How immigration lawyers can collect client documents securely

Model Rule 1.6(c): “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”

Comment 18 lists the factors for judging what is reasonable: the sensitivity of the information, the likelihood of disclosure if additional safeguards are not used, the cost and difficulty of those safeguards, and how far they get in the way of representing the client. A client may ask for security measures the rule does not require, or give informed consent to go without ones it would. Comment 19 applies the same test to transmitting client information: take reasonable precautions to keep it from unintended recipients.

Your state’s version of Rule 1.6 and its bar opinions are what bind you. Most states follow the Model Rule closely, but check yours.

ABA Formal Opinion 477, Securing Communication of Protected Client Information (May 2017, later reissued as 477R), says a lawyer generally may send client information over the internet after reasonable efforts to prevent unauthorized access, but may need “special security precautions” when an agreement with the client or the law requires them, or “when the nature of the information requires a higher degree of security.”

It keeps unencrypted email as “generally” acceptable for routine communication, and says “particularly strong protective measures, like encryption, are warranted in some circumstances.” For information of sufficient sensitivity, it says a lawyer should encrypt the transmission, and names as an alternative to email attachments “a well vetted and secure third-party cloud based file storage system.” It also asks lawyers to do due diligence on vendors that provide communication technology.

A passport, a birth certificate and a record of immigration status together are enough to impersonate someone. That is the kind of file the opinion’s sensitivity test is about, and it is why routine email is a weak default for intake.

ABA Formal Opinion 483, Lawyers’ Obligations After an Electronic Data Breach or Cyberattack (October 2018), says lawyers must make “reasonable efforts to monitor their technology resources” to detect a breach. It defines a data breach as an event where “material client confidential information is misappropriated, destroyed or otherwise compromised”, or where the lawyer’s ability to do the work is significantly impaired, and says “an obligation exists for a lawyer to communicate with current clients about a data breach.”

For intake this is an argument about how many copies exist. A passport scan that sits in your inbox, a paralegal’s inbox and the client’s sent folder is three places to monitor and three places it can leak from. An upload link that stores only encrypted files keeps one copy, in one place you control.

1. Start from the filing’s evidence list. The Form I-130 checklist and the Form I-485 checklist are transcribed from USCIS’s own checklists, and ShieldFive offers both as templates when you create a request. Remove what does not apply to this family.

2. Create a request with that checklist and a PIN of at least four characters, and choose when the link expires.

3. Send the link by email or text and give the PIN another way, such as on the phone or in a meeting.

4. The client opens the link in a browser on a phone or computer, enters the PIN and uploads photos or PDFs of each document. No account, no app. Each file and its name is encrypted in the client’s browser before upload; ShieldFive stores ciphertext and you decrypt in your own browser.

5. Check what is still missing. You can mark an item received, if it came another way, or not needed. If nothing has been uploaded after about three and seven days, ShieldFive emails you a reminder to follow up.

6. Foreign-language documents: USCIS requires a full English translation with a translator’s certification for any document in another language (USCIS: I-130). Add the translation as its own checklist item so it is not forgotten.

The immigration document collection page shows the same workflow for a firm in short, and the help article on collecting passports and identity documents lists every limit in one table, with tips for clients who are not comfortable with technology.

ShieldFive only handles digital files. It does not receive, store or return paper originals. USCIS says not to send original documents unless the form instructions or regulations specifically ask for them (USCIS: I-130); when an original is needed, for an interview or because an officer requests it, it travels by mail, courier or in person, outside this tool.

It does not make your practice compliant with the Rules of Professional Conduct or any law. It is one tool in the reasonable efforts you make; your judgment about each client’s information, your own devices and accounts, supervision of staff, and your breach response are still yours.

It collects documents. It does not fill USCIS forms, track receipt notices or deadlines, keep a case calendar, e-file or take payments. If your case-management software already has a portal your clients use, that may be the simpler choice.

Your firm name and logo appear on the upload page on the paid plan and during the 14-day trial. There are no recurring requests. You need a free ShieldFive account to create requests; only the client skips signup. Every link needs a PIN of at least four characters, which is one more thing to pass on to a client who may not read English well.

Like any web app, we serve the JavaScript that does the encryption. The guarantee is “encrypted in the client’s browser, ciphertext at rest”, not a claim that no compromised server could ever interfere. The request security page sets out the threat model.

Price: a new firm gets 14 days with everything unlocked, then 1 open request at a time free, with links that last up to 7 days and no client reminders. The Firm plan is €29 per seat per month or €290 per year for unlimited open requests, client reminders, your logo and links up to 90 days or with no expiry.

This page summarises the ABA Model Rules and formal opinions and a USCIS page as published on the date at the top, with a link to each. The ABA opinions are advisory and your state’s rules govern. This is not legal advice about your obligations.