A law firm does not need to encrypt every email, but it does need a defensible rule for which messages get encrypted, a tool that protects them in transit and at rest, and staff who follow that rule. Ethics guidance in Texas and nationally asks for reasonable, competent safeguards, and sensitive client data is where that standard bites hardest. This guide covers what the rules say, how the encryption types differ, and how to put a workable policy in place.
TL;DR
- Ethics rules do not require encrypting every message. They require reasonable measures, and the right measure depends on how sensitive the content is and what you know about the client's situation.
- Always encrypt, or move to a secure portal, for Social Security numbers, financial account numbers, driver's license numbers and similar data.
- Transport encryption (TLS) protects a message on the wire. Only end-to-end or portal-based approaches keep it protected after delivery.
- Encryption fails when people skip it. A written policy, simple tooling and training matter as much as the cryptography.
- A virtual CISO can set the policy, vet the tools and document your reasoning so you can show it if a client, insurer or bar asks.
Table of Contents
- What the ethics rules actually require
- When to encrypt, and when plain email is fine
- What email encryption protects: transit, rest and end to end
- Secure links, encrypted attachments and client portals
- Rolling out encryption without stalling the practice
- What encryption does not fix
- Our perspective: encryption is a policy decision first
- Getting help with the policy and the evidence
- FAQ
- Sources
What the ethics rules actually require
Start with the duty. Attorneys have ethical and common law duties to take competent and reasonable measures to safeguard client information, and many also carry contractual and regulatory duties, according to the American Bar Association's guidance on competent and reasonable safeguards. The same guidance says attorneys must understand the requirements, threats and safeguards that apply, learn them, or get qualified help.
Notice what that language does not say. It does not say "encrypt everything." It sets a standard of reasonableness and leaves the firm to show its work.
Texas Opinion 648
For Texas firms, the key document is Opinion 648 from the Professional Ethics Committee for the State Bar of Texas. In April 2015 the committee concluded that lawyers may generally communicate confidential information by email under the Texas Disciplinary Rules of Professional Conduct. It added that particular circumstances may call for heightened security, including encryption.
The opinion ties this to Rule 1.05, which prohibits knowingly revealing confidential information. Whether a lawyer violated it is judged case by case, by asking whether the lawyer knowingly disclosed information to an unauthorized person.
The circumstances the opinion flags for considering encryption are practical ones:
- You are sending highly sensitive information.
- The email account is shared by more than one person.
- You know the client reads email on an unsecured or public device or network.
That third factor is the one firms miss. Your server may be locked down while your client reads privileged advice on a family tablet or an airport network. Once you know that, the reasonable response changes.
Does email lose privilege because it is electronic?
Readers often ask whether emailing a lawyer is confidential at all. In general, yes. California's evidence code, as discussed by the State Bar of California's ethics committee in 2010, provides that a privileged communication does not lose that character solely because it is delivered electronically, even when intermediaries might have access. That is a California rule and a 2010 opinion, so treat it as persuasive background rather than Texas law. Its larger point holds everywhere: confidentiality and privilege exist so clients feel safe telling their lawyers the whole story. A breach of that trust costs more than a fine.
Privilege protects against compelled disclosure. It does not stop a criminal from reading a mailbox. That gap is what encryption and access controls close.
When to encrypt, and when plain email is fine
A blanket rule of "everything encrypted" sounds safe, but it tends to collapse in practice. Staff route around friction. A tiered rule survives.
Guidance from the U.S. Court of International Trade says encryption is appropriate for sensitive information such as Social Security numbers or financial account records, or when specific threat factors are present, such as a client on shared devices. It also notes that routine messages like scheduling or administrative updates can go by unencrypted email. The same document states that data such as Social Security, driver's license and financial account numbers should not be transmitted electronically without encryption.
A practical three-tier model built on that guidance:
| Tier | Examples | Handling |
|---|---|---|
| Routine | Meeting times, document-received confirmations, general status | Standard email with enforced TLS |
| Sensitive | Draft agreements, settlement positions, medical or employment details, strategy | Encrypted email or secure portal |
| Restricted | SSNs, bank and account numbers, driver's license numbers, trade secrets, protected health information | Portal or end-to-end encrypted message only, never in an attachment on plain email |
Two additions make the model work. First, let any lawyer or staff member escalate a message to a higher tier without asking permission. Second, record in each matter file any client-specific risk you know about, such as a shared home computer or a spouse with access to the inbox. That record is your evidence that you applied the Opinion 648 factors.
