Ethics Opinion 290: Disclosure of Protected Information of Insureds to Insurers and Outside Auditing Agencies

Inquiry
The inquirer is a law firm that defends insureds and is paid by an insurer. The law firm requests the Committee’s opinion regarding a lawyer’s ethical obligations to the insured when the insurer has retained an outside agency to audit its legal bills. To facilitate these audits, the insurer requires that the law firm submit detailed billing information to the outside auditing agency. In turn, the auditing agency has requested that the law firm’s billing invoices contain descriptions of activities that are “specific enough to allow a person unfamiliar with the case or billing attorney to determine what function they are performing.” The auditor also has requested that the law firm provide in support of its invoices detailed information and materials that appear to be protected by Rule 1.6. Examples of the level of detail the auditors expect the law firm to provide include the identity of participants, the content of all communications (telephone calls, correspondence, meetings), specific issues researched, the specific trial preparation performed, and the identity of material or documents reviewed and written work product generated in the representation of the client.
The first question we turn to is whether and under what conditions, consistent with the D.C. Rules of Professional Conduct, the law firm may release a client’s confidential information directly to an insurer. The Committee concludes that the law firm ethically may submit an insured’s detailed bills that contain protected information to the insurer only after the lawyer has informed the insured about the nature and potential consequences of both the requested disclosure and non-disclosure and the insured has consented to the release of the information. Disclosure of such information to an independent auditing agency also may occur only with consent of the insured after disclosure. Consent to disclose confidences and secrets to the insurer may not provide a basis to infer consent to disclose the same information to another entity who performs work for the insurer.

