Law firms share files all day. Draft agreements go to clients. Discovery goes to opposing counsel. Medical records come in from providers. Financial statements move between accountants, lenders, and the firm.
Every one of those exchanges carries confidential information. And the method a firm uses to share it matters more than many attorneys realize.
This article compares the most common file-sharing methods law firms use, explains where each one creates risk, and offers a practical way to choose the right tool for each situation.
The Professional Duty Behind the Technology
Lawyers have an ethical duty to protect client information. ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized access to or disclosure of client information. The ABA's Formal Opinion 477R discusses how that applies to electronic communications and suggests that the level of protection should match the sensitivity of the information.
In plain terms, a routine scheduling email and a sealed settlement agreement don't need the same treatment. Firms should think about what they're sending, who it's going to, and what could happen if it ended up in the wrong hands. Each state adopts its own version of these rules, so check your state bar's guidance.
Comparing Common File-Sharing Methods
Regular email attachments
Where it works: Low-sensitivity documents such as public filings or meeting agendas.
Where it falls short: Attachments live forever in multiple inboxes. They can be forwarded without your knowledge. If either party's mailbox is compromised, every attachment in it is exposed. You also can't take a file back once it's sent.
Encrypted email
Where it works: Sensitive documents sent to clients who are comfortable with email.
Where it falls short: Encryption protects the message in transit, but recipients may still download and forward files. Some clients find the extra login steps confusing, which can lead them to ask for "just a regular email."
Cloud sharing links (OneDrive, SharePoint, and similar tools)
Where it works: Larger files, collaborative drafting, and ongoing matters.
Where it falls short: Links are only as secure as their settings. A link set to "anyone with the link" can be opened by anyone who receives it, including someone it was forwarded to. Links also tend to stay active long after a matter closes.
Client portals
Where it works: Recurring exchanges with clients, especially in estate planning, family law, and business practices.
Where it falls short: A portal only helps if clients actually use it. Poor usability drives people back to email.
Personal file-sharing accounts
Where it works: It doesn't. Staff using personal cloud storage accounts to move client files creates serious risk, because the firm has no control over who has access or what happens when the employee leaves.
This last category is a form of "shadow IT," which we cover in how employees using unauthorized apps put your business at risk.
A Simple Decision Guide
Many firms find it helpful to sort documents into three tiers:
| Sensitivity | Examples | Recommended method |
|---|---|---|
| Low | Public filings, scheduling notices | Standard firm email |
| Moderate | Draft contracts, correspondence with personal details | Encrypted email or restricted cloud links |
| High | Medical records, financial statements, trade secrets, sealed materials | Client portal or restricted links with expiration and named access |
Writing this down and training staff on it removes guesswork. It also gives the firm a defensible answer if a client asks how their information was protected.
Cloud Sharing Settings Worth Reviewing
If your firm uses Microsoft 365 or a similar platform, a few settings make a large difference:
- Restrict "anyone with the link" sharing, or turn it off entirely.
- Default new links to specific people rather than everyone.
- Set expiration dates on external links.
- Require external users to verify their identity.
- Review externally shared files when a matter closes.
Our cloud services help firms configure these settings so they protect clients without frustrating attorneys.
Don't Forget the Other Side of the Exchange
Files coming into the firm deserve attention too. Phishing emails often disguise themselves as shared documents from clients or courts. Train staff to be cautious with unexpected sharing links, especially ones that ask them to sign in before viewing.
A Quick Example
An associate shares a folder of a client's tax returns with the client's accountant using an open link. Months later, the accountant forwards an email containing that link to a mortgage broker. The broker's assistant forwards it again. Nobody at the firm knows the documents are still accessible.
Had the link been restricted to the accountant's email address with a 30-day expiration, the chain would have stopped at the first forward.
Building Confidence With Clients
Clients increasingly ask how their information is protected. A clear file-sharing approach answers that question and strengthens trust. Maise Technology helps law firms put the right cybersecurity and data protection controls in place.
If you'd like help reviewing your firm's sharing practices, Schedule A 15 Minute Discovery Call.
This article is for general information and is not legal advice.
