Closing Files, Destroying Files and Making Money (Part 2)
How to Shred Almost Anything
By Jim Calloway, Director, OBA Management Assistance Program

Last month I wrote “Closing Files, Destroying Files and Making Money” for the Oklahoma Bar Journal. I didn’t really intend for there to be a part two at the time. But, I received several requests for more information. Several articles on related topics have also recently crossed my desk (or my computer screen).

So, here’s even more information about this timely law office management topic, including a bit more about digital client files and the requirements associated with the destruction of client legal files once the proper procedures have been met to have them destroyed.

Q. Mr. Calloway. Can you talk a bit more about how old files are actually destroyed once the decision has been made that it is time to do so?

Well, I’d be pleased to do so. But, first………

An Apocryphal Story

A lawyer with a solo practice dies and his family and friends are left with the process of closing down his office. They manage to get the active files all farmed out to appropriate attorneys and paid a local landfill operator to pick up the closed files for disposal. Several months later, a lawyer who desperately needs some information from one of those files contacts the family and they tell him about the file disposal. Knowing that it is probably hopeless, the lawyer contacts the landfill operator just to make sure that the files have, in fact, been destroyed. “Oh no,” the landfill operator replies. “I still have them all. You know, there’s a lot of interesting reading in those lawyer files.”

All lawyers understand that closed files contain confidential information that is p rotected by the attorney-client privilege. But there is also information that is private and potentially embarrassing, even if it is not technically privileged. Bits of information, such as Social Security numbers, or even birthdates, should be treated with care. There is information that a lawyer may rightfully possess but where there is still a statutory right of confidentiality, such as medical records covered by the Health Insurance Portability and Accountability Act, a topic well noted in last month’s Oklahoma Bar Journal.

So it goes without saying that an attorney is not free to merely discard client files, but must affirmatively see to the destruction of the file s when they are no longer needed. Even a buried file in a landfill might survive and be unearthed someday. With the tools available today, the physical destruction of the files prior to disposal is the only sensible business alternative.

Document shredding capability is easily affordable. Most office supply stores now carry individual paper shredders that will shred a single sheet at a time for under $50. These essentially look like regular office trash receptacles with a shredder attachment on top. Double or triple the investment and one can have a desk-side shredder that will shred several sheets of paper at a time while it also shreds CD-ROMs or DVDs. A lawyer can spend several hundred to several thousand dollars to get a departmental or business sized shredder. Commercial file destruction services offer machines that can shred an entire box of files at one time, along with plastic three-ring binders, binder clips, file brads and other associated material. One would certainly want to have their hands clear of those machines when they are operating.

For many law offices, the desk-side shredding machine sitting next to the trash can by each desk has already become standard operating procedure. Small desk-side paper shredders can eliminate documents containing extremely sensitive client information, as well as drafts of documents with Social Security numbers, extra copies of medical records and similar documents. It may seem odd to have two trashcans sitting by your desk, one a shredder and one a traditional trashcan, but that may be the law office “best practice” now. It would be an unreasonable expense in many cases to have all of the office trash shredded. There’s no reason to shred the remains from all of those take-out meals you’ve had while working at your desk during lunch. So it is good business sense to have the lawyers and other law office staff shred the few documents that need to be shredded at the time they are discarded.

Recycling of paper provides great environmental benefits. I am sure that there are recycling companies available that can handle confidential documents with discretion. It just seems to me to be a better practice to shred any sensitive information as you discard it so there is no question that your good environmental practices put client confidentiality at risk in any way. In fact, you probably need to do this however you dispose of your trash. You do not want information compromised at the recycling site or exposed to dumpster diving in the alley behind your office.

Please note that just because there are very inexpensive desk-side machines for paper shredding does not mean that the law firm should invest in these. Most lawyers will want to be able to shred eight to10 page documents in one pass without having to worry about trying to pull out staples or separating pages.

But even these moderately-sized desk-side machines may not typically be the best tool for massive shredding projects such as a year’s worth of closed files. It may depend on how busy your workload is. (Although, if you have a teenager in the family who needs a part-time job, feeding closed files page by page into a small shredder would certainly keep them out of trouble—at least until they break the shredder.)

