Lost Thumbdrive Raises Handful of Questions


I recently took a trip out of state and took a thumb drive containing client information (including names, DOBs and POSSIBLY social security numbers) which I somehow lost in the airport. As a new attorney, how do I rectify this in accordance with the rules of professional responsibility and hopefully avoid a potential malpractice claim?


This is really not at LCL question, but it seemed a reasonable question to direct to our sister program, LOMAP.  Heidi Alexander, the director of that program, was kind enough to provide the following response:

Your question raises both ethical and statutory concerns. Under Rule 1.6, you have a duty to maintain the confidentiality of your client’s information. As expounded by the comments to the Rule, a lawyer must make “reasonable efforts to prevent the access or disclosure” of confidential client information. (See Comment 18, Rule 1.6.)  There are a number of factors considered in determining the “reasonableness of the lawyers efforts” including the sensitivity of the information. This brings leads to the other concern.

Massachusetts has one of the most stringent data privacy regimes in the entire country with reporting requirements in the event of a data breach to the Office of Consumer Affairs and Business Regulation and to the Attorney General. This webpage details the reporting requirements under M.G.L. c. 93H. Under the statute and implementing regulations (201 CMR 17.00), if you store “personal information” (which includes names and Social Security numbers) on a portable device, that device should be encrypted where it is reasonable and technically feasible. If you did not encrypt the contents of your thumb drive, you may be required to report the breach.

We would suggest consulting with an attorney to analyze your situation and determine 1) whether this is a reportable event, and 2) how best to minimize your ethical and malpractice exposure.

If you would like to discuss further, our Law Office Management Assistance Program can consult with you confidentially about this issue. Please contact LOMAP Director, Heidi Alexander, heidi@masslomap.org or 857-383-3250.

preload preload preload