Creating an Efficient & Secure Law Practice

Transcription

1 Creating an Efficient & Secure Law Practice Akron Bar Association December 17, 2014 PRESENTED BY: Colleen Heine Senior Software Consultant Accellis Technology Group John H. Roth II Software Consultant Accellis Technology Group Jeremiah Sorbera Accellis Technology Group Security & Compliance Officer {File Number: }

2 Table of Contents Practice Management Software... 3 How PMS helps you avoid malpractice... 3 The difference between Outlook and Practice Management Software... 5 Questions to ask before choosing a Practice Management System... 7 Document Management for Law Firms Why should firms use Document Management Software? Pillars of a TRUE Document Management System What is NOT a Document Management System? Needs to consider when purchasing a Document Management System Time & Billing Software Reporting Collecting your fees Law Firm Security Data Gold Threat Matrix Cyber Security Threats to Law Firms Basic Technical Controls: Creating Secure Passwords Tiered Password System Breach Notification Guidelines {File Number: } Page 2 of 30

3 PRACTICE MANAGEMENT SOFTWARE A Practice Management System (PMS) is designed to help you manage information, collaborate with coworkers and reduce the reliance on paper files within your office. It has the ability to keep track of virtually all the important information you need to manage your practice. Phone calls, notes, s, phone messages, documents, etc., can all be stored and tracked in a simple, straightforward solution specifically designed for lawyers. Centralized Case / Matter Information - A PMS gives you the ability to quickly locate any information you need by organizing and storing all information relevant to a matter - including contacts, s, notes, documents, appointments and tasks - in a single source shared by all members of your firm. Calendaring and Task Management - When lawyers think about calendars, they often think of Outlook or Google. The calendar in a PMS is like the Google calendar, but with links to matters and the ability to track time directly from events and tasks. You can add others to appointments and overlay firm and selected staff calendars. Calendar entries can be synced to Outlook which in turn gives you access on most smartphones. Communications - Moving out of a paper file system give firms a shared repository for linking s, phone call details and messages directly to a case. No longer stuck forwarding case details to firm members not copied on an , you have the ability to review a case s entire chronology of communication records. Time and Bill Tracking Tracking time spent on file activities can be a struggle for attorneys. Working long hours can result miss billable activities when it comes time to calculate their day s work. Time Entry tools within a PMS allow firm members to catch every phone call, , document created with the appropriate rate, interest and other billing details. Furthermore, the ability to have support staff add billable time for attorneys saves your focus for case related activities. How PMS helps you avoid malpractice Attorneys can get sued for malpractice. It is a reality. Clients complain to the Disciplinary Counsel when they feel their attorney has been non responsive, or they feel their case has been mishandled. A PMS will help you stay in touch with your clients, improve communication, and educate other staff members on the status and details of any case. Don t miss deadlines - A practice management program provides you with a way to create appointments and to-do s for upcoming filing deadlines, statute of limitation dates, etc. It allows you to create a built in tickler system for particular types of events. And, because calendars are visible to multiple people in your firm, it is less likely that a deadline will be missed. Rather than having support staff review court rules and filing {File Number: } Page 3 of 30

4 dates to log onto a paper calendar, your office can have one shared calendar calculating formulas to track the next expected deadline. Improve client relations - A PMS allows you to automatically assign tasks to another member, or even apply date calculations to help keep track of upcoming court dates, etc. It also gives you the ability to create time entries from record types, such as phone calls, s or notes. So you can use your bills as an additional form of communication with your clients. For Example: You have logged the details of your phone conversation with a client. You can easily turn the phone call into a time entry. This way, you ve billed your time for the call, but you have also created a detailed time entry that will show up on your client s bill. By doing so, your bills become an increased communication with your client and with detail like that, they are more likely to pay your bill and less likely to dispute your fee. Better documentation of work performed for client - By using a PMS to keep track of all the work you do for a client, you will have an easier time on several fronts. First, it will be easy to update the client when they call for a status. It will also be easier to work collaboratively with other firm members on the file, because the data is stored centrally and everyone can access it. And, in the unfortunate event of a suit for malpractice, or a suit to defend your fee, you can very simply provide a list of all the work performed for a client on a particular matter. Avoid conflicts of interest A PMS is a database helps you keep track of everyone you have dealt with - not just clients. You can keep details of everyone you have dealt with on a matter, including witnesses (from both sides), parties to the case, experts, etc. That way, when you do a conflict check in your database, it has integrity. Many firms will send an to the entire firm to see if anyone can see a conflict. That s a good start but it s not enough. How many attorneys, law clerks, secretaries, and paralegals have worked at your law firm? Do they all still work there? Do you send the to everyone who has ever worked at your firm? Instead, enter all of the names of the people you have dealt with, no matter how insignificant they may appear to have been. Run a conflict search and look at the results. Just because a name appears, it doesn t mean there is a conflict. But you, as the professional whose license is on the line, make the determination. A PMS will give you an internal system to keep track of conflicts, instead of memory or word of mouth. You ll view former clients, witnesses or potential client records even cases that never panned out. Malpractice insurance companies have been known to offer discounts based on using a program with internal conflict checks. {File Number: } Page 4 of 30