So, the best practice is to shred individual documents and drafts on a needed basis as they are discarded and use a commercial service to destroy large sets of boxes of closed files. Does that handle the problem? Well, not completely.

Q. Well, what about shredding digital documents and files on my computer? I’ve heard somewhere that files can still be recovered if you just delete them.

As most readers know, when you delete a file on your computer, it is not really deleted. On most computers, it is just moved to the recycle bin where it sits until the bin is emptied. Even then the “deleted” file is not really deleted. The file name is changed so that it does not appear visible to the user, and the hard drive area holding the contents of the file is marked as available to be overwritten. This free space may be overwritten rather quickly with normal computer use or it may linger untouched for a long time, even for months or years. A forensic exam of the computer or an “undelete” utility can still retrieve the information that has not been overwritten. Multiple overwriting is the recommended method required to really make certain information from deleted files is truly gone.

As the lawyers who are delving into electronic discovery are learning, even more frightening is the concept of slack space. Digital files are saved on a hard drive in organizational units called clusters. If an entire cluster is not needed for data, the space is still reserved. This unused, but reserved, space is called “slack space.” It can encompass some of that free space from a file that was recently deleted. Normally, this will be such a small segment of information that it presents no concern about breaching attorney-client privilege. But slack space might contain important evidentiary material. For example, if an individual denied having (and deleting) a large amount of financial information on his computer system, a forensic examination of the slack space of newly created digital documents might reveal a smoking gun in the form of pieces of spreadsheet data.

One can always reformat the hard drive. Reformatting, as we all know, removes everything. For some situations, reformatting a hard drive might be sufficient. This is particularly true if the computer is going home with a co-worker or friend. (Although you might want to check to see if any particularly tech-savvy teen or spouse lives there.) But make no mistake. There are utilities available that can recover information even from a drive that has been reformatted. See “Clean the Hard Drive before Dumping Your PC” by Kim Komando on the Microsoft Web site at http://tinyurl.com/8bxvm.

Software products are available to overwrite and permanently erase data. The Department of Defense has set erasure standards, which have been largely adopted by others concerned about properly deleting data.

A free program to do this is Darik’s Boot and Nuke. This is an open source program and can be downloaded at http://dban.sourceforge.net/. According to the Web site, “DBAN is a means of ensuring due diligence in computer recycling, a way of preventing identity theft if you want to sell a computer, and a good way to totally clean a Microsoft Windows installation of viruses and spyware. DBAN prevents or thoroughly hinders all known techniques of hard disk forensic analysis.” Be very careful when using DBAN because there is likely no way to recover accidentally deleted files.

PC Magazine offers the Shred 2 utility for $7.97. This allows you to permanently delete individual files or folders. Shred 2 deals with this issue by first destroying the file’s contents and then changing the file name. You can find more information about that utility and download it here: http://tinyurl.com/yphbez. It provides for multiple overwriting. The linked article gives a good technical explanation of why any single-time overwrite is not enough. For those interested in the topic, read the first two pages to see why “ghosts” of old data exist.

Window Washer is another utility in this class that comes highly recommended. It is from the well-known utility company www.webroot.com.

But for some very cautious people, physical destruction of the hard drive is the only method that will let them sleep at night. Of course, this means that you can not donate the PC to a worthy charity, school, friend or employee without buying another hard drive for it. But as long as some lawyers delay before buying new computer equipment, they may find that no one wants their “donation” anyway.

Q. So can I send my old files off somewhere to be shredded or must I do myself?

Security in transportation of the documents to a destruction facility is a concern for the lawyer. A lawyer once advised me that when he destroyed an entire storage building’s worth of files, he actually followed the truck transporting the files to the destruction location so he could personally watch them all being destroyed. Companies providing services in this industry will typically lock file storage bins in case there is an accident or some other unusual situation occurs while they are enroute to being destroyed. They will then, on request, provide you a certificate that all files were properly destroyed and kept secure prior to their destruction. Individual lawyers will have to decide their own comfort level, but relying on a large specialized company with secure destruction as its primary business service seems reasonable. If they have customers in the financial services or healthcare sector, this service would create an additional comfort level for many.

