Why Simple Human Error May Result in Complicated Consequences: The Inadvertent Disclosure of Confidential and/or Personally-Identifying Information

Co-authored by Jay Milano

It is necessary for Ohio attorneys to exercise special care in document filings to protect themselves, their clients, and third parties from the inadvertent disclosure(s) of confidential and/ or personally-identifying information—and it is important to recognize the possible consequences for failing to do so, especially where the potential for harm is significant.

When submitting an electronic case filing to the Cuyahoga County Common Pleas e-filing portal, the system makes you check a box to verify the document complies with Rule 45’s provisions governing the filing of documents containing personally-identifying information.

This checkbox routinely forces me to reconsider the material within, or attached to, our court filings — was the client’s SSN redacted from that Institutional Summary Report? Did I accidentally use the full name of that alleged minor victim? Are there un-redacted medical records still attached to that expert report?

If the e-filing portal did not regularly compel me to consider this, I am sure there are times I would forget — inadvertent disclosure is oftentimes simple human error. But it is possible this simple human error could equate to an ethical violation and/or a violation of court orders that require Ohio attorneys to exercise special care when filing documents with sensitive information relative to clients and/or third parties.

Consider the harm. In certain circumstances, the harm caused by inadvertent disclosure could be significant — especially within the area of criminal defense given the involvement of alleged victims, the sensitive facts underlying sexual offenses, the frequent relevance of medical records, etc.

But the risk is inherent to every other practice area as well — for instance, commercial litigation commonly involves sensitive information about company operations, often of a sensitive financial nature. Probate litigation often involves allegations of mental incompetence and/or the inability to handle one’s personal assets — implicating financial, medical, personal information, etc.

In sum, the importance of this consideration cannot be overstated to any particular type of attorney licensed to practice in Ohio — the rules implicated by the disclosure of personally-identifying information could potentially be violated (albeit inadvertently, in most cases) by any of us.

Rule 45(D) of the Rules of Superintendence for Ohio Courts requires the party filing any document to “omit personal identifiers from the document” by filing a separate, specified (and sealed) form detailing the nature of the information omitted.

Sup. Rule 45(D)(3) makes clear that the responsibility for omitting personal identifiers rests with the “filing party” — the attorney who signs off. Sup. Rule 44(H) defines “personal identifiers” as: “social security numbers, except for the last four digits; financial account numbers, including but not limited to debit card, charge card, and credit card numbers; employer and employee identification numbers; and a juvenile’s name in an abuse, neglect, or dependency case, except for the juvenile’s initials or a generic abbreviation such as “CV” for “child victim.”

Many courts codify Rule 45(D) in their Local Rules of Court and/or administrative orders. All divisions of the Cuyahoga County Court of Common Pleas — criminal, civil, domestic relations, probate, and juvenile — have adopted Rule 45(D) as either a Local Rule of Court or a standing Administrative Order.

A violation of a court order can lead to an action for contempt — and a contempt finding, under certain circumstances, can be sustained despite the issue of intent. In any event, a finding of contempt can carry serious direct and collateral consequences — both personally and professionally.

Depending on the circumstances, an inadvertent disclosure could be found to violate the Ohio Rules of Professional Conduct on a broader scale than Rule 45, as the “type” of harmful disclosure is not limited by definition — and if proven against you, the violation could result in possible sanctions.

Rule 1.1 requires us to provide competent representation to our clients, and competent representation requires (among other things) the “thoroughness [] reasonably necessary for the client.” Similarly, Rule 1.3 requires attorneys to act with reasonable diligence in representing a client. Comment [2] reinforces both Rules 1.1 and 1.3 by requiring a lawyer to “control [his/her] work load so that each matter can be handled competently.”

For example, a situation in which one is accused of not exercising the level of thoroughness reasonably necessary for the client based upon the disclosure(s) of sensitive and/or confidential information as to their own client through an inadvertent document filing. This particular hypothetical also implicates the issue of whether inadvertent disclosure would waive the attorney-client privilege.

Rule 1.6 prohibits the disclosure of information “relating to the representation of a client, including information protected by the attorney-client privilege under applicable law,” unless a condition or exception applies as enumerated in subsections (a) and (b) — I.e. a situation in which an attorney inadvertently files a document (perhaps as an exhibit) that has that attorney’s hand-written work product noted during a prior meeting with the client, and is accused of violating Rule 1.6(a).

Because your duty is to the client, your responsibility to the client requires you to “subordinate the interests of others[.]” But Rule 4.4 (Comment [1]) also prohibits the rights of third parties from being “disregarded” — it is important to keep the privacy and dignity of third persons in mind each and every time you submit a filing, by whatever manner.

Rule 4.4 of the ORPC requires lawyers to “not use means that have no substantial purpose other than to embarrass, harass, delay, or burden a third person, or use methods of obtaining evidence that violate the legal rights of such a person” — i.e. a situation in which an attorney is accused of violating Rule 4.4 for filing a Motion with sensitive and/or confidential information about a non-party to the litigation.

Rule 4.4 also requires lawyers to promptly notify the senders of inadvertent disclosure(s) if documents are received that noticeably include them.

In the context of professional disciplinary proceedings (should a case go that far) the presence of aggravating and mitigating circumstances is a crucial inquiry in evaluating the appropriate sanction to be imposed. Among the list of aggravating factors set forth in Section 13 of Rule V of the Supreme Court Rules for the Government of the Bar of Ohio is “[t]he vulnerability of and resulting harm to victims of the misconduct.” Where an inadvertent disclosure causes an individual significant harm, this factor could weigh heavily against you.

Clerical mistakes and simple human errors are inevitable — as document filing systems and techniques continues to advance, the opportunities for error could also increase.

It is necessary for Ohio attorneys to exercise special care in document filings to protect themselves, their clients, and third parties from the inadvertent disclosure(s) of confidential and/ or personally-identifying information—and it is important to recognize the possible consequences for failing to do so, especially where the potential for harm is significant.

This post first appeared as an “Ethics Perspective” column at clevemetbar.org.

Posted in How to Lawyer.