5 File collaboration with ease (substitute attorneys) - As it stands right now, the paper file is probably the place where most of the case details are shared. You might also have all of the documents for this particular client saved on a network drive. This is a great start, but a PM program can take sharing data to the next level. PM programs allow you to save calendar events, to-do s, phone call records, phone call messages, , notes, documents and other custom file data right to the PM file or matter. That way, anyone in your firm can access the information that they would otherwise need the paper file for. For example, perhaps you are working on a Probate file. Your paralegal simply needs the date and county of death in order to complete the documents he or she is preparing for you. However, you went to court with the file yesterday, and haven t returned to the office yet. The file is in your briefcase, in your trunk. Had this data been save in your PMS, the location of the paper file would be irrelevant, and your staff could stay productive and profitable. Now let s consider what happens when the lead attorney on the case is out of the office. Another attorney at the firm has to step in and cover the cases. If you have taken notes about the case that are sitting in a pile on your desk to be filed, or have s saved in your Outlook folders (to which others don t have access), the attorney will not have all the data necessary to comment or assist with the case. However, with a PMS, the notes you take can be automatically saved to the client file. The s can be saved to the file. That way, when the substitute attorney has to talk to the client, or opposing counsel, or appear on behalf of the client, the file is up to date and they have what they need to be prepared. Electronic versions are backed up and secure - A malpractice suit could begin if an attorney cannot provide examples of evidence, filings or case documents that were misplaced. Electronic Practice Management systems are strongly encouraged to be implemented with a regular back-up system. Unlike when the paper file is lost within an office or buried on a co-workers desk, you can confirm your electronic documents are linked to a case correctly and easily accessible. The difference between Outlook and Practice Management Software A Practice Management System was designed with law firms and legal departments in mind. Unlike Outlook, which uses a contact centric approach to manage data, a PMS uses a matter centric approach; because that is how firms operate. In Outlook, you have the ability to manage your , calendar, contacts, and tasks. However, there is no efficient way to indicate which s, calendar events, contact records, or tasks are related to a particular matter. Further, there is no easy way to turn these records types into billing records. Below are a few other ways Outlook pales in comparison to a true Practice Management system. {File Number: } Page 5 of 30

6 Shared calendars - Group calendaring will allow for all users to schedule one event for five people as opposed to five people scheduling the same task individually or possibly incorrectly. In a PMS, you can go directly to the matter and look up all events associated with that matter. Since the events on this list are only related to this matter, the information is located much more quickly than trying to search through every event in Outlook. A PMS also offers firm-wide access to calendars and events, so anyone in your firm can add/edit/view events on your calendar. Contact management - While Outlook does a decent job of giving us the fields we need to manage the data related to a contact, there is no way to see which matters this particular client is associated with. A contact record in your PMS may contain much of the same information as Outlook (name, address, , phone, etc.,) but you also have the ability to see the many different relationships this Contact might have with other records in your firm. For example, Jane Doe is your client. She hired your firm to incorporate Accellis Technology Group, Inc. She is also acting as a consultant on your Baxter vs. A Jenkins Engineering Case, and, she is the beneficiary of an estate your firm is administering. Jane is ONE CONTACT who has a relationship with 3 SEPARATE FILES. In a PMS, you can go to Jane s contact record and see all of the files she is related to. Further, by simply double clicking on the name of the matter in a PMS, you can get right to the matter you need. There is simply no corresponding feature in Outlook. You cannot open a contact record for a client and see all the matters they are related to. Other related records in a PMS may include phone records, records, event records, and many others. While Outlook does enable you to link these types of records to the Contact, there is no way to identify which MATTER the records belong on. Everything in Outlook is contact centric, instead of matter centric. Management A PMS allows you to save s to specific client matters, instead of lumping all client work together. You no longer have the burden of creating subfolders, organizing your inbox contents or forwarding attachments to firm members. Also, anyone in your firm can see all s associated with a particular matter in just a few clicks (unless security roles are in place). Malpractice protection - Going back to your malpractice protection, if your client moves and Joe s Outlook has a former address, but only one account in the whole firm has been updated and service is not updated correctly we re liable to communicate case details accurately and serve parties accordingly. {File Number: } Page 6 of 30