Discussion

The Applicable Rules
D.C. Rules of Professional Conduct 1.6 and 1.8(e) control the relationship among a lawyer, a client, and a third party who is paying for the lawyer’s representation of the client.
     Rule 1.8(e) prohibits a lawyer from accepting compensation for representing a client from one other than the client unless: 1) the client consents after consultation; 2) there is no interference with the lawyer’s independence of professional judgment or with the client-lawyer relationship; and 3) information relating to a client’s representation is protected as is required by Rule 1.6. Comment [6] to the Rule reiterates the need, when a third party is responsible for payment of the client’s legal fees, to protect the client’s confidences and secrets from unauthorized disclosure and emphasizes the requirement that the lawyer may not represent a client under such circumstances if a conflict of interest arises. Thus merely because an insurer is paying the insured’s legal expenses does not alter the lawyer’s duty to protect his clients’ confidences and secrets under Rule 1.6.
     When an insurer requests that an attorney furnish it with information concerning representation of the insured, a lawyer representing the insured must determine, as a threshold matter, whether client confidences or secrets are involved. Whether a billing statement contains client confidences (information protected by the attorney-client privilege) or client secrets (information gained in the professional relationship that the client has requested be held inviolate or the disclosure of which would be embarrassing, or would likely be detrimental to the client) will depend on the content of the statement. While some billing statements may not reflect protected information, at least some of the information and materials described by the inquirer clearly fall within the protection of Rule 1.6.
     Under Rule 1.6, a lawyer may not knowingly reveal a confidence or secret of the client or use a confidence or secret of a client for the benefit of a third party unless one of three relevant exceptions is met: 1) the client consents after full disclosure 2) the lawyer has “reasonable grounds for believing that a client has impliedly authorized disclosure in order to carry out the representation”; or 3) disclosure is permitted by these Rules, or “required by law.” Rule 1.6 (d) (1) (2), (4). With respect to the exception for implied authorization, the set of facts presented to the Committee does not suggest that divulging the information to the insurer is necessary to performing the job for which the lawyer was retained. Therefore, the Committee concludes that the circumstances of the retention by the insured do not imply authorization to disclose. While payment for legal services is no doubt important to the client, the Comments to the Rules compel a narrower interpretation of this exception. To illustrate the scope of the implied authorization exception, the Comments provide two examples: “a lawyer may disclose information by admitting a fact that cannot properly be disputed or in negotiation by making a disclosure that facilitates a satisfactory conclusion.” Comment [9]. As these examples suggest, implied authorization is limited to situations in which disclosure is essential to the purpose of the representation. Moreover, given the express mandate of Rule 1.8(e) requiring protection of client confidences and secrets from disclosure to third party payers, this general exception should not be construed to so easily negate those protections.
     Nor do other provisions of the Rules or the requirements of any laws permit disclosure of an insured’s confidences and secrets to the insurer for auditing purposes. Comment [11] indicates that
“[u]nless the client otherwise directs,” a lawyer is permitted to reveal “limited information from client files to an outside agency necessary for statistical, bookkeeping, accounting, data processing, banking, printing, or other legitimate purposes, provided the lawyer exercises due care in the selection of the agency and warns the agency that the information must be kept confidential.” Comment [11] covers the lawyer’s use of third parties such as accountants to perform business functions, where the lawyer has the power to select and control the third party. Comment [11] is not applicable where, as here, the information sought is substantive and the lawyer neither selects the auditor nor controls its use of the information.
     Other provisions of the Rules that allow divulging confidences or secrets—for example, to defend against allegations by the client concerning the representation, to prevent imminent serious bodily harm or when required by law or court order—are inapplicable. Thus, a lawyer may only share confidential information of the type described by the inquirer with the insurer with the consent of the client after full disclosure.
Effect of the Contract of Insurance
The insurance contract or other agreements the insured entered into in submitting the claim may grant the insurer access to confidential or secret information. The lawyer’s duty to the insured, however, is governed by the Rules of Professional Conduct, not by the insurance contract. The lawyer will need to review these provisions with the client to determine whether they constitute the informed consent for disclosure required by Rule 1.6.
     Consent is defined by the Rules to mean “a client’s uncoerced assent to a proposed course of action, following consultation with the lawyer regarding the matter in question.” Rules, Definitions section. Neither Rule 1.6 nor the Comments elaborate on what is meant by full disclosure. However, the Rules define consultation to mean “communication of information reasonably sufficient to permit the client to appreciate the matter in question”. The commentary to Rule 1.7, dealing with disclosure of and consent to waivable conflicts of interest, notes that “disclosure and consent are not mere formalities.” Rule 1.7, Comment [19].
     In the matter before the Committee, the lawyer must evaluate the reasonably foreseeable adverse consequences of disclosure and inform the client of the adverse effects that may result, in a manner consistent with the client’s level of sophistication. In re James, 452 A.2d 163-167 (D.C. 1982). The consequences of disclosure and the adequacy of any general consent by the client in the insurance contract will inevitably turn on the facts and circumstances of the particular case. For example, if the information sought is subject to an evidentiary privilege, the consequences of disclosure to a third party are potentially far more serious than if the information involves client secrets that would be subject to discovery in any event. Furthermore, the risk of losing privileged status for the confidential information sought may be diminished by the nature of the relationship between the insurer, insured, and lawyer which may have a colorable basis of joint privilege. Even if waiver of privileged material is likely to occur, in some cases the negative effects of such a waiver may be negligible.
