A law firm with regulated clients inherits security obligations from those clients, even when no rule names law firms directly. Healthcare clients bring HIPAA business associate duties when the work involves protected health information (PHI), financial services clients bring vendor security terms, and government contractors bring controlled unclassified information (CUI). This law firm cybersecurity guide sets out where each obligation comes from and what it asks of a firm’s email and file sharing.

Why do regulated clients pass security obligations to their law firms?

Regulated clients pass security obligations to outside counsel because their own rules make them answerable for what their vendors do with regulated data. HIPAA, New York’s cybersecurity regulation and federal CUI rules each reach past the regulated organization to the people it shares data with, and a law firm reviewing records or contracts is one of those people.

Diagram showing four client types and the obligation each passes to a law firm: healthcare clients a BAA when the work involves PHI, DFS-regulated clients a third-party service provider policy under 23 NYCRR 500.11(b), corporate clients outside counsel guidelines, and defense or federal clients CUI handling terms under 32 CFR 2002.14(c), all landing on the firm's email and file sharing.

In the ABA 2023 Cybersecurity TechReport, 27% of respondents had been asked by clients for the firm’s security requirements document or guidelines, rising to 41% at firms with 10 to 49 lawyers and 59% at firms with 50 to 99 lawyers. 22% said a client or potential client had asked the firm to complete a security questionnaire.

When is a law firm a HIPAA business associate?

A law firm is a HIPAA business associate when it provides legal services to a covered entity (a health plan, healthcare provider or healthcare clearinghouse) and the work involves PHI. The HIPAA definition of business associate lists legal services by name, and HHS gives the example of an “Attorney whose legal services to a health plan involve access to PHI.” Firm size does not change that status.

The definition at 45 CFR 160.103 covers a person who provides “legal, actuarial, accounting, consulting” and other services to or for a covered entity where the service involves PHI. Before sharing PHI, the covered entity must obtain “satisfactory assurance that the business associate will appropriately safeguard the information” (45 CFR 164.502(e)(1)(i)), documented in a business associate agreement (BAA) that meets 45 CFR 164.504(e).

Business associate status also carries direct liability, and HHS lists “Failure to comply with the requirements of the Security Rule” among the provisions business associates are directly liable for. That brings in the Security Rule’s technical safeguards for electronic PHI (ePHI): audit controls at 164.312(b) are a required standard, while encryption at 164.312(a)(2)(iv) and 164.312(e)(2)(ii) is addressable, meaning the firm must adopt it where reasonable and appropriate or document why it chose an equivalent measure. The detail is in HIPAA for law firms: business associate agreements, subcontractors and your email vendor.

Does NYDFS Part 500 apply to law firms?

NYDFS Part 500, the New York Department of Financial Services cybersecurity regulation, does not name law firms and does not regulate them directly. It regulates covered entities, such as New York-licensed insurers and financial services companies. Those clients must keep a written policy for third-party service providers, and outside counsel with access to the client’s nonpublic information fits the regulation’s definition of one.

Part 500 defines a third-party service provider as a person that is not an affiliate, is not a governmental entity, “provides services to the covered entity” and “maintains, processes or otherwise is permitted access to nonpublic information” (23 NYCRR 500.1(s)). Section 500.11(a) requires each covered entity to “implement written policies and procedures designed to ensure the security of information systems and nonpublic information that are accessible to, or held by, third-party service providers.”

Section 500.11(b) says those policies “shall include relevant guidelines for due diligence and/or contractual protections relating to third-party service providers including to the extent applicable guidelines addressing” multi-factor authentication “as required by section 500.12” and encryption “as required by section 500.15 to protect nonpublic information in transit and at rest.” In practice, DFS-regulated clients set MFA and encryption expectations for vendors, including outside counsel with access to nonpublic information. The duty runs through the client and its contract with the firm.

What do outside counsel guidelines and security questionnaires usually ask?

Outside counsel guidelines and client security questionnaires usually ask how the firm encrypts client data in transit and at rest, who can access it, whether multi-factor authentication is in place, how activity is logged, which vendors can reach the data and how quickly the firm will report an incident. Outside counsel guidelines are the written terms a client sets for the firms it hires, and they turn the client’s internal security standard into contract terms.

The Association of Corporate Counsel’s March 2017 model controls for outside counsel cover data handling and encryption, data breach reporting, physical security, employee background screening and cyber liability insurance, according to its announcement. The model text asks outside counsel to encrypt company confidential information in transit and at rest (sections 3.1.1 and 3.1.2), to use “two-factor or stronger authentication for its employee remote access systems” (section 5), and to report a suspected or actual breach within 24 hours of discovering it (section 3.2).

What does CUI in client files require of a law firm?