7 Increased communication and tracking - Each program allows you to create a phone or record when you have this type of communication with a client or party related to the matter. Instead of taking phone call notes on a sheet of paper and filing them in the paper file, you can take a note inside your PMS and associate it with the appropriate file or matter. The more efficient your firm is, the better the service you can provide to your clients. A PMS gives you have the ability to store all of the data for your client s matters in a central location. You can create records for every phone call, phone message, , file note, calendar entry, etc. You also have built in reminders to help you accurately bill your time, and to create detailed time entries based on records in the database. Improve profit - A PMS makes it easier for you to see the work you have done at any given point in time, including s, phone calls, events, notes, etc., and turn these into billing records or time entries. Some Practice Management systems will populate time entries for you, or remind you to track your time, with little to no effort on your behalf. When your firm resources are utilized in an efficient and consistent manner, your profit will increase. The less time your billable staff spends on non-billable tasks, the more time they have to spend on billable tasks! Avoiding conflicts of interest will protect you against the expenditure of firm resources with the unfortunate result of not being able to collect your fees for work due to a conflict of interest that is discovered after work has begun. Utilizing document templates will streamline and speed up the process of document generation. All of these things, among others, combine to improve the firm s profit. Questions to ask before choosing a Practice Management System 1. What systems do I want it to integrate with? - Third party integration requirements are available from every software manufacturer. You need to be sure that you, or your IT professionals, have reviewed these thoroughly, before you buy. Version incompatibility is one of the most difficult hurdles in any Practice Management project, because it takes the cost of the project and increases it beyond estimation. It begins to implicate potential upgrades to operating systems, office suites, etc. that you never budgeted for. 2. Do I own or need to purchase additional hardware? - When you go to a website for a program, you will see the minimum technical specification to run the program. These are for the product at hand. They need to be considered in the context of all the other programs in use at the firm. Server specifications need to be considered in the context of all other programs that are running on that server. Make a list of every single program that everyone in your firm uses, even if it is as simple as windows messenger or weather bug. Every program that runs on a machine on a daily basis needs to be considered. {File Number: } Page 7 of 30

8 For example, you may have bought a server 5 years ago that seemed to be more server than you would ever need. However, in the past 5 years, in addition to that server acting as your file server, you have added Microsoft Exchange, a few people access that server as a Terminal Server, your backup software is installed there, and now your Accounting and Practice Management databases live there. Now, what seemed to be more hardware than you would ever need is maxed out and performance is suffering. Remember, you cannot build a 4000 square foot house on a 1200 square foot foundation. It won t support the technology you want to use, and performance will suffer. Another thing to remember is, when you call Amicus Attorney, or Time Matters, or Practice Master, or any software manufacturer, and talk to the sales department, they are not obligated, nor are many of them qualified, to analyze your network and tell you whether your hardware is sufficient in the context of everything else you run. It is your responsibility, and that of your IT professionals and consultants, to make sure that you are building on a solid foundation. Technical specification list things like processor speed, RAM, the type of hard disk drive, your video card and display settings, the.net framework and type of file system, the type of network cable you have, the versions of Windows you are running, etc. The tiniest of violations can have a significant impact on the performance of your PM program. Don t gloss over these requirements. If you don t understand a technical requirement, or don t know how to determine whether your network is sufficient, speak to someone that does. 3. Should I work with a consultant? - The choice you make for your firm s Practice Management System program can be the difference between running a profitable, efficient law firm, and losing money. It s never a good idea to simply buy the program that your buddy from law school uses or the program that you saw demonstrated at the last CLE you attended. There are tons of things that should be considered before you decided which program is right for you. There are several good Practice Management Systems on the market. Fundamentally, they all do much of the same thing. However, each program has features that are better than their competitors, and you need to know what those features are, and whether they are important to your firm. Most consultants will give you a decent amount of time (for free) to help you investigate the program they represent. If you can find a consultant with knowledge of multiple programs, so that you can get a side-by-side comparison of the programs, that s your best option. {File Number: } Page 8 of 30

9 Am I willing to invest in training? - Training is the most important step in any Practice Management implementation, yet is most often overlooked. Each attorney in your office can spend 6 hours at a billable lost opportunity of $200 per hour ($1200 loss to you) to try to teach themselves the program, or you can pay a consultant less per hour to come in a teach your entire staff the right way to learn the program. If the training line item is the one that breaks the bank, then you cannot afford this project right now and should delay until you can. Training should be mandatory - even for the managing and senior partners. Lead your support staff by example, and be sure the mandate to learn and use the program is clear. If you have people in your office who swear they don t have time, investigate whether there are any public classes they can take to get CLE credit at the same time, or see what on-line courses that can be taken at their convenience are available. Additional Considerations What does it mean to new lawyer? Installation / adaptation process/timing Will it need to support rapid growth or multiple locations in the future? What s the best product for my type of law? {File Number: } Page 9 of 30