     Similarly, the consequences to the insured of not consenting to disclosure must be evaluated with the client. For example, the insurance contract may require the insured to cooperate in the defense of the claim or allow disclosure of confidential information and failure to agree to disclosure could risk loss of insurance coverage.
     In seeking client consent to the release of information to the insurer, an attorney should be cognizant of the possible conflict between his interests and the client’s interests. See 1.7(b)(4). The lawyer may have a financial interest in avoiding an audit of his billing practices, and should avoid exaggerating the risks of disclosure to a client whose consent to disclosure is sought. Conversely, a lawyer may have an interest in cooperating with the insurance company to preserve the lawyer’s business relationship with the insurance company. In sum, the disclosure to the client in order to obtain adequate consent within the meaning of Rule 1.6 must adequately and fairly identify the effects of disclosure and non-disclosure on the client’s interests and will depend on the facts and circumstances of each case.
     It has been suggested that the existence of legal privilege provides a basis to infer consent to disclosure or implied authorization. Communications among the insurer, insured and lawyer may be privileged, at least in part, because the lawyer is representing both parties, because there is a joint defense agreement or because a legal doctrine governing the “tripartite” relationship of insurer-insured-attorney applies. This is a matter of substantive law beyond the scope of the Committee’s opinion. In any event, the mere existence of a possible privilege among insurer, insured and counsel does not in and of itself provide a basis to infer client consent to disclosure of confidences or secrets. Except as allowed by Rule 1.6, a lawyer may not release information relating to the representation of a client to anyone, including a co-client, unless the first client consents after disclosure or an exception is met. To the extent it is relevant, the existence of a joint privilege may bear on the consequences of disclosure of which the client must be apprised before consenting.
Release to an Auditor
The inquirer has also asked whether it would be ethically permissible to provide the same detailed billing information and work product directly to the outside auditing agency. If the auditor is an independent entity from the insurance company, disclosure to the auditor is only permissible if the provisions of Rule 1.6 have been met. Even if disclosure to the insurance company has been consented to by the client, that consent should not be assumed to include consent to disclosure to a third party auditor. The Rule 1.6 considerations we have described with respect to insurance company disclosure should be separately addressed when disclosure to an auditor is requested.
     We note that many other jurisdictions have issued opinions addressing the same or similar facts and have concluded that the insured’s consent after disclosure is necessary before a lawyer may disclose protected information to outside auditing agencies. See Utah State Bar Opinion 98-003; Florida Bar Staff Opinion 20591, December 31, 1997; Alabama State Bar (unnumbered); South Carolina Ethics Advisory Opinion 97-22; Kentucky Bar Association, KBA E-404; North Carolina Proposed 98 Formal Ethics Opinion 10; Louisiana State Bar Association (unnumbered); Indiana State Bar Association, Opinion 4 of 1998, Virginia Legal Ethics Opinion 1723, Maryland State Bar Association, Inc., Committee on Ethics Docket No. 99-7. A number of these decisions specifically address the different status of the insurer and the third party auditing agency. See, e.g., Virginia Opinion 1723, Indiana Opinion 4 of 1998, Maryland Opinion No. 99-7, Alabama State Bar Opinion RO-98-02.
     The Massachusetts Bar Ethics Committee has taken a somewhat different approach, concluding that if a client has consented to disclosure of protected information to the insurer, the information may be disclosed to an independent auditing company retained by the insurer without further client consent if the lawyer is satisfied that the auditor has taken reasonable steps to protect confidentiality of the disclosed information. Mass. Bar Opinion, November 22, 1997. We do not adopt this approach. We find nothing in the D.C. Rules of Professional Conduct that supports the conclusion that consent to disclosure to the insurer may be used to infer consent to disclosure to other third parties whose purpose it is to assist the insurer in its business, not the attorney in representing the client’s interests. Even if disclosure to the insurance company has been consented, to, the Rule 1.6 considerations that we have described with respect to insurance company disclosure should be separately addressed when disclosure to an auditor is requested. For example, where applicable law affords privileged status to communications among the insurer, insured and the insured’s attorney, disclosure by the insurer to a third party could effectively waive the privilege. See Indiana State Bar Opinion No. 4, 1998. In this regard we note that if disclosure to a third party without client consent has the effect of waiving the privilege, other ethical provisions become relevant. See, e.g., Rule 1.1 (Competency), Rule 1.4(b) (Communication) and Rule 1.6 (interference with professional judgment and attorney-client relationship by person paying rather than client).
     The inquirer also asked whether the Rules of Professional Conduct apply if the lawyer provides the protected information to the insurer, who then sends it to the outside auditor. The Rules of Professional Conduct do not apply to an insurer and insurance companies are therefore not bound by this opinion. Prior to disclosure of protected information to the insurer, however, the lawyer should instruct the insurer not to release the protected information and should designate all such information clearly. If there is reason to believe that the insurer will not follow this instruction, the lawyer should so advise the client, prior to disclosure, explaining any additional risks that would result from disclosure by the insurer to a third party.

Conclusion
The requirements of Rules 1.6 and 1.8 need not be impediments to effective representation of insured clients or to the interests of insurers. Identification of each party’s interests and informed disclosure at the outset of the representation should allow a workable relationship that meets the insured and insurer’s needs and the ethical obligations of the lawyer. For example, at the outset the attorney could identify with the insurer and auditing agency the type of information that would be requested during the representation and discuss with the client the legal effects of such disclosure. In assessing the legal effects, the lawyer may wish to evaluate the agreement between the auditor and the insurer regarding procedures to protect confidential materials. Where agreement is reached at the outset regarding the scope of disclosure to the insurer or auditor, the lawyer must continue to be vigilant throughout the representation to the scope of the consent and obtain new or updated client consent where appropriate.

Inquiry No. 98-6-17
Adopted: April 20, 1999