OCR Vendor Data Breach: What a Law Firm Does Next

When an OCR vendor reports a data breach, your firm does five things in order: confirm the notice is real, secure the account, work out which client documents were in it during the affected period, decide with the responsible lawyers who must be told, and write down every step. The vendor's notice starts your work. It does not finish it.

This post is a handling guide for the days after such a notice. It is not legal advice. Notification duties come from ethics rules, statutes, contracts and court orders that differ by jurisdiction and by matter, and the decisions belong to the firm's lawyers, its insurer and any counsel they bring in.

What should a firm do first when an OCR vendor reports a breach?

First, confirm the breach notice is real and tell the person at the firm responsible for incidents. Then secure the firm's account, preserve what the account shows, and send the vendor written questions. Do not delete documents in a hurry, and do not tell clients anything until you know what was in the account.

The first day, in order

1. Verify the notice. A message announcing a breach can itself be a phishing attempt. Do not click links in the message. Go to the vendor's site by typing the address, check its status or security page, and contact support through a channel you already had.
2. Tell the right person. The managing partner, general counsel or whoever the firm's incident plan names. If there is no plan, the most senior lawyer available.
3. Call the insurer. A cyber or malpractice policy may set conditions on prompt notice and on which outside advisers may be used. Read the policy or ask the broker before you hire anyone.
4. Secure the account. Change passwords, sign out other sessions if the tool allows it, and review who has access. If you sign in through another provider's account, review that account's security as well.
5. Preserve the account's contents list. Before changing anything else, capture the list of documents: names, upload dates, page counts, who uploaded them. Screenshots are enough if there is no export.
6. Pause new uploads. Route urgent conversions elsewhere until you understand the event.
7. Send written questions. See the list below.

Questions for the vendor

• What happened, and over what dates?
• Was customer document content reached, or only account details such as names and email addresses?
• Was our account among those affected? How do you know?
• Were original uploads, converted text, exports, logs or backups involved? Which?
• Was the data copied out, or only exposed?
• Was it encrypted where it was accessed, and were the keys affected?
• Were documents we had already deleted still in any affected system?
• Was a subprocessor involved?
• What have you done to contain it, and when will you report further?

Why not delete everything at once?

Deleting may destroy the only list of what was exposed, and it may conflict with a preservation duty if the breach leads to a claim. Capture first. Then decide about deletion with a lawyer, matter by matter.

ABA guidance supports acting promptly. ABA Formal Opinion 483, issued October 17, 2018 under the title "Lawyers' Obligations After an Electronic Data Breach or Cyberattack", concludes that lawyers "must employ reasonable efforts to monitor the technology and office resources connected to the internet, external data sources, and external vendors providing services relating to data". It is an advisory opinion on the Model Rules. Your state's rules and opinions govern.

Working out which client documents were in the vendor account

Work out which client documents were in the vendor account by matching three records: the account's own document list, the firm's matter files, and the memory and mailboxes of the people who uploaded. The goal is a table of documents by client and matter, with the dates each one sat in the account.

The vendor's notice will describe the breach in the vendor's terms: systems, dates, categories of data. Only the firm can translate that into "the Aldana medical records and the Brightwater production".

Call the event a cybersecurity incident in the log even if the vendor uses softer words. Breach notification clocks can start on personal data while you are still matching file names to matters. Client confidentiality is the reason each row names a client before anyone drafts a letter. Flag health details and account numbers in the sensitivity column the same afternoon.

Sources for the inventory

Build the table

For each document or batch, record: client, matter, a description, the upload date, the deletion date if any, whether the vendor says it fell in the affected systems and dates, and a sensitivity note. The sensitivity note drives everything later, so be specific.

Sealed material deserves its own check because the obligation runs to the court. The post on OCR for sealed records explains what should have been settled before such a file was uploaded, which is also what you will be asked about afterward.