10 DOCUMENT MANAGEMENT FOR LAW FIRMS A Document Management System (DMS) is a program that will control how your firm accesses and saves its intellectual property. This is typically accomplished by overriding the traditional Windows save window, whereby the user selects the path to the location where the document will exist. The new DMS save window will require the user to name the document and select other information from table such as client and matter. This information that is selected from a table is referred to as metadata. Once each field is completed, then the program determines where the document will live. This folder structure is entirely managed by the DMS. When a user needs to locate these documents, the DMS has a host of user friendly options of which the user can take advantage. This includes searches, navigation panels, shortcuts, quick access, favorites etc. These programs are typically more robust and user friendly than Windows. A DMS may also meet additional firm needs for mobility, user control and security. Why should firms use Document Management Software? Think of all of the countless times you have searched high and low for documents on a server only to find it under complex naming conventions or it was missing altogether. Document management simplifies the creation and use of documents. Occasionally users buck at the idea of filling out a metadata profile when saving a document. However this information helps other users locate it because all users work within the same organizational structure. Initially this structure is determined by the firm. Then, once agree upon, acts as a common sense logic that users can reference when looking for documents. While I agreed some people are organized and could manage to follow guidelines for naming and folder structure, we all know that this is not possible for everyone. Because a DMS forces this structure there is no way for users to escape and create their own structure. This structure is determined by the metadata that is selected when saving a document. Think of metadata as an address on an envelope. Once the document has this information the DMS knows where to store the document and where it can be found. Metadata is usually information like client, matter, document type, author, and a description of the document. Then when someone needs to look up a pleading created by a colleague for John Doe s case, they can find it easily. This highlights another benefit of DMS; searching. Has anyone ever tried using the search bar in Windows? If you are searching in that folder is helpful, but say you needed to run a search across multiple folders and multiple network shares. This can take minutes. These wasted minutes add up to time you could have spent billing. In comparison a DMS builds an index of {File Number: } Page 10 of 30

11 documents, and the search that took minutes in Windows may take 2-3 seconds in a DMS. A DMS also has the ability to search on metadata, date ranges, and text. In additional you can add descriptions and comments to audio, video, and image files to increase the likely hood you will find them. Document Management Systems have many other tools that help firms stay organized as well. This includes user friendly interfaces, version control, Practice Management Integration, integration and more. How is Document Management Software different from Windows? The more experienced Windows user may recognize some of these features and claim that Windows already has them. In some cases this is true, but the biggest difference is forcing the user into a structure and location with the addition of metadata and advanced searching. This forced structure allows the firm to confine users to the DMS so they have no alternatives but to save in the DMS. There are some similarities between Windows and a DMS. For example, both Windows and the DMS have the ability to preview a file before opening it. However, in a DMS your text search can be previewed as well. Also the DMS preview pane will display a wider array of extension types than Windows. You can create favorites and shortcuts in Windows. These allow you to jump to a folder or share in a click. But these are limited to folders. A user cannot select one document from folder A and another from folder B and create a new favorites group, unless the user makes copies of both of these files, which defeats the purpose of storing those files in folder A and folder B. A good DMS will also have these features and you can create your own favorite groups based on documents rather than folders. Then if you update the document in your favorites folder it will also update that document in the real location. There are other areas where windows offer similar features, but again a DMS will be more robust. 4 Pillars of a TRUE Document Management System Pillar I Forced Save A true DMS will over-ride the Windows save with its own save. This DMS Window will, if the site chooses, not allow users to escape the DMS. This means any time a user saves anything they will be forced by the DMS to save it by entering the metadata information. This will guide the document to the folder and save it to the right location. {File Number: } Page 11 of 30

12 Pillar II Metadata Metadata is gathered during the save process. This metadata is customizable to meet the firm s needs. Once customized the metadata will determine where the document is saved and provide additional search options. It is the metadata that provides the site wide structure that will allow one user to find a document that another user saved. This works because all users are thinking and using the same organizational structure. Pillar III - Advanced Search features The advanced search is what sets DMS apart from Windows. In addition to searching on metadata, users are provided filters, customizable sorts, a robust preview pane and more. User can search by text, date created, date accessed, date modified, and a DMS will often provide an audit so a user or administrator can see who did what and when. But, perhaps the most overlooked difference is the speed at which a DMS can perform a search. DMS is much faster and this difference in speed becomes more apparent as the number of documents increases. This process works much better due to the index that a DMS creates. The index itself could almost be taken as a separate pillar on its own. Pillar IV - Managed folder structure This may sound innocuous, but it s actually very important. Without the DMS to manage the folder structure of two scenarios plays out. The most likely scenario is that everyone creates folders as needed. Initially this starts of very organized, but as time passes users split into two groups. One group stops creating folders, and starts saving wherever. The other group creates a new folder for everything creating a complicated structure that nobody can follow. Since both things are happening in one environment this means the existing folder structure does not accurately contain all firm documents. Alternatively, if you limit folder creation to one person, that person will become overwhelmed with reasons and justifications to create additional folders, while others will just start saving them locally. A true DMS will manage this structure and force users to comply. The structure will create new folders and remove empty ones. Then even if users don t agree with the new structure they will not be able to escape. This keeps users on the same structure. Since the structure and organization is maintained by the DMS all firm members will be working off the preconceived organizational paradigm. Two of the most well-known examples og a true DMS are Worldox and NetDocuments. {File Number: } Page 12 of 30