What email encryption protects: transit, rest and end to end
Vendors use these terms loosely, and the differences decide whether a product fits a law firm.
Encryption in transit. The message is scrambled while it moves between mail servers. The common standard is TLS. If both sides support it, eavesdroppers on the network see nothing useful. The weakness is that TLS protects each hop, not the message itself. Once the message lands, the receiving provider can read it, and it sits in readable form in the recipient's mailbox.
Encryption at rest. The stored copy is encrypted on the server or device. This protects against stolen drives and some forms of server compromise. It does not help if an attacker logs in with a stolen password, because the system decrypts the mail for the legitimate account.
End-to-end encryption. The message is encrypted before it leaves the sender and can only be decrypted by the recipient's key. Providers in the middle cannot read it. The tradeoff is usability: the recipient needs a way to open it, whether a key, a certificate or a browser-based retrieval step.
The North Carolina Bar Association advises lawyers to check that a tool secures data both in transit and at rest, and notes that features such as expiration dates, self-destruct and "do not forward" rules can further reduce risk. It also makes a point worth repeating: security is not binary. You need to make sure protection holds after the message is decrypted, for example so that it does not sit unencrypted on the recipient's hard drive.
A quick test for any product
Ask these five questions of any tool you are considering:
- Does it protect the message in transit and in storage?
- Can the vendor read the message content, and under what circumstances?
- What does the client have to do to open it, and will they actually do it?
- Can you revoke access or set an expiration after sending?
- Does it keep an audit trail of who opened what and when?
If a product cannot answer question 3 well, it will be bypassed, and a bypassed control is not a control.
Secure links, encrypted attachments and client portals
Encrypted email is one option. For many matters it is not the best one.
According to the ABA's guidance on modern communication tools, encrypted client portals suit substantive communications because they give a secure way to talk and share documents. The author, Alexander Paykin, calls a secure portal the most protected way to communicate electronically and recommends mentioning portal use in the engagement letter.
How the options compare in practice:
| Method | Best for | Watch out for |
|---|---|---|
| Enforced TLS email | Routine messages | Does not protect after delivery |
| Encrypted email (end to end) | Individual sensitive messages with a client who will use it | Recipient friction, key management |
| Password-protected attachment | A stopgap | Password often sent in the same thread, which defeats the point |
| Secure link with expiry | Large files, one-time deliveries | Links forwarded without controls |
| Client portal | Ongoing matters, document exchange, intake | Client adoption, onboarding effort |
The portal also solves a problem encryption does not: version sprawl. When documents live in one controlled place, you are not hunting for attachments across a dozen inboxes, and you can close access when the matter ends.
Rolling out encryption without stalling the practice
Most failed rollouts have the same cause: a tool was bought before a policy was written. Do it in this order.
- Inventory what you send. Look at 30 days of outbound mail by practice group. Which matters involve financial data, health data or personal identifiers? That tells you where Tier 2 and Tier 3 handling is needed.
- Write the rule in one page. Define the tiers, who can escalate, and what to do when a client refuses a secure method. Reference your duty of competence and Rule 1.05 so the document reads as an ethics control, not an IT preference.
- Choose tooling that fits the weakest user. If your most senior partner and your least technical client cannot use it unaided, pick again.
- Put it in the engagement letter. Tell clients how you will communicate, what you will ask them to use, and what they should avoid, such as reading privileged mail on shared or public devices.
- Turn on the enforcement settings. Require TLS for outbound mail, flag messages that contain SSN or account-number patterns, and enable multi-factor authentication on every mailbox.
- Train, then test. Short sessions and simulated phishing do more than an annual lecture. Phishing is how attackers get around encryption, because they take over the account that legitimately holds the decrypted mail. Our overview of law firm cyber threats shows how those attacks usually begin.
- Review quarterly. Check exceptions, failed deliveries and any client complaints about the secure method.
