Cybersecurity is an imminent and costly threat to lawyers and their clients

Cybersecurity is a critical issue in handling the workers’ compensation claims process. Regulatory authorities and clients are mounting an increased concern that the legal profession must employ adequate measures to protect data from cyber attacks. The fragmented century old social insurance system is complex and expensive to operate and is now confronted with security measures that are more time consuming, cumbersome and expense to implement.

The progress of technology and the Internet of Things (IoT) is advancing logarithmically. The participants in the present workers’ compensation system need to be aware of the seriousness of cyber vulnerabilities as well their responsibilities to maintain the confidentiality of client’s interests and protect the legal strategies of the case.

An overriding question remains whether lawyers’ will be able to effectively protect their client’s confidentiality interests at any cost. Clients are becoming more sophisticated and they now demand that law firms adhere to security standards that will prevent a breach, and if a breach occurs that the law firm will take adequate action to provide notice and, mitigate the potential damage.

The ethical responsibility of lawyers, in most jurisdictions, is to take reasonable care to protect the personal information of clients in accordance with well-defined constitutional, statutory and administrative regulations, ethics opinions and the common law phraseology of the Restatement of Torts.

The urgency of this issue is evidenced by the constant news reports, including government alerts, of cyberattacks on all aspects of the virtual community. Cyber attacks occur on all  devices embracing the IoT including mobile devices. The obligation of maintaining data security extends to law firms’ agents, including third party service agencies, such as cloud based providers.

Homeland Security recently advised the public of the potential vulnerability of potential  crippling distributed denial-of-service (DDoS) attacks implemented by the IoT several weeks ago. Despite those efforts, a massive outage that occurred nationally in October 2016. Dyn, a company whose servers monitor and reroutes internet traffic was the target of massive interruptions throughout the internet. Initial  investigations report the cause as infections generated by the IoT devices that were unprotected.

The complex workers’ compensation system needs to address cybersecurity issues. Lawyers in most jurisdictions  are ill-prepared to handle these situations. They have not been afforded guidance through ICLE courses in technology or have performed due diligence on the subject. 

Medical information, financial data, PPI, employer’s trade secrets/productivity issues, and legal strategies are targets for hackers to harvest. The major perpetrators are: State sponsored agents, gangs of private hackers and disgruntled employees. The purposes of the attacks are for disruption of the system, economic gain generated ransom and/re-sale of cyber information, or just plain embarrassment.

Injured workers, employers and insurance companies are becoming more reluctant to enter into contracts of representation until  they have assured that the law firms handling their confidential information and personally protected information (PPI) will be secure and safe from intrusion and/or inadvertent disclosure. At this point in time there is no uniform standard of cybersecurity and threshold levels to create a protocol have become chaotic, and is compounded even further by what has become a national patch work of multi-jurisdictional workers’ compensation programs.

The economic “bite-back” of cybersecurity is insidiously expensive. Cybersecurity is an additional and huge cost to be absorbed into the cost doing business. While lawyers initially considered technology as both a time and cost saving tool, the reverse is actually true. Overall expenses may increased only 1% over recent decades, but cybersecurity costs are increasing 8% annually.

The complexity of the use of virtual technology demands that needs to be balanced between the easy of data availability and the the expense incurred to maintain the preventive and responsive protocols. Lawyers and law firms participating in the fragment national workers’ compensation system will need to implement cybersecurity protection programs/audits in order to prevent and react to these increasing threats.

Related: 
Cyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to victims, including the targeting of over 40 major financial institutions
Alert (TA16-336A) US-CERT 12.01.2016 

….

This article is based on my presentation on Cybersecurity  at the NJ ICLE seminar on Hot Topics in Workers' Compensation Law. The forthcoming 2017 supplement to the treatise Workers' Compensation Law (In Press) will provide extensive and expanded coverage on this topic.

Jon L. Gelman of Wayne NJ is the author of NJ Workers’ Compensation Law (West-Thomson-Reuters) and co-author of the national treatise, Modern Workers’ Compensation Law (West-Thomson-Reuters). 

For over 4 decades the Law Offices of Jon L Gelman  1.973.696.7900  jon@gelmans.com  has been representing injured workers and their families who have suffered occupational accidents and illnesses.

Updated: 12-01-2016

Hot Topics in Workers' Compensation Law Seminar 2016 - Available from NJICLE

This seminar is now available from NJICLE-Click here

Hot Topics in Workers' Compensation Law Seminar

Wed. Sept. 14, 2016  Ÿ Law Center, New Brunswick 5-8:35p

This year’s program will focus on professional and ethical responsibilities concerning disclosure and protection of client confidential information throughout the course of discovery and litigation, with specific emphasis on the pretrial conference.

