone to say that they need certain things. So, there’s definitely, and you can see, unfortunately, the abundance of articles on ransomware impacting law firms. So, there’s several different opportunities. As it relates to what they’re required to do, there is an ABA formal ethics opinion 477 that discusses securing communications and protected client information dealing with cloud storage and cloud computing. And a lot of states have issued their own formal ethics opinion regarding cloud computing. And essentially, those opinions state that lawyers have a duty to understand the technology they use that access the cloud and use reasonable effort to adequately address the risks associated with cloud computing. And as it relates to loss of files, 482 comes into play–again ABA formal opinion 482 that says some lawyers located in the area affected by disaster may have their files destroyed. And lawyers who maintain only physical paper files are at higher risk of losing those files. And a lawyer’s responsibilities regarding these files vary depending on the nature of the stored documents and the status of their affected clients, whether it’s a current client or a former client or things of that nature. So, folks should really take a look at 482 and then drill down into their own state’s ethical rules to determine what their responsibilities are for former, current, or existing clients.

Andrea: What does the typical insurance policy cover? And do firms need to consider adding additional insurance if they live in an area that’s prone to hurricanes, tornadoes, floods, or blizzards?

Christopher: That’s a really tough question. So, each state has its own insurance laws regarding covered events and policy exclusions that can be based upon what the insurance provider provides. The best advice I can give to attorneys is not to assume something’s covered. For instance, many times, attorneys assume that a data breach will be covered by their malpractice insurance carrier, but that’s not always the case. I wrote an article, “Once Upon a Cyber Crime: Are You Covered?” published in Wisconsin Lawyer Magazine here in Wisconsin that kind of went through and outlined these different types of breaches or theft and then just showed where different coverages would come into play or coverages weren’t applicable. So, folks should have a conversation with their malpractice insurance carrier and their business insurance provider to assess the potential risks, identify existing coverages, and purchase insurance to safeguard against events that are not covered.

Andrea: You mentioned earlier the importance of planning. In your experience, with all of the lawyers and firms that you’re working with, do you think that firms are drafting written disaster recovery plans? Are they planning sufficiently? Or is this something that is kind of staying on the to-do list and not getting executed?

Christopher: So, prior to COVID, it was my experience that most firms, like a lot of the larger firms or firms that have clients that require this, would have those plans in place. But most of the other firms did not. So, when I started here at the State Bar a few years ago, I started actually providing Continuing Legal Education on the need for business continuity and disaster planning. And I think COVID helped firms focus on their business continuity plans, and then they started looking at disaster recovery as an afterthought to say, “Okay, well, maybe we should have this in place in case our business continuity plans are destroyed or something else happens.”

Andrea: For those who don’t have one prepared, what should these plans include?

Christopher: So, firms should absolutely have a written plan. That’s my recommendation. So, many state bar associations or malpractice insurance carriers provide sample written guides. Ready.gov offers different guides as well. These are free to download and use. The disaster recovery and their business continuity guides should include contact information for key staff; information regarding business and landlord and vendors that are critical to restoring and continuing operations; a process outlining job responsibilities and backup personnel; a map outlining different systems and services that need to be restored; and only sharing that plan with necessary personnel because a lot of this has critical information that if a hacker got ahold of, or someone trying to do a social engineering attack, could really exploit the vulnerabilities and information that’s in there. So, have a plan, have it in place, have trusted personnel know what they’re supposed to do, and then make sure that you coordinate with key staff as well.

Andrea: Are there certain essentials that every law office should have on hand, physically, in the actual office?

Christopher: I think the biggest thing for folks to have on hand as a physical item is some sort of waterproof and fireproof containers if they’re holding original documents. This will allow folks, if there is some sort of disaster, to go in and retrieve those documents, hopefully, if the fire isn’t lasting too long or it can’t be put out, or the container–the waterproof container doesn’t float away from the office. So, keep those things in mind. Store documents electronically, and that way, if there is a disaster, files can still be retrieved or recreated.