Do not overlook output

The account held converted text and tables as well as scans. A spreadsheet export of a bank statement is easier to misuse than the image it came from. Count output as exposed wherever the original was, unless the vendor shows otherwise.

When the inventory cannot be completed

Sometimes the firm cannot say what was there. The account kept no history, staff have left, deleted items are untraceable. Record what you tried. Opinion 483 addresses this directly for client notice: if a lawyer "has made reasonable efforts to ascertain the extent of information affected by the breach but cannot do so, the client must be advised of that fact."

Does an OCR vendor breach trigger a duty to tell clients?

An OCR vendor breach can trigger a duty to tell clients, and whether it does turns on what was exposed. Under the ABA's reading of the Model Rules, notice to a current client is required when material client confidential information was, or probably was, accessed. Statutes, contracts and court orders may add separate duties.

There are four sources to check, and they do not move together.

1. Professional conduct rules

Opinion 483 states the test in its summary: "When a data breach occurs involving, or having a substantial likelihood of involving, material client information, lawyers have a duty to notify clients of the breach". It rests this on Model Rule 1.4, the duty to keep a client reasonably informed. The opinion also confirms that the breach need not be the lawyer's own. It describes an earlier opinion as holding that "notice must be given to clients if a breach of confidentiality was committed by or through a third-party computer vendor or other service provider."

On content, the opinion says the disclosure "must be sufficient to provide enough information for the client to make an informed decision as to what to do next, if anything."

For former clients, the opinion found no direct guidance in the Model Rules and declined to require notice as a matter of ethics, while pointing out that other law or agreements may require it.

Having taken care beforehand does not remove the duty. The comment to Model Rule 1.6 says unauthorized access "does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure." Opinion 483 contrasts that with notice: if the obligation to notify is triggered, "a lawyer must make the disclosure irrespective of what type of security efforts were implemented prior to the breach."

All of this describes the ABA's model. States adopt their own versions and issue their own opinions.

2. Breach notification statutes

Opinion 483 notes that "All fifty states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands have statutory breach notification laws." It adds that those statutes "require that private or governmental entities notify individuals of breaches involving loss or disclosure of personally identifiable information", and that such schemes can reach people "irrespective of the individual's relationship with the lawyer." Which statutes apply, and what each requires, is a job for counsel with the statutes open.

3. Contracts

Outside counsel guidelines, engagement letters and business associate agreements may contain their own notice clauses with their own clocks. Pull the agreement for every client in the inventory.

4. Court orders

A protective order may require a party to report unauthorized disclosure of designated material to the party that designated it. The post on OCR for documents under a protective order quotes one court's model clause. Read each order for matters in the inventory.

A worked example

Dunmore Legal, a fictional four-lawyer firm, learns that its converter suffered unauthorized access to stored customer files between March 3 and March 19. Its inventory shows three matters in the account during those dates.

The firm's lawyers make each call. The inventory is what lets them make it by matter instead of sending one vague letter to everyone.

Breach notice deadlines in an OCR vendor contract

An OCR vendor's contract sets how soon the vendor must tell you about a breach and what the notice must contain. The wording can be a fixed number of hours, a phrase such as "without undue delay", or nothing beyond what the law requires. That clause fixes when your own clocks can start.

Legal models show the range. The General Data Protection Regulation, where it applies, says in Article 33 that "The processor shall notify the controller without undue delay after becoming aware of a personal data breach." The HIPAA rule on notification by a business associate, 45 CFR 164.410, requires notice "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach." California's Civil Code section 1798.82 says a business that maintains computerized personal information it does not own "shall notify the owner or licensee of the information of the breach of the security of the data immediately following discovery", where the personal information was or is reasonably believed to have been acquired by an unauthorized person. Whether any of these reaches your vendor depends on facts and law this post does not assess. They show how widely the clocks vary.