A representative from the Oklahoma City office of Shred-It Oklahoma outlined an interesting destruction concept for me. This involves leasing several bins from the company with slots on the top for confidential material to be deposited. At set periods, the company mobile destruction vehicle would make a call and the lawyer (or his/her designated staff representative) could accompany the documents outside to watch as the bins were unlocked and the paper, files, binders and discs were all destroyed.

A sidebar to this article lists the Oklahoma member companies of the National Association for Information Destruction. There may be additional companies in-state which are not included in this list and some of these companies serve a broad geographical area. If you are in a smaller community, you may also want to ask your local banker or hospital administrator for the name of the company that handles destruction of their records.

Q. Mr. Calloway, do I have to destroy old client files? A lot of lawyers I have discussed this with seem to keep all of theirs. I might even want to invite all of my old clients to a big retirement party some day.

I am not aware of any law or regulation that requires the destruction of closed client files so long as they are kept securely. As previously noted, the primary reasons for having a file destruction policy are the voluminous nature of closed files and the expense of maintaining them.

A divorce or probate client might not care that you have retained their closed file for 20 years. On the other hand, a 25-year-old adult might expect that your record of their juvenile transgressions would no longer exist after a period of time. A file destruction policy will no doubt result in disappointing a rare client or two who shows up seeking some bit of information 10 or 12 years after their matter has been concluded.

However, one should be aware of the fact that document retention and destruction policies are now a fact of life in corporate America. Almost all businesses of any size will now have a document retention and destruction policy due to Sarbanes-Oxley and the fact of electronic discovery. So a corporate client might not appreciate it if it comes to light years from now that copies of some corporate documents and correspondence remain in the lawyers closed file despite the corporation having set a policy for file destruction.

I will also note that many of these businesses have established a digital file destruction policy that corresponds with their paper file destruction policy. Since so many business records are never printed, this only makes sense.

Corporate file destruction policies are not established to secret things or hide the truth. Notwithstanding our recent memories of the Enron scandal, there are generally good business reasons for a file destruction policy. There is the expense of digital or physical file storage to consider. Companies in litigation have also learned that it is much more expensive to handle discovery when a corporation has retained 5 million e-mails instead of 250,000.

Many lawyers who advise businesses have already been involved in the drafting and approval of their information destruction policy. So if your client file contains a lot of your client’s corporate business records and communications, it seems that it would be a good idea to discuss document retention with the client’s representative.

Q. Do I have to give a client a copy of the file at the termination of representation and can I charge for copy charges?

I refer you generally to “Retaining Liens: When Should I Use One?” (75 OBJ 811 March 13, 2004, by Gina Hendryx, OBA Ethics Counsel)

I also note that the Oklahoma Rules of Professional Conduct (in both the current and pending versions) provide in Rule 1.16(d):

(d) Upon termination of representation, a lawyer shall take steps to the extent reasonably practicable to protect a client’s interests, such as giving reasonable notice to the client, allowing time for employment of other counsel, surrendering papers and property to which the client is entitled and refunding any advance payment of fee that has not been earned.

I was contacted by one lawyer about this issue some months ago. I wish I had recorded her name so I could give her credit here.

She said that she thought the idea of charging for client copies seemed pretty simple and she wanted to know what I thought of her contract provision. Here’s the thrust of her idea, with a bit of embellishment.

Copies of documents: Throughout our representation of you in this matter, we will receive various documents. We will provide you with a courtesy copy of all of these documents at no additional charge. Therefore at the conclusion of your representation you will have (and we will have) a complete copy of your file. Should you desire any additional copies, our photocopying charges are X per page.

Put that way it does seem pretty simple. Giving the client copies of everything throughout the representation is a great client service and a good business practice. If your client is an individual you may want to provide them with a file folder in which to keep their copy of their file. Then it stands to reason that, having given them one copy, the others are extra copies. Certainly, it seems quite reasonable to charge for an “additional” copy of something you have already given to the client. I recognize, however, that things do not always operate like this in the “real world.” It is often better to “bite the bullet” and pay for copies than to have an angry client, or former client.

