Secure client intake: how to replace email attachments with a client portal

Why is email a weak channel for client intake documents?

Because an attachment, once sent, is out of the firm's control. A client portal for law firms fixes this by keeping each file in one controlled place. An emailed attachment sits in the client's sent folder, the firm's inbox, every forwarded copy and every phone that syncs either mailbox, with no expiry and no record of who opened it. Intake is when that matters most: new clients send tax returns, medical records, bank statements, IDs and settlement papers before anyone has set up a matter workspace.

The documents themselves raise the stakes. California's breach notification statute, Civil Code section 1798.82, treats a name combined with an unencrypted Social Security number, driver's license or other government ID number, financial account number with its access code, medical information or health insurance information as personal information. A firm that owns or licenses that data must notify affected California residents within 30 calendar days of discovering a breach, subject to limited delays the statute allows. A compromised mailbox full of intake attachments is exactly that kind of event, and the State Bar's Formal Opinion 2020-203 adds a separate duty to tell affected clients.

Email also carries the scams. When clients learn to expect documents and instructions by email, a forged request looks routine. Our piece on verifying trust account payouts covers how a compromised mailbox turns into a misdirected wire.

What do the ethics rules require for client communications?

They require reasonable steps to protect client information, and they do not ban email. In California the duty starts with Business and Professions Code section 6068(e)(1), which requires an attorney to maintain inviolate the confidence and preserve the secrets of a client. Comment [1] to rule 1.1 ties competence to understanding the benefits and risks of relevant technology.

The State Bar's Formal Opinion 2010-179 sets out what to weigh before using a technology to transmit or store confidential information: its level of security and whether precautions can raise it, the legal consequences for someone who intercepts it, the sensitivity of the information, the impact of a disclosure on the client, the urgency of the situation and the client's instructions and circumstances. The opinion notes that encryption may be a reasonable precaution for highly sensitive information, and that if a client instructs the lawyer not to use a technology, it should not be used.

ABA Formal Opinion 477R (May 2017) reaches a similar place under Model Rule 1.6(c). It treats reasonable efforts as a fact-based analysis, calls for particularly strong protection such as encryption for highly sensitive information, and recommends agreeing with the client on how each type of communication will be protected. ABA opinions are persuasive in California, not binding. Comment [18] to the Model Rule also recognizes that a client may ask for more security than the rule requires, or give informed consent to less.

Is a client portal for law firms better than encrypted email?

For intake documents, usually yes, because a portal changes where the file lives. Encrypted email protects the message in transit, but the attachment still lands in mailboxes and can be forwarded. A portal or secure upload request puts the file straight into a controlled location, ideally the matter workspace, where access is limited, logged and governed by the firm's retention schedule.

A good intake channel does five things:

• Requires sign-in with multi-factor authentication for staff, and at least a one-time code for clients.
• Uses upload-only requests with an expiry date, so a link cannot be reused to browse or download other files.
• Files each upload into the correct matter, where existing permissions and matter-based sensitivity labels apply.
• Logs who uploaded, viewed and downloaded each file.
• Follows the firm's file retention policy instead of keeping copies indefinitely.

Encrypted email still has a role for clients who cannot use a portal, and for sending documents out. The goal is fewer copies of sensitive files in inboxes.

What should a firm check before choosing a portal vendor?

Whether the vendor can protect client information to the same standard the firm owes. Opinion 477R lists vendor due diligence among its considerations, and California rules 5.1 and 5.3 make managing lawyers responsible for reasonable measures that keep lawyers and nonlawyer assistants in line with the rules. A portal vendor that stores client files is part of that picture. Ask:

• Where are files stored, are they encrypted at rest and in transit, and who at the vendor can access them?
• Does the vendor use uploaded files for any purpose beyond providing the service, including training AI features?
• Will the vendor notify the firm promptly after a security incident, and what logs will it provide?
• Can the firm export everything and confirm deletion when the contract ends?

Firms that keep California residents' personal information should also note Civil Code section 1798.81.5, which requires reasonable security procedures appropriate to the nature of the information and requires contracts that oblige third parties receiving it to do the same.

Often the best option is a feature of a system the firm already licenses, such as its document management or practice management platform, because uploads land beside the rest of the matter and inherit its access controls.

How do you get clients to actually use the portal?

Make the portal the default from the first contact, and explain why. Clients follow the process they are given at engagement. If the engagement letter and welcome email say documents go through the portal, most clients use it.

Three habits make the switch stick. Send the portal link from a predictable place, such as the firm's website or a message the client was told to expect, so clients do not learn to trust any link that arrives by email. Give staff a short script for when a client emails documents anyway: thank them, move the files into the matter, and point them to the portal next time. Keep a documented path for clients who cannot use the portal, such as encrypted email or in-person delivery, so staff are not improvising.

When a client prefers plain email after hearing the risks, Opinion 2010-179 treats client instructions as part of the analysis and Comment [18] contemplates informed consent to fewer safeguards. Record that choice in the matter file. The counsel review list below covers when to confirm that choice for a sensitive matter.

What should a law firm do this quarter?

Start by mapping how documents arrive today, then move intake to one channel and tell clients about it. Seven steps cover it:

1. Map how intake documents arrive today: email, text, personal accounts, fax-to-email and any free file-sharing tools staff have used.
2. Choose one intake channel and set it up with MFA, expiring upload-only links and automatic filing into matters.
3. Review the vendor's security, data use, incident notice and exit terms, and keep the review in the file.
4. Update engagement letters and welcome emails to state how the firm will request documents and that it will never ask for them through an unexpected email link.
5. Train attorneys and staff on the new process and the script for emailed documents, and record who completed it.
6. Clean up: find old intake attachments sitting in mailboxes and move or delete them under the retention policy.
7. Watch the accounts that touch intake for risky sign-ins, since one compromised staff mailbox can still expose what clients sent before the change.

What should your counsel review before you change intake?

Do this review before the new intake channel goes live, and again whenever a client asks to send sensitive documents by plain email. Bring these decisions to your counsel:

• Client consent to fewer safeguards: whether a client's informed choice to use plain email is enough for a given matter, under State Bar Formal Opinion 2010-179 and Comment [18] to ABA Model Rule 1.6. Bring the client's written instruction and a description of the documents involved.
• Portal vendor contract: whether the agreement meets the contract requirement in Civil Code section 1798.81.5(c). Bring the vendor agreement, its security terms and its data-use terms.
• Engagement letter language: how the letter describes the firm's document channel and records client instructions, given Business and Professions Code section 6068(e)(1). Bring the engagement letter template and the welcome email.
• Breach notice duties: how the firm would notify clients and California residents if an intake mailbox or the portal is compromised, under Civil Code section 1798.82 and Formal Opinion 2020-203. Bring the incident response plan and a list of the data types collected at intake.

How does s90 help law firms with secure intake?

s90 manages IT for law firms across Los Angeles and Orange County. We help firms choose and configure an intake channel inside the tools they already use, set up MFA, labels and logging around it, and clean up the attachments that have built up in mailboxes. If you want a second look at how your firm collects client documents today, we are happy to talk it through.