13 What is NOT a Document Management System? As a consultant I am often asked if a particular product is a DMS. Without the information discussed so far this can be very confusing to a firm. There are products that have features of a DMS but these products are typically missing one or more of the 4 Pillars that define a true DMS. Here are some types of products that manage documents but are not DMS. Sync and Save (e.g. DropBox, Box) A Sync and Save (S&S) product typically allows you to drop a document into a container. This container copies the document into the cloud. From here your document can be accessed across multiple devices. S&S make it very easy for users to access documents on the road and across multiple devices. This typically makes it easy to share large files with clients or attorneys when those files can t be ed. Depending on the version, free or paid, they may offer the ability for an administrator to manage folder creation, document security and user privileges. Anytime the firm uses a cloud product they should make sure all proper security measures are taken. Also, depending on the firms practice area and the nature of the documents the cloud may not be a option. S&S programs are not considered a true DMS because they do not manage the document structure nor do they provide indexing, or the advanced search features found in a full DMS. Document Search Engine (e.g. MetaJure) A document search engine (DES) will walk all folder trees both on the network and the local PC. Then it will index the findings. This index allows users to do a Google like search across all allowed folders and servers. Document search engines are newer to the market. This is an excellent way to share right form Outlook without any extra steps. Users have the freedom to save and name documents however they want (some firms love this). There are some security features that can be employed, nut they are not as robust as a full DMS. DES Searches are quicker and more accurate than Windows searches. If a firm merges or has separate data stores, these products can provide a one stop shop allowing user to search across all data stores. {File Number: } Page 13 of 30

14 Folders structure are still not managed and user could be saving to their local PC, which is not likely to be backed up. Access to features, folders, and files are not as customizable. A document search engine, MetaJure for example, is not considered a true DMS because it does not manage the folder structure nor does it create the metadata that is found in a true DMS. Documents not saved to the server are most likely not backed up, so if the user s computer goes down or is taken off the network, those documents cannot be searched. Other DMS tools might be absent as well, version, bookmarks etc. Just because they are not a true DMS does not make them bad products. They serve a different role and in their fields they are excellent at what they do. The firm needs to realize what they need, so they know what product to buy. The only time these products won t work is if they are bought for a purpose other than the one for which they are designed. Many firms need access across multiple devices and the ability to share documents that are too large to . If syncing and saving is the only need, then a true DMS won t work. In the same way, some firms need to merge large data stores and don t want users searching in 2-3 places for a documents. Or maybe they just like the organic nature to save where ever they want. In this case a Document Search Engine will work wonderfully and a DMS might be seen as intrusive or redundant. When looking for something to manage your documents, make sure the need is identified first. Needs to consider when purchasing a Document Management System Before any products or solutions can be considered the firm must to be able to identify exactly what it needs. As mentioned in the previous section, if a product is purchased to serve a purpose other than the one it was designed for, problems will arise. Since we are discussing document management, let s look at some questions focused on this topic. If the features below are most important to you, then a Document Management System may be right for your firm (e.g. Worldox, NetDocuments) Full control of save process Managed Structure Security of product features and documents Quick searches Customization Management {File Number: } Page 14 of 30

15 If the features below are most important, then a Sync and Save program may be right for your firm (e.g. DropBox, Box). Mobility Cloud storage Sharing Access from multiple devices If the features below are most important, then a Document Search Eengine may be right for your firm (e.g. MetaJure). Locating documents Minimal training Easily sharing Keeping documents onsite. Once the firm has a clear picture of what is needed, only then should products be considered. After review the products and seeing a few demonstrations, then lastly let price guide you. Firms that start with price tend to end up with products that don t adequately meet their needs, or worse yet cut out training. Remember the product you select will manage all of your documents in one way other another. The firm s staff that does not know how to properly use the product, will end up hating the product, and will look for ways to avoid using it. This will only set the firm back and make life more difficult. Even though this decision may be made by a few people, the entire firm needs to be on board, aware of the change, and well trained for a successful implementation of the DMS. Any way you spin it, a Document Management System can be a powerful tool that firms can use to maintain an organized document store, manage , quickly search, and identify documents. Other common features like favorites, bookmarks, preview panes, filers and indexs will make document access and management easier for all uses. Security features will allow firm administrators to grant and deny access to both documents and features within the program. Remember to identify your firms need accurately when selecting a product, and don t cut corners on training. A well trained staff managing your documents is very important to the success of your DMS implementation. TIME & BILLING SOFTWARE The question often comes up, should I capture my time for non-billable events, like conducting performance reviews, reviewing pre-bills, attending CLE, etc.? Absolutely, yes. Your support staff {File Number: } Page 15 of 30