Retention and recipient verification
Encryption raises two housekeeping questions. Retention: decide how long encrypted messages and portal records stay, and make sure your archive can still open them years later, which means keeping access to keys or using a system that does it for you. Verification: before sending a Restricted message, confirm the recipient address by a second channel, such as a call to a number already in your file. Misdirected email is a more common cause of disclosure than interception, and encryption to the wrong person protects nothing.
What encryption does not fix
Encrypted email stops a narrow class of problems. Several larger ones remain:
- Compromised accounts. A stolen password gives an attacker the decrypted view. Multi-factor authentication and conditional access matter more here than the cipher.
- Endpoints. A malware-infected laptop reads mail after decryption.
- Vendors. Your portal, e-discovery platform and cloud mail host all touch client data. See our steps for third-party risk in law firms and our guide to eDiscovery security controls.
- Human error. Wrong recipient, wrong attachment, reply-all.
- Changing threats. The tools you chose three years ago may no longer fit. Reviewing the safeguards is part of the job, and it helps to understand how data breaches and leaks unfold so that you can judge which of your controls would have mattered.
For a broader view of how encryption fits among other controls, see our list of five client confidentiality controls and the cybersecurity frameworks used by law firms.
Our perspective: encryption is a policy decision first
We work with law firms, oil and gas companies and other regulated organizations in Houston and across the U.S., and the pattern is consistent. Firms rarely lack an encryption product. They lack a decision about when it is used, who owns that decision and how it is documented.
The ethics standard is reasonableness, so your best protection is a record that shows reasoning: the data you handle, the risks you identified, the controls you chose and why. A firm that can produce that record in an hour is in a very different position from one that says "we think everyone uses the secure option." That record also helps with cyber insurance questionnaires, client security reviews and outside counsel guidelines, which increasingly ask the same questions.
Our advice to managing partners is to treat encryption as one control inside a security program, not a purchase. Pick a tiered rule, pick a method your clients will actually use, make multi-factor authentication non-negotiable and train people on the account takeover attacks that make encryption irrelevant. Then review it on a schedule. That is how a firm keeps up with its duty of competence without overspending on tools it will not use. Our view on how this reduces exposure is laid out in our piece on cyber compliance and malpractice risk.
— vCISO
Getting help with the policy and the evidence
If your firm does not have a security leader, a virtual CISO can write the communication policy, assess your current mail and portal setup, vet vendors and keep documentation ready for clients and insurers. CISOSafe pairs vCISO services, risk assessments and policy development with a platform that supports compliance work across more than 50 frameworks, so the encryption decision sits inside a wider program. For a closer look at how that engagement works, read about the strategic value of vCISO services for law firms, or contact CISOSafe to talk through your firm's situation.
FAQ
Do lawyers have to encrypt every email?
No. Texas Opinion 648 says lawyers may generally communicate confidential information by email, with the caveat that circumstances can call for more protection. Sensitive data such as Social Security and financial account numbers, or a client on shared or public devices, are the situations where encryption or a portal is the reasonable choice. Document how you decide.
Is emailing a lawyer confidential?
Generally yes. Electronic delivery alone does not strip a communication of its privileged character, as the State Bar of California's ethics committee explained in its 2010 opinion. Confidentiality in practice still depends on how well both sides secure their accounts and devices, which is why firms add encryption and multi-factor authentication.
Is TLS enough for a law firm?
TLS is a sensible baseline for routine messages because it protects mail moving between servers. It does not protect the message once delivered, so use end-to-end encrypted email or a client portal for sensitive and restricted material.
Should we use a client portal instead of encrypted email?
For ongoing matters with frequent document exchange, a portal is usually the stronger option, and ABA guidance describes it as the most protected electronic route. Encrypted email is still useful for one-off messages to a client who will not log in to a portal. Many firms use both, governed by a written tier policy.
Who should own email encryption at a small firm?
A named partner should own the policy, with a security lead, in-house or virtual, responsible for tooling, training and reviews. Splitting it between "IT" and "the lawyers" is how gaps appear.
Sources
- Securing Lawyer-Client Communications, U.S. Court of International Trade
- Texas Professional Ethics Committee Opinion 648
- ABA: Employing Competent and Reasonable Safeguards
- ABA: Navigating Modern Communication Tools as a Lawyer
- North Carolina Bar Association: Encrypting Communications
- State Bar of California Formal Opinion 2010-179
- Data Breaches and Leaks: Understanding the Dangers