The seminar +reviews the Professional Code of Responsibility and it’s integration with the Rules and procedures of The Division of Workers' Compensation, and The Health Insurance Portability and Accountability Act (HIPAA). 


Co-Moderators:
Jon L. Gelman, Esq,. Author of Workers' Compensation Law (Thomson-Reuters) (Wayne)
Nancy J. Johnson, Esq,, Certified by the Supreme Court as a Workers’ Compensation Law Attorney, Capehart & Scatchard (Mt. Laurel)

From the Bench:
Hon. Emille Cox, Administrative Supervising Judge of Workers’ Compensation (Camden)
Hon. Ashley Hutchinson, Administrative Supervising Judge of Workers’ Compensation (New Brunswick)

From the Bar:
Christopher Gargano, Esq., Certified by the Supreme Court as a Civil Trial Attorney (Jersey City)
Steve Secare, Esq. Certified by the Supreme Court of New Jersey as a Criminal Trial Attorney, District IIIA (Ocean County) Ethics Committee Secretary (Toms River)

Ralph Smith 3rd, Esq., Co-Chair, Labor & Employment Group, Capehart & Scatchard (Mt. Laurel)

From the Medical Profession:
Steven G. Crawford, M.D., Certified Medical Examiner (CIME) (Eatontown)

Time	Facilitator	Segment	Panel
Panel 1	Hon. Ashley Hutchinson, Steven G. Crawford, M.D., Christopher Gargano, Esq., Jon L. Gelman Esq., Esq., Nancy J. Johnson, Esq.,  Steve Secare, Esq., Ralph Smith 3rd Esq,		1
5:00 PM	Jon L. Gelman Esq. Nancy J. Johnson, Esq.	Introduction	1
5:01 PM	Ralph Smith 3rd, Esq,	Health Insurance Portability and Accountability Act (HIPAA): Protection of confidential client information and ethical responsibility of Workers’ Compensation practitioners.	1
5:23 PM	Ralph Smith 3rd, Esq,	Health Insurance Portability and Accountability Act (HIPAA): Proper protection of personal identifying information in pleadings, discovery and exhibits.	1
5:45 PM	Steve Secare, Esq.	Recognition of and dealing with conflicts of interest.	1
6:07 PM	Christopher Gargano, Esq.	How and when to withdraw and terminate client representation.	1
6:29 PM	Break
Panel 2	Hon. Emille Cox, Hon. Ingrid French, Hon. Philip Tornetta, Christopher Gargano, Esq., Jon L. Gelman Esq., Esq., Nancy J. Johnson, Esq., Steve Secare, Esq.		2
6:44 PM	Jon L . Gelman, Esq.	Meeting the challenge of cyber security.	2
7:06 PM	Hon. Emille Cox	Maintaining pretrial conference decorum and confidentiality of client protected information.	2
7:28 PM	Steve Secare, Esq.	Appropriate communication method with clients, adverse parties and the Court.	2
7:50 PM	Hon. Philip Tornetta	Representing minors and incompetents	2
8:12 PM	Hon. Ashley Hutchinson	Settling a claim with appropriate authority and enforcement of the settlement.	2
8:34 PM	Jon L. Gelman Esq. Nancy J. Johnson, Esq	Closing Remarks	2
8:35 PM	Adjourn

NJ CLE ETHICS: This program is approved for 4.0 credits (50 minute hour), including

 4.0 ethics/professionalism credits.

Available for purchase

This seminar is now available from NJICLE-Click here

New Jersey Institute for Continuing Legal Education A Division of the NJSBA

One Constitution Square, New Brunswick, NJ 08901

Phone: (732) 214-8500 · Fax: (732) 249-0383 · CustomerService@njsba.com

ICLE is a fully accredited CLE provider in NJ, NY & PA. 

Updated: September 20 2016

Privacy: Court Mandates Protective Order for Workers' Compensation Discovery

Plaintiff in mesothelioma case sought production of defendant's (Union Carbide Corp) employees' workers' compensation claim records. The corporate defendant, Union Carbide Corp) sought to restrict access and limit dissemination of the records of the workers' compensation matters sought through discovery.

Confidentiality is a two sided sword. Historically asbestos litigation had its genesis in workers' compensation claims. In this instance the Corporate Defendant sought the utilization of privacy restrictions as a defense.


