Google, Microsoft and Adobe are all moving towards offering their main applications through SaaS (see Microsoft’s interest, Google Apps and Adobe Air). If the experts are right, one day you’ll simply have a computer which connects to the Internet, run Windows from Microsoft’s servers (with the most up-to-date patches, security and anti-virus automatically done) and use all of your applications and documents which are stored on a large server farm in Idaho.

In the legal market, there are many companies vying to gain the attention of lawyers such as VLOTech, RocketMatter and Clio. The problem these companies are running into, besides lawyers being unnecessarily squeamish about their data not being on their computers/servers, is the question of the ethics of such off-loading of confidential and sensitive client data.

Fortunately, several lawyers have queried progressive state bar associations in an attempt to push their respective state’s forward ahead of this growing trend. In a recent Proposed Ethics Opinion from the North Carolina State Bar, the concept of a web-based law firm mangement system was addressed:

The use of a web‑based management system that allows both the law firm and the client access to the client’s docketing information or other information in the client’s file is permissible provided the lawyer can fulfill his obligation to protect the confidential information of all clients. A lawyer must take steps to minimize the risk that confidential client information will be disclosed to other clients or to third parties. See RPC 133 and RPC 215. It is not acceptable for one client to have access to another client’s information absent client consent. This risk is not cured by an agreement from a client or a client’s in‑house counsel not to view the confidential information of another client. A security code access procedure that only allows a client to access its own confidential information would be an appropriate measure to protect confidential client information.

If the law firm will be contracting with a third party to maintain the web‑based management system, the law firm must ensure that the third party also employs measures which effectively minimize the risk that confidential information might be lost or disclosed. See RPC 133.