OK, if I shred the sensitive paper and know how to truly delete files from my computer hard drive, have I got this information security all under control?

This would be sufficient as long as you don’t ever store any information on any electronic device other than your computer’s hard drive. In the November 2006 Oklahoma Bar Journal, Ellen Freedman, Reid Trautz and I wrote an article titled “A Lawyer’s Guide to Mobile Computer Security” (77 OBJ 3085 Nov. 4, 2006). This article has been reprinted by numerous publications during the last year. If you missed it the first time, you might want to read this.

Christy Burke recently wrote an article for Law Technology Today titled “Get Back to the REAL World of Security: Ensuring Proper Physical Data Security and Destruction throughout the E-Discovery Process.” She notes that an issue of growing concern is “how to properly secure and dispose of your hard drives, CDs, backup tapes and obsolete hardware like laptops, PCs, PDAs and thumb drives.” When the law firm manager considers how to destroy this information, one must be concerned with Sarbanes-Oxley, HIPAA and the new E-discovery retention and disposal rules of amended Federal Rules of Civil Procedure. If physical destruction is contemplated, there are the guidelines of the Environmental Protection Agency for appropriate disposal.

Law Technology Today is available for reading at http://tinyurl.com/229b8m. Suffice it to say that shredding and melting of all of these different types of hard drives that are no longer needed is growing in acceptance. Three is absolute certainty that the information is destroyed. The smelter can also recycle the metal and even some of the plastics.

One should also bear in mind that digital copiers can be set to retain the copies that they have made for an extended period. More recently copiers have been set to only retain this information for sure. But that was not always the case.

Your mobile phone may contain information about you as well. The Subscriber Identity Module card should be removed before any phone is recycled or discarded. You should also see about wiping the phones internal memory. If you do not know how to do that, you may find the information at www.wirelessrecycling.com.

Jay Foonberg on File Retention and Destruction

Jay Foonberg was a guest speaker at the 2007 OBA Solo and Small Firm Conference. By all accounts his remarks were enjoyed and well received. I was recently honored to be in attendance as Mr. Foonberg received the law practice management section’s Sam Smith Award for lifetime achievements in the field of law practice management. Coincidentally, he published an article on this topic in the July/August 2007 edition of GPSolo magazine. The article, “Preservation of Files: Destroy or Not to Destroy” begins at page 36 of the magazine.

This article is not yet freely available online, but within several weeks (or months,) it will be available at the following link: www.abanet.org/genpractice/magazine. You can read Mr. Foonberg’s article for more information on this important topic.

Mr. Foonberg has given us permission to reprint his “Implied Consent to Destruction Letter” form as a sidebar to this article. He indicates that he is embedded this form with several state bar disciplinary authorities and other knowledgeable individuals. So it may become a guideline for your office policy and procedures.

Conclusion

Destruction of information might have had a nefarious ring to it, but it has become a part of 21st century life. Identity theft is no joke. Neither is the sanctity of the attorney-client privilege and attorney-client confidentiality. Hopefully, readers now have all of the information needed to prepare and implement appropriate file destruction policies.

Oklahoma NAID
(National Association for Information Destruction) Member Companies

Obtained from www.naidonline.org

No warranties expressed or implied

American Document Shredding LLC
Kelly Herneisen
P.O. Box 1861
Muskogee, OK 74402
(918) 770-5606
Fax: (918) 687-6032
E-mail: kellyherneisen@yahoo.com

Asset Disposition Group Inc.
Steve Walden
P.O. Box 5210
Edmond, OK 73013
(405) 340-4362
Fax: (405) 340-4315
E-mail: swalden@adgok.com
www.assetdispositiongroup.com

Business Records Storage LLC
Dahl Luttrell
5 NE 12th St.
Oklahoma City, OK 73104
(405) 232-7867
Fax: (405) 232-1294
E-mail: dahl@westoredocuments.com
www.westoredocuments.com

