When I began my practice, working with lawyers and law firms on professional liability, ethics, and risk management issues, I would sometimes hear from lawyers who had experienced a disaster, like their basement had flooded, destroying all of their old client files.
Years later, a lawyer friend working for a large firm in New Orleans was suddenly displaced from her office and home after Hurricane Katrina struck and submerged the city. The entire firm was suddenly dispersed across the country, with clients still in need of representation.
As technology advanced, law firm disasters more frequently came in the form of computer system crashes, caused by viruses, malware, and most recently, ransomware – by which a cyber-criminal hacks into a computer network and shuts it down until the firm pays a substantial “fee” to have its system restored to functionality. One colleague was told, “It sure would be a shame if something happened to your nice time and billing system.”
Now we have the coronavirus/COVID-19 pandemic shutting down great swaths of the world’s economy and forcing lawyers to immediately transition to working remotely, relying entirely on technology to allow their necessary work to continue.
While the possible disaster scenarios grow, one thing remains constant for lawyers and firms: the need to prepare for disaster in advance. Without effective disaster planning, lawyers run the very real risk of being unable to meet critical client needs, missing important deadlines, losing key financial information, incurring staggering reconstruction costs, losing clients, and increasing the risk of malpractice claims.
CREATE A DISASTER PLAN
The most important step in preparing for disaster is to carefully consider possible ways in which your practice can be affected by pandemic, natural, or technological disasters. Disaster planning is not just for large law firms; even the smallest practice needs to have a plan in place for getting back in business effectively and as soon as possible, while minimizing expense and loss of critical data.
There are two elements in this process: (1) business continuity (continuing operations after a disaster occurs); and (2) disaster planning (being able to restore necessary technology, working space, and other factors required to provide effective client services).
One issue that has arisen in the current pandemic and must be considered in any law firm’s disaster plan, concerns online videoconferencing. This capability has been a lifesaver for firms. While all businesses need to protect the confidentiality of their internal communications, lawyers have an additional ethical obligation to protect their clients’ confidences and communications from disclosure to third parties. When selecting a videoconferencing application, lawyers must be particularly careful to choose one that best assures such confidentiality. As technologies evolve, so too must firms’ disaster plans, so the best and safest applications and off-site data storage are used.
The disaster planning process can be daunting but there are, fortunately, many resources available to help lawyers, often for free. Your state bar association likely provides detailed information online about disaster planning. The American Bar Association provides a wealth of helpful information on how to plan for disaster.
Involve all parts of the firm in the planning process since each has its own expertise in identifying possible issues and solutions. Once an initial plan is created, have your most experienced staff and key outside vendors review the plan to make sure it is complete. If parties outside the firm are involved in this review, use a strong confidentiality agreement with them to assure that proprietary information of the firm is protected. Regular testing of the plan in a mock emergency, and evaluating how it functions, will strengthen your plan.
EVALUATE YOUR INSURANCE COVERAGES
Law firms have long maintained insurance to protect against the effects of disasters, such as malpractice, general liability, property, and employment liability coverages.
In the age of cyber-crime and ever-expanding reliance on technology, cyber security insurance should also be considered. Loss of use of one’s computer system, or a security breach causing dissemination of client confidences, can have a devastating effect on law firms.
Business interruption coverage should also be considered. While it may contain exclusions from certain causes of business interruption, when applicable, it may provide an important safety net to help keep your practice afloat.
While it takes time and effort to develop a disaster plan, it is time well spent and will make recovery from the next disaster quicker, more effective, and less expensive.