Five things to read in the clause

1. The trigger. "After becoming aware" and "after confirming" can be weeks apart. A vendor may investigate for some time before it calls an event confirmed.
2. The definition. Does "security incident" cover any unauthorized access to customer content, or only events the vendor judges to be notifiable under a statute?
3. The time. A number is better than an adjective.
4. The content. Does the vendor commit to say what was affected, for which customers, over which dates?
5. The channel. Notice goes to the account's email address unless you have named another. Make sure that address is a monitored mailbox and not a former employee's.

After the breach: check performance

Compare the date the vendor says it became aware with the date it told you. If the contract set a period, note whether it was met. Also read the clauses on cooperation, costs and termination, and check whether the agreement lets a customer leave without penalty after a security incident. The post on clauses to read in an OCR vendor data processing agreement covers what to ask for before you sign the next one.

Why do deleted uploads shrink a vendor breach?

Deleted uploads shrink a vendor breach because an intruder can take only what is still stored. A document removed from the vendor's systems before the affected period needs no entry in your inventory. Short retention makes the inventory shorter, the notice letters fewer and the exposure smaller.

Compare two fictional solo lawyers using the same breached tool. One has converted client files for three years and never deleted any. Her inventory covers 140 matters, many closed, some for clients she can no longer reach. The other exports each job, checks it and deletes it the same week. His inventory covers the two matters that were open during the affected dates. They had the same vendor and the same intruder, and they face very different weeks.

Opinion 483 draws the connection for former clients, encouraging lawyers to follow a retention schedule "to reduce the amount of information relating to the representation of former clients that the lawyers retain."

Three limits on that comfort

• Backups. A document deleted from your list may persist in backups for a period. Ask the vendor whether backups were in the affected systems and how long deleted items stay in them.
• Timing. Deletion helps only if it came before the intrusion began. Compare your deletion dates with the vendor's stated window, and remember that the window may widen as the investigation proceeds.
• Other copies. Logs, support tickets with attachments and copies held by subprocessors are not removed by the delete button unless the vendor says so.

Encryption is sometimes offered as the reason a breach does not matter. It can be, if the stolen data was encrypted and the keys were safe. It is no help if the intruder came in through a working login. The post on encrypted OCR explains what encryption does not cover.

Setting periods so that documents leave on schedule, with a record that they did, is the subject of the post on OCR with data retention control. On any service, the practical habit is the same: export, verify, delete. Schema Law states for every plan that you can "Delete any document, at any time", and its pricing page lists no retention setting on any plan. Nothing is deleted automatically, so a document stays until you remove it. Use whatever delete control your tool gives you as part of closing each task. Do not wait for an incident.

A vendor incident log for the firm's records

A vendor incident log is the firm's dated record of what it learned, what it did and what it decided after a vendor's breach. Start it the hour the notice arrives. It supports client letters, insurer reports and any later inquiry, and it is how the firm shows that its response was reasonable.

Keep one log per incident. Have one person maintain it. Record facts and decisions with times, and attach documents instead of summarizing them.

Fields to keep

A sample entry

March 22, 9:40 a.m. Email from vendor support to the accounts mailbox reporting unauthorized access to file storage, March 3 to 19. Confirmed by signing in directly and reading the vendor's status page. Reported to R. Dunmore at 9:55. Passwords changed and two former staff removed from the account at 10:20. Document list captured as 14 screenshots, saved to the incident folder. Nine questions sent to vendor security contact at 11:05.

Who sees the log

The log will contain client names and frank assessments. Keep it with restricted access, and take advice early on how to preserve any privilege in the firm's own investigation.

Close the loop

End the log with what changed. That might be a shorter retention period, a rule that scans with identifiers are not uploaded without approval, a monitored address for vendor notices, or a move to another tool. If the firm keeps a written policy on outside tools, update it and tell the staff. Then review the vendor list for other services holding client documents and ask of each one the question this breach forced: if they wrote to us tomorrow, could we say what was in the account?