CUI in client files requires a law firm to follow the handling terms that come with it. CUI is information a law, regulation or government-wide policy requires or permits an agency to protect. A firm that reviews or negotiates government contracts for clients often receives it, and the obligation reaches the firm through agreements and contract terms.

The CUI program rule at 32 CFR Part 2002 requires that “Authorized holders must take reasonable precautions to guard against unauthorized disclosure of CUI” (2002.14(c)) and points to NIST SP 800-171 for protecting CUI on non-federal systems (2002.14(h)(2)). Defense and federal clients often share CUI with outside counsel, and their contracts may require the firm to protect it. CUI from your clients covers the details.

What do ABA Formal Opinions 477R and 483 add?

ABA Formal Opinions 477R and 483 apply the Model Rules to a firm’s technology. Opinion 477R says a lawyer may need special security precautions when a client agreement or the law requires them, or when the information is sensitive. Opinion 483 adds duties to monitor systems and vendors and to notify clients after a breach.

Model Rule 1.6(c) requires a lawyer to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” Comment [8] to Rule 1.1 says competence includes keeping abreast of “the benefits and risks associated with relevant technology.” Opinion 477R connects the two: “a lawyer may be required to take special security precautions to protect against the inadvertent or unauthorized disclosure of client information when required by an agreement with the client or by law, or when the nature of the information requires a higher degree of security.” A client’s BAA, vendor policy or guidelines can be that agreement.

How do the requirements map to email and file sharing?

Each client obligation lands on the same few email and file controls: encryption of client data in transit and at rest, access limited to authorized people, activity logs, and vendor terms such as a BAA. The table lists each requirement, its citation, whether it is required, and where PreVeil supports it.

RequirementCitationRequired or expectedHow PreVeil supports it
Business associate safeguards for ePHI45 CFR 160.103; 164.502(e); 164.504(e)Required when the work involves PHIPreVeil signs a BAA with law firms when the work involves PHI
Audit controls45 CFR 164.312(b)Required standardActivity logs in the PreVeil admin console (Business plan)
Encryption of ePHI45 CFR 164.312(a)(2)(iv), (e)(2)(ii)AddressableMessage contents and attachments, and files, encrypted end to end
Vendor MFA and encryption guidelines23 NYCRR 500.11(b)Set by the DFS-regulated client, to the extent applicableEncryption in transit and at rest; keys held on user devices
Reasonable precautions for CUI32 CFR 2002.14(c)Required by agreement or contractEnd-to-end encryption with FIPS 140-3 validated cryptographic modules
Reasonable efforts to protect client informationABA Model Rule 1.6(c); Op. 477REthical dutyEncrypted email inside Outlook, Gmail and Apple Mail
Monitoring and client notice after a breachABA Op. 483Ethical dutyActivity logs for the firm’s review

Where does PreVeil fit, and where does the firm’s own program take over?

PreVeil fits where client data leaves the firm, which for most firms means email and shared files. It encrypts message contents and attachments end to end inside Outlook, Gmail and Apple Mail, and encrypts files shared through PreVeil Drive. The firm’s program still covers policies, training, devices, incident response and the rest of what a client’s terms ask for.

PreVeil cannot access or decrypt customer data, because the encryption keys stay on users’ devices. Clients read and reply for free from their browser, and replies stay encrypted.

See PreVeil for law firms for more details.

Law firm cybersecurity: frequently asked questions

Does HIPAA apply to a small law firm?

HIPAA applies to a law firm of any size when the firm provides legal services to a covered entity or business associate and the work involves protected health information (PHI). The firm is then a business associate under 45 CFR 160.103, needs a BAA under 45 CFR 164.502(e), and is directly liable for Security Rule compliance.

Does NYDFS Part 500 name law firms?

No. Part 500 regulates DFS covered entities. Those clients must keep written policies for third-party service providers under 23 NYCRR 500.11, and outside counsel with access to nonpublic information meets the definition in 500.1(s), so the requirements reach the firm through the client.

Do law firms have to encrypt email?

No rule covered here requires every law firm to encrypt all email. ABA Opinion 477R says strong measures like encryption are warranted in some circumstances, and client agreements, BAAs and vendor policies often ask for encryption of the client’s data.

What is CUI and why would a law firm have it?

Controlled unclassified information (CUI) is government information that a law, regulation or government-wide policy requires or permits agencies to protect (32 CFR 2002.4). Firms that review or negotiate government contracts for clients often receive it in email and files.

Can PreVeil read a law firm’s email?

No. PreVeil generates and keeps encryption keys on users’ devices, so its servers cannot decrypt message contents, attachments or files.

Sources

Talk to PreVeil about your clients’ requirements

If a client has sent a BAA, outside counsel guidelines or a security questionnaire, a demo is enough to see how PreVeil answers the email and file-sharing questions. Request a demo