Andrea: Are there any other practical tips that you have for lawyers? I’ve heard that trying to take a hairdryer to a wet document is not a good idea. But folks might find themselves tempted to do just that. What would you recommend for folks who are finding wet pieces of paper, wet files? What should they do?

Christopher: So, if someone suffers a disaster like that in their office, they should immediately contact their business insurer. If the event is a covered event for insurance purposes, they’ll typically–the insurance company will cover the cost of having a company come in and salvage and restore what can be salvaged. Those are professionals. They know what do to, they know how it will work, and they can make an assessment of what can be done to salvage it. And then, those attorneys or firms might want to contact their malpractice insurance carrier to see if they have any other helpful advice or to be aware of, on the lookout for anything else.

Andrea: So, take a deep breath, and don’t try to engage in self-help because you might end up making it worse when it comes to repairing those actual items.

Christopher: Absolutely.

Andrea: Should firms have a crisis communication plan in place for communicating with support staff? And what additional considerations need to be taken when a firm has employees? I think a lot of our audience are solo and small practitioners. But if you’re a medium-sized firm without the same level of infrastructure as a large firm, are there different things you need to be thinking about?

Christopher: Yes, so you should definitely–every firm, regardless of size, should have some sort of business continuity, disaster recovery plan in place. The smaller you are, the easier it will be. Make sure you have some sort of successor attorney lined up in case you’re unable to continue practice, right. And then as far as notifying staff, key staff should be identified when the plans are being activated. So, for instance, as I said, you don’t want to share your higher-level plans with everyone because of the security risks that are posed with that, but you can tell your staff, “Listen, if there’s some sort of triggering event that happens, we have this web page devoted to you being able to go in and access whether you’re going to be able to work, how you’re going to be able to work, if you’re going to have to go to a remote data center. Or, if that’s unavailable, here is a voiceover internet protocol phone number that you can call into, which will have information on what you need to do.”

Andrea: Where can lawyers turn for help on these issues? Are state bars and local bars a good resource?

Christopher: Yes. So, for instance, my role at the State Bar of Wisconsin is the Law Practice Assistance Manager, and I provide confidential consultations that are included in the cost of member dues on the subject areas we discussed today. We also have an ethics council that provides guidance on the rules of professional conduct in Wisconsin. We also have a lawyer’s assistance program that helps address the mental anguish of disasters or ongoing wellness challenges. Many state bar associations have folks that provide these types of services. They’re a great resource, starting point for the discussion. In Wisconsin, these are confidential consultations. In many other states, they are too. And sometimes attorneys don’t even realize that they have access to those services. And it’s not just the state bar associations–local bar associations have services like this. And in addition, if people belong to specialty bar associations, they also have resources like this. So, talk to as many people as you can, take a look at the resources that you are already paying for as part of your membership dues, and reach out to those folks who are there to help you out.

Andrea: I think attorneys are so accustomed to being the problem-solvers in work and their personal lives that sometimes it can be hard to come forward and ask for advice and ask for help. But I would think when you’re dealing with a natural disaster or another disaster of that magnitude–I think another important reminder is that there’s no shame in asking for help.

Christopher: Absolutely. And most of the time, folks, when they call in, they will say, “Oh, I don’t mean to bother you, but I have a question about this.” Or they’ll call back again and say, “Oh, I don’t mean to follow up,” or things of that nature. “Is this something you would help out with?” And that’s what these services are designed to do. They’re designed to help attorneys, confidentially guide them through a process or something that’s challenging. And by reaching out and seeking help, it’s just like the example of the blow dryer on wet paper, right? Instead of trying to do it yourself and then calling and asking for help after the fact, call and ask for guidance ahead of time, and then you can get a clear picture of the path forward of what you should do.

Andrea: Well, this was great, and it’s been such an informative interview. Thank you again for joining us. And we will make sure to send attorneys your way and to your colleagues in the state bar world because these are incredible resources that more people should know about.

Christopher: Absolutely. Thank you. I really appreciate it.

Andrea: Thank you.