Tag: Risk Management

Frivolous Lawsuit Leads to Serious Damages

Many attorneys will encounter a lawsuit they believe to be potentially frivolous at one point or another. These claims often lead to frustration for the defense attorney and Client, who may face two complex alternatives: (a) settle the case to avoid defense costs or (b) expend time and money in defending a meritless claim. A recent case out of Pennsylvania may give some hope to those forced to defend weak claims and might give pause to anyone considering such a suit in the future.

A jury in Philadelphia County recently awarded approximately $2.3 million in damages in a frivolous litigation matter. Plaintiff alleged that the defendant’s attorney and law firm commenced and pursued a frivolous claim designed to extort money. Defendant Attorney represented Client in a bitter amongst Client’s family over nearly $1 million in stocks. Client, through Defendant Attorney, alleged that Client’s aunt was mentally incompetent and that Client’s brother-in-law (“Plaintiff”) was unduly influencing the aunt to take advantage of the stock windfall. That suit was dismissed with prejudice in 2013.

Subsequently, the brother-in-law (an attorney) filed a claim against the defendant’s attorney, alleging that the undue influence suit was commenced to pressure the family into a financial settlement by threatening his reputation within the legal community. The jury agreed with Plaintiff’s allegations and awarded approximately $2.3 million in damages, roughly $1.9 million attributed to Defendant Firm.

Though the threat or implication of a potential lawsuit is a widespread and predictable settlement and negotiation tactic, following through with such a lawsuit where the claim itself is not solvent creates the instant potential for retribution by way of a counter-suit based upon frivolity or vexatious litigation. Instances such as this serve as yet another reminder that those in the legal profession need to take care and exercise only the best and most prudent judgment when accepting and pursuing cases on behalf of clients, lest the potential for recovery becomes a potential for loss.

Cyber Security Best Practices

Law firms are the same as any other company in countering cyber attacks and protecting their confidential and proprietary data. The only difference is that law firms have ethical rules that require confidentiality of attorney-client and work product data. That does not make them unique, however, because accounting firms, engineers, and medical providers also have privileged data.

Some essential activities must be undertaken to establish a security program, no matter which best practice a firm decides to follow. Technical staff will manage most of these activities, but firm partners and staff must provide critical input. Firm management must define security roles and responsibilities, develop top-level policies and exercise oversight. This means reviewing findings from necessary activities, receiving regular reports on intrusions, system usage, compliance with policies and procedures, and reviewing the security plans and budget.

• Set the “tone from the top” and issue high-level policies regarding the privacy and security of firm data. This includes encryption, remote access, mobile devices, thumb drives, laptops, Wi-Fi “hotspots,” clouds, Web email accounts, and social networking sites.
• Inventory the firm’s software systems and data, assigning ownership and risk categorizing. Client data may need to be organized; not all clients are equal. Extremely sensitive matters have the highest risk and could cause the most significant magnitude of harm if breached. Firms may want to keep this data on a separate server with stronger security protections and access controls.
• Conduct third-party vulnerability scans, penetration tests, and malware scans. Antivirus software is essential, but it detects only a small percentage of new malware. Specialized services that see sophisticated attacks may be required.
• Deploy needed security technologies for encryption, intrusion prevention, detection, monitoring, security event management, etc.
• Identify and document security controls.
• Develop security policies and procedures to support the security plan and technologies.
• Develop contractual security requirements for outsourcing vendors, cloud providers, or other entities that connect to the firm’s network, including notification in the event of a breach.
• Conduct regular reviews of the security program and update as necessary.

Like any other business, law firms are subject to breach notification laws, and many have pre-breach security program requirements. A firm will be in a far superior position with its clients, its state bar, and any regulators that may become involved if it can show that (1) its security program is aligned with best practices, (2) its management is engaged, (3) it is complying with its policies and procedures, and (4) tools are deployed to detect malware and criminal behavior.

RESPONDING TO AN INCIDENT

Having a well-rehearsed incident response plan is critical. It must specify who will be notified, within what time frame, what documentation must be kept, who is designated to speak about the incident, and who has the authority to make certain decisions about the investigation. Serious incidents require specialized assistance from cyber forensic experts and careful documentation to preserve evidence. Even if the event did not trigger a breach of law, a law firm’s decision to cover up an incident could be a dangerous strategy.

ETHICAL CONSIDERATIONS

New commentary to Rule 1.1 of the Model Rules of Professional Conduct requires attorneys to “keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.” Model Rule 1.6(c), on the confidentiality of client communications, acknowledges that disclosures can happen by providing: (c) A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.

Commentary on the Rule notes that [18] Paragraph (c) requires a lawyer to act competently to safeguard information relating to the representation of a client against unauthorized access by third parties and inadvertent or unauthorized disclosure.

Thus, Rules 1.1 and 1.6 may allow a law firm to avoid an ethics violation stemming from a breach if it has acted competently (e.g., having a strong security program) to protect its client data from disclosure.

