By Julie-Karel Elkin

Lawyers, clients, insurance companies, investigators and others are not immune to data insecurity, and the effects of a lapse can be devastating. In a recent decision out of Virginia, counsel and client actually lost one of the most fundamental concepts associated with legal representation. . . privilege. Privileged communications allow counsel and client to speak freely and frankly about the events of a transaction and permit the attorney to provide the client the best possible representation. Apparently, in the Virginia case, adversary counsel was able to access certain case file materials from a claims investigation by way of a hyperlink to a non-password protected file in a cloud-based storage site (and if you have no idea what happened, you probably do need help in the data security department). Although the material did contain a privilege warning, the judge reasoned the “sharing” was ‘”too un-protected” to preserve attorney-client privilege. The accessing attorneys were also sanctioned for their behavior in viewing the material before seeking a ruling, but the damage, as they say, was already done.

Lawyers and those involved in litigation must be purposeful in the sharing and storage of data. If the information is not meant to be open, accessible and viewed by everyone, then security precautions should be taken. If limited access is being shared, there should be parameters set as to who is permitted to view the information, who is permitted to change the information and a data trail of who accessed it and when should be kept. If information is uploaded for sharing by a limited set of users, there should be a continuing responsibility to maintain security and to check what data has actually been made available and to whom. As they say, an ounce of prevention is worth a pound of cure, so being purposeful and double checking security measures can a help to avoid losses, especially the ones we count on as lawyers and clients.

Harleysville Ins. Co. v. Holding Funeral Home, Inc. , 2017 BL 39590, W.D. Va., No. 1:15cv00057, 2/9/17 as reported by Joan C. Rogers, Bloomberg 2/17/17 from


Julie-Karel Elkin is an experienced litigator who has worked with some of the nation’s largest insurance companies, independent businesses and personal claims. Focusing in negligence and regulatory claims, torts, contract disputes, mediation and administrative processes, she is uniquely qualified to address all aspects of health data needs. She is the head of Spicer Rudstrom’s Health Data practice in the firm’s Nashville office.