16 should track their time for non-billable, administrative tasks as well. Without this information, how can you really analyze your staffing needs? Consider this: You pay a legal secretary $45, per year, plus benefits, vacation, etc. He typically bills his time at $75.00 per hour. On average, he is entering about billable hours each week. At 20 hours per week, 50 weeks out of the year, he is billing about $75,000 per year. At first glance, he s covering his salary and so you figure he is profitable. But, could he be MORE profitable? You can only answer this question by looking at the time he spends on administrative tasks that cannot be billed to a client. After reviewing his non-billable time for a month, you realize that he spends 1 hour every morning making coffee, sorting the mail, and delivering the mail to each staff member. Each afternoon, he covers the phones so the receptionist can go to lunch. At the end of the day, he spends another 30 minutes preparing all the mail to go out. He prints reports for the staff meeting, and also spends about 1 hour per day entering attorney time into the billing system. So, every day, he spends at least 3.5 hours doing work that cannot be billed to a client. What can these numbers tell you? That you should hire a law clerk or office assistant for 20 hours per week to do these things. You can pay them $15.00 per hour, part time, and have an estimated yearly expense of about $15,000. Now, your paralegal can increase their profitability by $65,000 per year, and you net about $50, extra dollars. Without tracking the billable AND non-billable time and running this essential report, how could you make this staffing decision? Contemporaneous v. Reconstructive TimeKeeping -Billing Rates Reporting Many law firm specific Time, Billing and Account programs have standard reports that can help you make this important analysis before you lose this money. Here is a sample report from PCLaw that shows a summary of each type of law, the value of the time entered, as well as the true billable rate for each attorney within each type of law: {File Number: } Page 16 of 30

17 You can gather valuable information from this report. Let s use Bankruptcy as an example. You charge a flat fee of $2, to represent someone in a bankruptcy. Robert S. Brown s hourly rate is $ per hour, so you ve estimated that it takes the billable attorney about 10 hours to complete the bankruptcy. So far this year, you ve billed $4, under the Bankruptcy area of law (2 cases). As you can see from the report, Robert has logged 25.6 hours within this type of law. So, you are technically taking a loss on these types of cases. You can see from the Rate/Hr. column that Robert s actual rate calculates out to $175 per hour. That s a loss of $50.00 per hour from his normal hourly rate. However, the next column indicates that you have a 100% collection rate in this area of law, so this might not be a bad area of law for you to continue practicing. Collecting your fees Reports in these legal specific programs can take it even further and add collections to the report. So, you charged the client $600. The value of the work was actually $ And the client hasn t paid you for 6 months. So, you really lost on that one. You might even notice a trend the new associate seems to be bring in a ton of new business with these simple estate plans she s averaging 10 per month. But, she has a 50% collection rate. Perhaps this will open your eyes to the fact that this associate could use some help qualifying {File Number: } Page 17 of 30

18 clients, preparing retainer letters, and talking to clients about payment. Every bit of data can provide you with insight to your firm that you didn t have before. Having a ton of clients doesn t necessarily make your law firm successful. Further, if you have any compensation arrangements with partners or associates that provide bonuses based on billable hours, do you really want to payout bonuses on fees you haven t yet collected from the client? You need a report that shows a comparison between the fees billed, and what has actually been collected. So, in the report below, you can see that Robert S. Brown has billed $15,756.06; however, the firm has only collected $9, There is a $6, accounts receivable balance for his work, meaning the firm has only collected approximately 62% of the fees Mr. Brown has billed. If he is entitled to a bonus of 10% of what he bills, should the firm pay him 10% of $15,756.06, or $9, ? If they pay him 10% of $15,756.06, he gets a check for $1,575 and if they never collect the remaining $6,186 he earned close to $ on fees that the firm never collected. Is that what the firm intended to do when they set up his bonus structure? LAW FIRM SECURITY Amid the seemly never ending articles, blogs and news reports regarding the latest cyber security breach is a key question that never seems to get answered what, exactly, are we at risk from and what are we supposed to do about it? {File Number: } Page 18 of 30

