Why your firm should stop collecting client documents over email

Collecting client documents over email is the default at most small firms, and almost nobody chose it. It happened because email was already open, the client already knew how to use it, and the first attachment arrived before anyone had decided on a process. Ten years later the firm has no process, it has a habit.

The habit is worth looking at directly, because the risk it carries is not the one people assume. The danger is rarely an attacker reading a message in flight. It is that email makes copies, spreads them, and then keeps them forever in places nobody is tracking.

One file, eleven places

Think about where a single PDF ends up when a client emails it to a paralegal.

It is in the client’s sent folder. It is in their phone’s mail app, cached locally. It is on your mail server, and in the paralegal’s inbox, and in their local cache too. The paralegal forwards it to the associate, so now it is in a second sent folder and a second inbox. Somebody saves a copy to the desktop to open it, and that copy stays. Somebody else replies-all with a question and the file rides along on the reply. Your backup captures all of it, several times, and retains it for whatever period your backup policy says, which at a small firm is often “forever, nobody checked”.

That is one document. A moderately active matter generates forty.

None of those copies are wrong, exactly. Each was made for a sensible reason at the time. But the firm now has no answer to a question it may one day be asked: where is this client’s information, and who has been able to see it? The honest answer is that nobody knows, and finding out would take a week.

A portal answers that question by construction. The file exists once. Access is a permission rather than a copy, so revoking it actually revokes it. If you want to see the shape of this in practice, who can see a document walks through how access is decided on a single file, and access control and permissions covers the firm-wide settings behind it.

The wrong address problem

The second failure is more common than interception and considerably more embarrassing: the file goes to the wrong person.

Autocomplete is the usual culprit. Two clients share a first name, the mail client offers the wrong one, and the message is gone before anyone reads the header. Reply-all does the rest. Every firm has at least one story like this, and the ones that do not have a story simply have not noticed yet.

There is no undo. Once a message leaves your server it is in somebody else’s mailbox, and a recall request is a polite suggestion, not a mechanism. The only genuine protection is not putting the document in the message in the first place. When the file lives in a portal and the client is invited to it, a misdirected invitation gives the wrong person a login screen they cannot get past, not a client’s bank statements.

Your obligations, in general terms

Rules of professional conduct in the United States generally require a lawyer to make reasonable efforts to prevent unauthorised disclosure of information relating to a client, and to understand the risks and benefits of the technology they use. Most state bars have said something about electronic communication specifically. What counts as reasonable depends on the sensitivity of the information, the cost and difficulty of safeguards, and how much a safeguard would get in the way of the work.

Read that standard carefully and it is not a ban on email. It is a proportionality test. The question it puts to you is whether a reasonable safeguard was available, affordable and practical, and whether you used it.

That is the part that has changed. Ten years ago, “the client would never manage a portal” was a real answer. It is much weaker now. Your clients bank on their phones and sign mortgage papers online. A portal is not exotic any more, and a firm that keeps taking Social Security numbers as email attachments is making a choice it will have to explain.

This is a general description of a general duty, not advice about your obligations. Your own state bar’s rules and opinions are the ones that bind you, and they are worth reading directly.

“We use encrypted email”

Worth being precise here, because the phrase covers three different things.

Transport encryption, meaning TLS between mail servers, is nearly universal now and does protect the message in flight. It does nothing about the eleven copies, and nothing about the wrong recipient. It is table stakes, not a safeguard you get to point at.

Encrypted attachments, meaning a password-protected zip or PDF, protect the file if the message goes astray, provided the password was not sent in the next email. It usually was. And the client has to open it, which is where half of them phone you instead.

Secure message portals bolted onto email genuinely do help, and they work by being a portal. The client gets a notification, follows a link, and authenticates. That is the model in this article, arriving through the mail system instead of beside it.

So if encrypted email means the first of those, you have less than you think. If it means the third, you already agree with the argument and it is just a question of where the front door is.

What to do instead

The change is smaller than it sounds. Firms that do it well tend to follow the same rough order.

Pick one workflow to move first, usually new-client intake, because it has a clean start and no legacy thread to untangle. Set up your folders and document types before you invite anybody, so the first file lands somewhere sensible rather than in a general pile. Organizing with folders and document rules and types cover that setup.

Then invite clients as they come, not all at once. Inviting clients and team members is the mechanical part, and it is a two-minute job per client. The thing that determines whether they use it is not the software, it is the sentence you send with the invitation. “Please upload your documents here, it saves us both a round of emails” works better than an explanation of security.

Finally, close the old door. This is the step firms skip, and skipping it means running both systems forever. Once a client is on the portal, replies to document requests should say “it is in the portal” rather than quietly accepting the attachment. Two or three of those and the habit changes.

Where to start this week

Open your sent folder and search for the last attachment you sent a client. Count the copies of that file you can account for, then count the ones you cannot. That number is the argument, and it is more persuasive than anything in this article.

What your client actually opens covers the other half of this: the screen they are sent to, and the things they cannot reach from it. If you would like to see it with your own documents in it, get in touch — we set the firm up, and we will walk through it with you while you put the first one in.