This article addresses an aspect of the law and rules governing attorney-client confidentiality: What—if any—information about client matters can lawyers share with their significant others?

The question was publicly presented most recently in Disciplinary Counsel v. Holmes and Kerr, Slip Op. No. 2018-Ohio-4308, a disciplinary case decided by the Supreme Court of Ohio (the “Holmes and Kerr” case). In our own practice, we have seen similar situations at other law firms. In addition, there have been other reported cases involving outcomes even more serious than professional discipline. These situations may not be commonplace, but, for all sorts of reasons, lawyers face the temptation every day to tell their loved ones and immediate family about the matters on which they are working. This article will highlight the ethical and legal issues that arise when lawyers actually do divulge client secrets in these circumstances, often inadvertently, as well as the obligations of law firms to report the matter to their clients and to the disciplinary authorities when they discover that an improper communication has occurred.

The facts of the Holmes and Kerr case were described by the Supreme Court of Ohio, based on admissions by the lawyers, as follows: at the time the two lawyers commenced what the court referred to as a “personal relationship,”

“they each primarily represented public school districts in their respective law practices. Between January 2015 and November 2016, they exchanged more than a dozen e-mails in which they revealed client information to each other, including information protected by the work-product doctrine or the attorney-client privilege, although they were not employed by the same law firm and did not jointly represent any clients. In general, Kerr forwarded to Holmes e-mails from her clients requesting legal documents. In response, Holmes forwarded to Kerr e-mails that he had exchanged with his clients which included similar documents he had prepared for them. Holmes and Kerr stipulated that in about one-third of these email exchanges, Holmes had ultimately completed Kerr's work for her.”

When Holmes's law firm discovered that he had disclosed confidential client information to Kerr, he was removed from the firm, a partner filed a grievance against him, and the law firm's counsel notified Kerr's employer of the e-mail exchanges. Kerr consequently admitted to the partners of her firm that she and Holmes had exchanged client information and that he had assisted her with her work. Despite the disciplinary investigation, Kerr continued to send confidential client information to Holmes and he continued to assist her in preparing legal documents for her clients. Subsequently, Kerr resigned from her law firm.

The disciplinary authorities and the two lawyers agreed that the lawyers had violated Ohio's version of New York's Rules of Professional Conduct (RPC's) 1.6(a) (in New York's version, prohibiting a lawyer from revealing a client's confidential information), and 8.4(h) (prohibiting a lawyer from engaging in conduct that adversely reflects on the lawyer's fitness to practice law). As aggravating factors, the parties agreed that Holmes and Kerr each engaged in a pattern of misconduct.

Because there was no evidence that Holmes's and Kerr's misconduct had harmed their clients and because of their prior clean disciplinary records, the disciplinary tribunal recommended and the court determined that an actual suspension was not warranted, and the court therefore ordered that the lawyers be suspended from the practice of law for six months, but with the suspension stayed on the condition that they engage in no further misconduct.

It is important to recognize that the loss of employment or place at a law firm, and a stayed suspension are by no means the only possible consequences of such conduct. For instance, it was reported in Law 360 (July 12, 2017) that a Massachusetts Institute of Technology scientist was arrested for insider trading based on inside information received from his wife, an associate at a global law firm, who had knowledge of an impending transaction concerning one of the firm's clients. The criminal complaint stated that the scientist loaded up on options in the law firm's client when this came to light, the law firm reportedly suspended the associate pending further investigation.

Keeping clients' information safe is one of a lawyer's primary obligations, based on the law of fiduciary duty as well as the applicable ethical rules. Notable in the Holmes and Kerr case is that the revelations did not just involve conversations, hypothetical (which arguably do not violate Rule 1.6 provided that the disclosing lawyer takes care to insure that the listener is not able to deduce the identity of the disclosing lawyer's client) or otherwise. Rather, here Kerr regularly emailed confidential documents to Holmes for his review which were from then on stored in his personal and business email accounts, outside the confidential network of Kerr's law firm. Accordingly, although not addressed in the case, this demonstrated a failure to behave in a way consistent with the requirement of Rule 1.1 to act in a technologically competent manner.

Turning to the obligations of law firms faced with such situations, three elements of the RPC's are directly implicated: Rule 1.4 (the duty to keep clients informed of the progress of their matters); Rule 8.3 (the duty to report misconduct the relevant authorities); and Rule 5.1 (the duty of supervision). New York's Rule 1.4 provides in pertinent part that

(a) A lawyer shall:

(1) promptly inform the client of: … (iii) material developments in the matter including settlement or plea offers. … (3) keep the client reasonably informed about the status of the matter;

Law firms will need to consider carefully in every case whether the unconsented to release to third parties unconnected with the representation of client material confidential information falls within these parameters, and must be promptly reported to the affected clients.