19 Understanding the true details of today s cyber security landscape is a full time job and nothing, even the most technically capable attorney, could likely master. Threats are an ever changing, dynamic situation that requires specialized and dedicated attention. Interestingly, the types of threats faced by all industries today are hardly different from the ones created a decade ago. But the people creating and distributing them have changed a lot. The days of casual hackers going about their efforts for little more than bragging rights have now morphed into big business where the financial rewards can be substantial. It is estimated that the makers of the ransom-ware Cryptolocker have already collected millions of ransom dollars (forbes.com) for that system alone. When you consider all the viruses on the Internet, the amount of revenue these nefarious coders are collecting is mind boggling. With the legal industry now squarely in the crosshairs of similar data centric industries such as finance, banking, insurance and healthcare, the American Bar Association (ABA) has taken notice. The ABA has quickly responded to these new cyber threats by passing a new resolution this summer to specifically address the security needs of the legal industry. ABA Resolution 109 specifically recommends: That all private and public sector organizations develop, implement, and maintain an appropriate security program, including: (1) conducting regular assessments of the threats, vulnerabilities, and risks to their data, applications, networks, and operating platforms, including those associated with operational control systems; and (2) implementing appropriate security controls to address the identified threats, vulnerabilities, and risks, consistent with the types of data and systems to be protected and the nature and scope of the organization; So no matter if your firm has three hundred resources or just three, it s no longer optional to have a plan to properly protect your client and employee data. Firms need to recognize that cyber security will need to be a top priority for most firms in the foreseeable future. But as you commit to proper protection of your data where do you start? First, you need to know what your real obligations are when creating a security plan. As a law firm, your responsibilities primarily fall into 2 categories 1) Protect your data and 2) Disclose if that data has been compromised. Where do these obligations come from? Truth is there is no one source but rather a patchwork of ABA Rules of Responsibility (ABA 1.6 Confidentiality, 1.1 Competence and 5.1 Supervision), FTC Regulations and State level mandates then establish a general guideline. {File Number: } Page 19 of 30

20 Second, it s important to understand that the standards by which a firm can enact a security program are open for interpretation may be different for every firm. Factors such as type of law practiced, client profiles and the type of information maintained by the firm could all influence the breadth and depth of your security program. The bottom line is that your firm must be able to demonstrate it has implemented reasonable and appropriate measures to protect data. So let s begin by establishing what, exactly, are the Information Assets that put you at risk. Data Gold Law firms represent easy targets for security breaches due to the fact that they often maintain extremely valuable data, while often denying that they actually do. Just because you don t house 10 million credit card numbers does not mean that the information you do have isn t valuable. The second reason is reflected in the overall industry s slow response to the expanding threat horizon. Implementation of the necessary controls over their staff/resources and infrastructure still remains very low in the priority scales for many law firms. Law firms store and maintain an array of very valuable information stores, sometimes referred by the security industry as data gold. The data gold can be anything from Personally Identifiable Information (PII), HR information, and corporate information to intellectual property files. The quantity and quality of this data is often very accurate as the attorney client privilege affords a great deal of shared valuable information. The good news for most law firms is that this information is almost always kept in one place! Threat Matrix This chart below displays the types of data that a law firm may hold. Your firm should identify what type of information you carry that could potentially pose a risk if it were lost or stolen. {File Number: } Page 20 of 30

21 Types of valuable information often maintained or managed by law firms include: 1. Bank or financial account information (security deposit box information, account numbers, account passwords, etc.) 2. Tax information 3. Personal client data (Social Security Numbers, date of birth, driver s license numbers, address info, etc.) 4. Employment information (both current and previous employees of the firm) 5. Intellectual property (trade secrets, trademarks, patents, research and development, etc.) 6. Medical information 7. Market information (mergers, company liquidation) Personally Identifiable Information (PII) that requires client notification when breached is legally defined as a Name PLUS any of the following (Bro & Smedinghoff, 2014): 8. Social Security Number 9. Driver s license number 10. Government issued ID number 11. Financial account / credit card number 12. Other information including address, healthcare data, etc.) Cyber Security Threats to Law Firms Cyber threats are essentially a combination of people, software, hardware and even natural disasters that can put your information at risk. As was done with the firm data assets, we look to streamline the threat discussion to those that are most relevant to the legal industry. Specifically, we can categorize the cyber threats to the previously listed data assets in the following way: {File Number: } Page 21 of 30