File Thirteen LLC
Mathew Feil
301 SE Wallock St.
Lawton, OK 73501
(580) 248-6767
Fax: (580) 357-6767
E-mail: matt@filethirteen.net
www.filethirteen.net

Green Country Shredding and Recycling Inc.
Tom Dawson
P.O. Box 52036
Tulsa, OK 74152
(918) 749-5885
Fax: (918) 743-6039
E-mail: tom.dawson@cox.net
www.gcshredding.com

Iron Mountain Secure Shredding
General Manager
5443 S. 108th E. Ave.
Tulsa, OK 74146
(918) 660-8157
(800) 899-IRON
Fax: (918) 660-8159
www.ironmountain.com

Midland Recycling of Sand Springs
Garold Beisly
360 S. Main St.
Sand Springs, OK 74063
(918) 245-7030
Fax: (918) 245-7165
E-mail: gbeisly@midlandrecycling.net
www.midlandrecycling.net

Midland Recycling - Oklahoma City
Brian Reid
1432 W. Main St.
Oklahoma City, OK 73106
(405) 232-8811
Fax: (405) 232-8819
E-mail: breid@midlandrecycling.net
www.midlandrecycling.net

OES Information Destruction
Chris Feeney
2600 E. Willow Ave.
Enid, OK 73701
(580) 548-2631
Fax: (580) 213-2737
E-mail: chris.feeney@okdhs.org

Paper Solutions
Jerry Cowden
901 Enterprise - Bay 10A
Oklahoma City, OK 73128
(405) 947-4040
Fax: (405) 947-1353
E-mail: jcow424@aol.com

Recall Secure Destruction Services
Nick Morris
7254 E. 38th St.
Tulsa, OK 74145-3230
(918) 665-9313
Fax: (918) 665-8675
E-mail: nick.morris@recall.com
www.recall.com

Secure Shred Inc.
Eric Pool
Operates From Missouri
1026 E. Lakewood St.
Springfield, MO 65810
(417) 885-1101
Fax: (417) 886-3116
E-mail: eric@secure-shred.net
www.secure-shred.net

Shred-It Oklahoma
Todd Rose
1301 Cornell Parkway
Oklahoma City, OK 73108
(405) 943-6700
Fax: (405) 943-6800
E-mail: oklahoma@shredit.com
www.shredit.com

SHRED-OK Inc.
Henry Jarvis III
406 W. Main St.
Norman, OK 73069
(405) 321-7226
Fax: (405) 321-7227
E-mail: das@shredok.com
www.shredok.com

Implied Consent to Destruction Letter

Dear [Client name ]:

We have concluded our services in the matter of __________________. [describe matter] All legal work has been done and all our fees and costs have been paid.

We thank you for the opportunity to have been of service. We are including a questionnaire to enable you to express your opinion of our services.

We have examined your file and we do not now have in our possession any original documents or items that belong to you. If you are aware of anything we may have that you want, please let us know immediately so that we may send it to you. We have previously sent to you [or, as appropriate, the letter can alternatively state, “We are sending under separate cover” or “We are enclosing”] : ________________. [describe materials]

We have endeavored to send you copies of everything that has happened on your matter and accordingly you have a file that duplicates our file. Please note that we have renumbered your file to indicate the month and year in which it was closed and are moving the file to our closed file storage area where it may be destroyed without further notice to you. Retrieval of the closed file or its contents prior to its destruction may require delay as well as a waiting period and charges for the service.

Again, please let us know if there is anything that you want from the file. If we do not hear from you within 30 days, we shall assume you have anything you might want or need and that you understand our closing, retrieval, and destruction system.

A new file number has been assigned to this one file only. The new file number is 2007 12-12

It would be appreciated if you sign a copy of the letter acknowledging its receipt and your new file number of 2007 12-12

Very truly yours,

________________________

[Your name]

________________________

[Client name]

Enclosure: Client satisfaction survey card

Copy of this letter

Self-addressed postage-paid envelope

Copyright 2007 Jay Foonberg, Reprinted with permission.

Originally published in the Oklahoma Bar Journal September 1, 2007 - Vol. 78; No.24.