More troubling to many lawyers are the obligations imposed by Rule 8.3 (Reporting Professional Misconduct):

(a) A lawyer who knows that another lawyer has committed a violation of the Rules of Professional Conduct that raises a substantial question as to that lawyer's honesty, trustworthiness or fitness as a lawyer shall report such knowledge to a tribunal or other authority empowered to investigate or act upon such violation. … (c) This Rule does not require disclosure of:

(1) information otherwise protected by Rule 1.6;

Two issues arise from this Rule. First, does the conduct rise (or sink) to the level “that raises a substantial question as to that lawyer's honesty, trustworthiness or fitness as a lawyer.” This will be a question for the law firm whose client's confidences have been improperly revealed to determine in each instance. A lawyer's (and law firm's) duties of competence and confidentiality are important obligations that clients rely on when they seek a lawyer's advice. In the Holmes and Kerr case the Ohio Supreme Court took particular notice of the fact that the conduct was not a single isolated instance, but occurred over an extended period of time and involved numerous clients' confidences. In such situations, it would be hard to argue that the reporting obligation has not been triggered.

But this still leaves open the question whether the duty to report is subject to client consent. Comment 2 to the New York RPC's resolves this as follows: “A report about misconduct is not required where it would result in a violation of Rule 1.6. However, a lawyer should encourage a client to consent to disclosure where prosecution would not substantially prejudice the client's interests.” This means that the firm must advise the client of the conduct at issue, that the firm believes it has a duty to report the issue, that it cannot do so without the client's consent, and counsel the client with respect to any prejudice, actual or potential, to the client that could result from reporting. The firm should make a record of having done so and obtain any consent in writing.

If a client has indicated that it does not want the firm to report the conduct, and the firm reports in a disguised fashion, using redacted documents and disguising the identity of the client, it nevertheless runs the risk that the identity of the client and other details may become known. This would be a particularly egregious result for the client after it has advised the firm that it will not consent to disclosure. Accordingly, even if this approach is being considered, the client needs to be advised of the possibility of disclosure as described above to ascertain whether the client considers this a suitable compromise. Again, any discussion on this issue should be carefully documented, and the client must consent in writing.

The problem of managing client confidential information, and managing the lawyers and support staff in a law firm, adds a significant dimension to the problems exemplified in the Holmes and Kerr matter and in other similar situations. Rule 5.1 requires lawyers, and in New York, law firms to “make reasonable efforts to ensure that all lawyers in the firm conform to these Rules.” And Rule 5.3 requires that “(a) A law firm shall ensure that the work of nonlawyers who work for the firm is adequately supervised, as appropriate.” (emphasis added).

What therefore do law firms need to do to try to prevent these situations from arising in the first place? For instance, even if a firm has very strong security protocols on the communication of client documents outside its network, for instance prohibiting lawyers from sending documents to personal email accounts, how can the firm police and prevent lawyers from sending documents to their spouses or significant others even if the purpose is merely to print the documents at the lawyer's home? Obviously, lawyers' actions—perhaps for apparently innocuous reasons—to avoid such prohibitions cannot be prevented by technology alone.

What is left is training. To avoid accusations that the firm has violated Rules 5.1 or 5.3 in these situations, firms may think it worthwhile to redouble their efforts to educate their lawyers and staff on an ongoing basis of the significance and meaning of Rule 1.6 and the duty to preserve clients' confidential information. That this knowledge and awareness is not always present is apparent from the reports of the situation President Trump's then attorney Ty Cobb found himself in last year. As was widely reported, “Cobb sat outside at a Washington, D.C., restaurant and discussed the White House's response to the Russian investigation with another lawyer for the President. Unbeknownst to him, a reporter for the New York Times sat at the next table taking notes on everything they said.” Ryan Podges, “Loose Lips Sink Ships: Keeping Clients' Confidences Outside of Work,” ABA (Dec. 20, 2017). As the ABA's commentator noted: “This may seem like a rare occurrence and an obvious lack of judgment by Cobb, but lawyers put themselves at risk of revealing their clients' confidential information every day.” Id. Law firms may wish to review whether, in their CLE programs, they need to go back to basics on a regular basis.

Anthony E. Davis is a partner of Hinshaw & Culbertson and a past president of the Association of Professional Responsibility Lawyers. Janis M. Meyer is a partner of the firm and a Special Professor of Law at the Hofstra University Maurice A. Deane School of Law.