22 Technical Trojans Viruses Worms Malicious Code Human Employees Hackers Competitors Third-Parties / Vendors Platform Software Defects Incorrect Configurations Poor Security Setup HUMAN THREATS Employees / Insiders Insiders are the people who sit next to you at work. They are the employees you let go, the ones still on the payroll and even the people you authorize to let touch your computer systems. They often have direct access to your most valuable and confidential information. Breaking down this category a little further provides better insight to the risks these resources represent. Employees are unknowingly your greatest threat. Sources show that 60% of security events are caused by an inside attack. Of that, 20% are intentional and 80% are unintentional (Intellinx.com). They don t mean to, it s just that the nature of their job gives them direct access to highly sensitive data. 61% of users who have access to a company network use the same login credentials on other non-company sites such as Facebook, Twitter, and LinkedIn (csid.com). Since many targeted breaches begin with a phishing effort to grab user s social media logins many are inadvertently putting confidential company login information right out for anyone to see. Additionally, many companies do not track when users access company information. If one of your coworkers or employees accessed company records last night at 2am, would you know? If {File Number: } Page 22 of 30

23 someone logs into your network from two different locations at one time would your network react? Part time employees come with all the same problems as full times employees only they know they are temporary. The risk is greater when there is no fostered loyalty. Sure you might have them sign the non-disclosure agreements, but if you are not keeping logs of everything going on, even the most trusted part-time employees might be very costly. They often have all the same access as full time employees without the responsibility. These resources are often easy phishing targets. Former employees sometimes get hostile after downsizing occurs. They might feel wronged and feel entitled to compensation. Employees who know they are leaving are also a substantial risk. What information did they take before they gave notice? Also, what about the access that former employees often retain even after they ve left the firm? Firms without quick and decisive employee exit strategies or clear restrictions for remote access can find that the path to data loss is much shorter than expected. Hackers Human hackers represent much of the threat landscape for many industries, and the legal industry is no exception. With pop culture today portraying them as both heroes and villains, it is sometimes difficult to really understand what exactly is going on. There are many types of hackers, some good and some bad. Types of hackers that represent the biggest risk to law firms include: A Black Hat hacker is the stereo-typical bad guy out to make a living off of your personal information. Pop culture has painted the picture of these people as nerds that spend all their time down in the basement of their mother s house. This is only partially true; there have been an influx in businesses around the globe that hire black hats for malicious development. These groups of hackers are legitimizing their dealings by creating applications and hiding their malicious code inside. The information they are after covers a wide spectrum. Anything with personal information, bank information, friend information, and what sites you purchase from can all be targets. Governments try and keep black hats behind bars; however, because of ever-changing tools that keep users anonymous, that task is becoming more difficult. Script Kiddies are the new people of hacking. They use publicly available, pre-packaged automated tools written by others. Automated tools are often found with malware written into them. It is easier for black hats to get script kiddies to do the leg work and have all the data report back to the original author. The average age of this group is typically low. {File Number: } Page 23 of 30

24 Nation-State hackers are a very real threat. Nation State hackers are not specifically sponsored or endorsed by a specific (local) government (might be though who knows for sure?) but they often originate from a foreign country. China, Russia and several other countries have a wild west type environment that applies virtually ZERO legal threat to those people or resources that are actively developing ransom-ware, stealing personally identifiable information or using your network as a staging area for further destructive activities. The two (2) biggest risks Nation State hackers represent to law firms include: o o Hijacking Depending on the hacker s goals (financial, information, etc.), they may be interested in using viruses and Trojan horses to hijack your computer so they can remotely control it for their own purposes. These purposes could be to harvest your information or to launch a bigger attack on another company. Terrorism - Some experts believe that terrorists will eventually launch an attack using hacking techniques. Competitors While this may seem more like the movies than real world business, domestic corporate espionage is happening on a regular basis. With the legal industry having embraced the use of digital formats for its entire work product while leaving security protocols and standards at the bottom of the technology spending list, this type of hacker is likely to be seen more and more. Truth is, it is easier than ever to pay a hacker to develop a malware program that will sit inside a firm s network and report back any information deemed relevant. Moreover, it is not overly difficult to hire someone to design the software specifically for a legal network so common antivirus and anti-malware programs will not pick up on them. The way viruses and malware are found are based on what s called signatures (list of known programs that cause problems) and heuristics. When you pay for your anti-virus and anti-malware programs, you are paying for that company to do the research and find the code that is causing problems. They create signatures that mark the program as bad and block it. It is also important to realize that most anti-virus solutions have reporting thresholds in place that have to be crossed before a defensive update is added to their software. In other words, it may take 1000 new virus infections before your anti-virus software builds an update to protect your network. It should be no surprise that the hacker community is often fully aware of these thresholds and will only release their malicious code in batches that keep their efforts below the radar of the bigger A/V solutions. Hackers are smart enough to create viruses and malware that can change based on heuristics and signatures. This puts us in a situation that necessitates more stringent protection from all the unknown malware and anti-virus out there. Because of this gap in security, competitors can leverage that knowledge to get whatever they want with little money. If you are not taking every {File Number: } Page 24 of 30