Accordingly, a strong security program may help shield a firm from an ethics violation caused by not appropriately protecting client data, and it may help them beat a negligence charge. Still, it does not impact the Rule’s requirement to inform clients of security incidents. A good security program does, however, reduce the likelihood that such a painful conversation will have to take place. Altogether, it is clear that an up-to-date security program is the best defense that a law firm can have. Whether large or small, taking measures to establish a strong security posture is not only the right thing to do, it’s the ethical thing to do. It may help save the firm cases, clients, and reputation.

Partnership by Representation Concerns

It is not uncommon for attorneys to join forces to defray costs, and this often means sharing office space, support staff, and equipment. Some attorneys take this further, advertising themselves as a partnership even if their practices remain separate. Such arrangements should be made with caution, as they may lead to vicarious liability among the so-called partners.

A New Jersey federal court recently addressed such a scenario for the first time, holding that the plaintiff in a malpractice case failed to support a claim of partnership-by-representation due to lack of reliance. In this case, a husband and wife were both attorneys who operated from the same space and used letterhead advertising them as partners. However, no formal partnership agreement existed, they did not share profits and losses, and separate accounts and tax returns were filed for each business. When a client brought a malpractice suit against the husband and discovered he lacked insurance coverage, the plaintiff joined the wife in the case under a theory of partnership-by-representation.

The court ruled in favor of the attorney-wife, although the finding came on the slimmest of margins. The court concluded that the plaintiff failed to establish that she relied on the existence of a partnership at the time of retention. According to the court, the simple existence of a retainer agreement on partnership letterhead was insufficient – the plaintiff must have alleged that she relied on this representation in entering the contract.

The husband-wife attorneys, in this case, escaped liability. While there was no evidence that a partnership existed, significant representations suggested that one did. Furthermore, it would certainly be reasonable for a client to allege that she retained a firm with the understanding that it was a partnership. Attorneys must be careful in representing themselves to comply with ethical and civil obligations arising from partnerships.

Considerations When Changing Firms

Most attorneys don’t end their careers in the same place they started. Instead, many attorneys make a move or two that may require the transfer of files and clients. When an attorney transfers a file to a new firm, the prior Firm must maintain certain ethical obligations. The lawyer must provide notice when terminating a representation and take steps reasonably practicable to protect a client’s interests. Therefore, professional commitments are not always terminated as soon as the client ends the relationship. The following example demonstrates how failure to timely withdraw from a case after the attorney-client relationship ended resulted in a malpractice claim.

The underlying suit stemmed from a contract action brought by a condo association against its developer.   The condo association was represented by attorney “A” with the law firm “Firm.” When A failed to appear at two case management conferences, the court dismissed the suit for want of prosecution.

A subsequently left the Firm and joined “New Firm.” The condo association then signed a written agreement with New Firm to represent it in the contract action. After New Firm was retained, the condo association sent a letter to the Firm to transfer the file to New Firm. Additionally, the letter stated, “please let this correspondence formally terminate the prior retention agreement” between the condo association and the Firm. After the file was transferred to New Firm, neither A nor New Firm filed an appearance for the condo association or moved to substitute their appearance for that of Firm. As a result, the dismissal for want of prosecution went unchallenged.

The condo association subsequently filed a malpractice action against A, Firm, and New Firm. Concerning its claim against the Firm, the association alleged that had the Firm investigated the status of the suit at any time during the relevant year; it would have discovered the dismissal. Furthermore, after the file was transferred, the Firm never took any steps to effect the transfer, such as filing a motion for leave to withdraw its appearance or substituting New Firm as the association’s new Firm.    The association alleged that if the Firm had taken such actions, it would have learned of the dismissal and could have notified the association so that it could take the appropriate action for reinstatement.

The Firm sought to dismiss the suit because the condo association could not prove that the Firm proximately caused its injuries. The motion to dismiss was denied and affirmed on appeal. The court found that the Firm “did not cease to be the attorney of record at the time it was discharged by its client, since it failed to file a motion to withdraw as attorney of record properly.” Accordingly,  any negligence on the part of the Firm for failure to investigate the status of the case and advise its client was not superseded by the association’s termination letter to the Firm and retention of new counsel.

Attorneys should be familiar with their jurisdiction’s local rules regarding how to effect withdrawal of counsel effectively.   When an attorney departs his Firm and takes matters with him, the Firm needs to ensure that the Firm promptly takes whatever steps necessary to notify the court that the Firm is no longer representing the client. A few simple steps could protect the Firm in the long run from potential exposure due to the former attorney’s negligence.

Liability for Delegated Tasks

Most professional liability cases involve an attorney’s direct negligence. Often, though, an attorney may be responsible for delegating tasks to others. The question is, then, can the delegating attorney avoid liability because the alleged negligence was committed by someone else? According to a recent South Carolina opinion, the answer is no.