Case reversed & remanded by Appellate Division so that Trial Judge could craft a Protective Order to embrace statutory "privacy requirements" of workers' compensation records. This decision restricts dissemination and use of discovery of workers’ compensation records obtained in this case for use in other matters.

"A participant in a workers' compensation hearing who agrees to the disclosure of medical records does so for the limited purpose of establishing a right to benefits, and does not intend or anticipate the release of that information for use in unrelated litigation."

Appellate Division ordered the trial judge to include the following restrictions:
"(1) the type of record requested; (2) the information it does or might contain; (3) the potential for harm in any subsequent nonconsensual disclosure; (4) the injury from disclosure to the relationship in which the record was generated; (5) the adequacy of safeguards to prevent unauthorized disclosure; (6) the degree of need for access; and (7) whether there is an express statutory mandate, articulated public policy, or other recognized public interest militating toward access."

The Court reasoned that both the Due Process Clause of the Fourteenth Amendment as well as the statutory restrictions of confidentiality N.J.S.A. 34:15-128(a)(1) and N.J.S.A. 34:15-128(3) required that a strict Protective Order be entered.

Seymoure v. A.O. Smith Water Products Company, et al 2016 WL 1589917 Decided 4/20/16
Limited time access at: http://www.judiciary.state.nj.us/opinions/a3967-14.pdf

The Security of Metadata in Workers' Compensation Claims

Metadata Ethics Opinions Around the U.S.
Source: aba.org

Confidentiality is a crucial element in workers' compensation matters and the removal of metadata in electronically transmitted documents are a critical factor in the process of maintaining the level of security embraced by the system. Metadata is all hidden data in a PDF file, including text, metadata, annotations, form fields, attachments, and bookmarks.


"....Metadata is loosely defined as "data about data." More specifically, the term refers to the embedded stratum of data in electronics file that may include such information as who authored a document, when it was created, what software was used, any comments embedded within the content, and even a record of changes made to the document.

"While metadata is often harmless, it can potentially include sensitive, confidential, or privileged information. As such, it presents a serious concern for attorneys charged with maintaining confidentiality -- both their own and their clients. Professional responsibility committees at several bar associations around the country have weighed in on attorneys' ethical responsibilities regarding metadata, but the opinions vary significantly. Source: The American Bar Association
The NJ Supreme Court announced yesterday, in an Administrative Determination,  that all documents in electronic format should be "scrubbed" of metadata.

"The Court addressed an important ethical question raised by New Jersey practitioners in the context of their contemporary practice: whether a lawyer who receives an electronic document may, consistent with the rules governing attorney ethics, review metadata in that document. “Metadata” is embedded information in electronic documents that is generally hidden from view in a printed document. Metadata may reflect such information as the author of a document, date(s) on which the document was revised, tracked revisions, and comments inserted in the margins, among other things. This embedded electronic information may include privileged information or other potentially objectionable, private or proprietary information. Following a careful review, the Court adopts the recommendations of the Working Group on Ethical Issues Involving Metadata in Electronic Documents, and makes a number of amendments to the Court Rules regarding electronic documents and metadata. The measures are designed to protect sensitive client data, clarify attorneys’ professional obligations, and foster education programs so that the legal community may be better equipped to meet the unique challenges inherent in exchanging documents electronically -- a modern reality that is ubiquitous in the contemporary practice of law.

“Metadata” is embedded information in electronic documents that is generally hidden from view in a printed copy of a document. It is generated when documents are created or revised on a computer. Metadata may reflect such information as the author of a document, the date or dates on which the document was revised, tracked revisions to the document, and comments inserted in the margins. It may also reflect information necessary to access, understand, search, and display the contents of documents created in spreadsheet, database, and similar applications. This embedded electronic information may include privileged information, information subject to the work product privilege, information that has not been requested in discovery, information that has been requested in discovery but is subject to an objection on which a court has not yet ruled, non-discoverable information, and private or proprietary information. Some metadata is of little or no use to a party or counsel in a litigated dispute or transactional matter. Other metadata is directly material to a factual or legal issue. If the sender has not affirmatively minimized (“scrubbed” or “stripped”) metadata in the document, some information may be revealed by simple computer keystrokes, while other metadata may be “mined” by the use of sophisticated computer software.

Professional programs are available to remove Metadata from electronic documents. See,
Sanitization—Remove hidden data from PDF files with Adobe® Acrobat® XI