In Johnson v. Amber, the plaintiff alleged that her attorney breached his duty of care by failing to discover the house she purchased had been sold at a tax sale the previous year and, therefore, she did not have title to the property. The title examination on the home was performed at the request of the plaintiff’s first attorney. When the plaintiff retained new counsel for representation at the closing, new counsel relied on the title exam performed by prior counsel to determine no back taxes were owed on the property.

When the plaintiff discovered the title issue, she filed a malpractice suit against the original and subsequent attorneys alleging they breached their duty to perform a complete title exam on the property to ensure she received an excellent and clear title.

On appeal, the plaintiff argued that an attorney should be liable for negligence arising from delegated tasks unless he expressly limits the scope of his representation. The Supreme Court agreed.   The court noted that even though the original attorney’s negligence when he failed to discover the title defect, it did not relieve the new counsel of any responsibility.

The court held that “while an attorney may delegate certain tasks to other attorneys or staff, it does not follow that the attorney’s professional decision to do so can change his liability to his client absent that client’s clear, counseled consent.”  Therefore, it found that new counsel owed the plaintiff a duty and absented an express agreement otherwise. Regardless of how he chose to carry out that responsibility, he was liable to the plaintiff.

The bottom line is if the delegated task is performed negligently, it will fall back on the delegating attorney. Attorneys should be mindful of who they delegate tasks to and ensure that the delegated tasks are performed correctly. If an attorney is unfamiliar with who is performing the delegated tasks or suspects it may not have been performed sufficiently; she should take steps to ascertain the quality of the job performed and take whatever action is necessary to remedy the situation so that the duty to the client is not compromised and the delegating attorney is protected.

Importance of Client Documentation

While it is impossible to avoid every single potential claim, there are plenty of risk management steps that can be taken to at least help defend such a suit. One of the most important steps that can be taken is to maintain proper documentation of your communications with clients.   This becomes extremely important when the client and attorney disagree.

This came to light in a recent professional liability claim/ lawsuit.  The CEO of a shipping company retained counsel to settle a dispute with the board of directors of his company.  However, the CEO and Board engaged in settlement discussions without the hired counsel, who repeatedly advised the CEO not to proceed with the settlement.  Nevertheless, the settlement was reached and the CEO stated on records that he understood and approved the settlement.

Two years later, the CEO filed a malpractice claim against his former counsel claiming it was their ineffective representation which led to the unfavorable settlement.   The court ruled in favor of the law firm, as the CEO was unable to provide any evidence that he was not advised of the consequences of the proposed settlement.  In fact, there were at least 13 separate documents that showed the CEO proceeded against the advice of his attorneys.

This case shows that a well-documented client file can go a long way toward defending a malpractice claim. When settling cases, attorneys need to be mindful of the possibility of buyer’s remorse and take precautions to avoid liability.  Attorneys should be careful to explain all the terms of the settlement and give their client ample time to weigh their options.   Attorneys should also document their explanation of the settlement terms and the client’s consent in writing. This may not stave off the buyer’s remorse lawsuit, but may help to preclude liability.

Dual-role Employees

A risk management position is an example of a role that, even when filled by a lawyer, frequently involves both legal and non-legal work. “Attorneys can be hired in a myriad of roles not requiring their status as attorneys,” says Richard T. Seymour, former chair of the ABA Section of Labor and Employment Law.

When determining whether a dual-role employee is acting as legal counsel and thus invoking attorney-client privilege protection, courts should focus on function more than a title. Status is not the same thing as role. While risk managers’ views may be partially influenced by their legal degrees, their employer is not necessarily looking for legal advice, as opposed to business advice.

Just because certain positions (like risk management positions) are not part of a company’s legal group and don’t require a law degree doesn’t necessarily reveal the employee’s accurate and complete role. Whether a dual employee is functioning as in-house counsel is not a bright-line test.

Rather than focusing on labels and bright-line tests, the emphasis should be on how the company utilizes risk management employees. There is a lot at stake in determining the applicability of privilege, so the focus should be on whether the company’s employees are reaching out to the risk management director to seek legal advice. Risk managers can deal with critical legal issues.

Bringing Risk Managers Within the Privilege

If the applicability of privilege to a risk management employee is driven by function rather than form, then companies should consider how to characterize and implement those functions. Companies should give serious thought to dual-role employees like risk managers. The intent to preserve privilege cannot be assumed—the company needs to be specific that legal advice is being sought.

Bringing risk management employees within the privilege requires planning and foresight. Place risk management departments under the supervision and control of their general counsel and have the general counsel issue instructions to them. Operational changes may also help a court see the department as more legal than business. These could include: (i) modifying risk managers’ job descriptions to state that the position will involve the company seeking legal advice concerning matters they handle; (ii) requiring risk managers to keep separate files for legal and non-legal matters, and (iii) limiting email discussions on legal matters only to those who need to be involved in legal discussions.