Key takeaways
- Know which records are sensitive before the request goes out.
- Collect them through a secure link, not an email attachment.
- Store them in one place with role-based access.
- Share only what the client or the task needs.
- Have a response plan for a misdirected email or a lost device.
Know what is sensitive
Social Security numbers, taxpayer identification numbers, bank and card account numbers, payroll records, tax returns, health information and login credentials are sensitive. A document can be sensitive even when the file name does not say so, such as a bank statement with an account number or a payroll register with employee addresses.
Treat the source document as sensitive, not only the number inside it. A screenshot of a tax return is as sensitive as the return itself.
Collect through a secure link
Ask clients to upload documents through a secure link instead of replying with an attachment. The link should be unique to the client and the request, and it should show the client what is still missing.
Do not ask a client to type a Social Security number, EIN or bank account number in an email or a chat. Ask for the document and let the secure link carry it.
Store in one controlled place
Keep client documents in the firm's document system or portal, not on a desktop, a personal drive or a phone. Use folders by client and year, and limit access to the people who serve that client.
Back up the document system and test the restore. A backup that has never been restored is a hope, not a control.
Share the minimum
When a client, lender or attorney needs a document, share only the pages they need. A full tax return sent for a loan application may include schedules and dependents that the lender does not need.
Use a link with an expiry date or a permission setting when the tool supports it. Do not forward a client's document to another client or to a personal account.
Train the team
Every team member should be able to recognize a phishing email, a fake client request and a suspicious attachment. Run a short training at onboarding and once a year, and test it with a harmless simulation.
Make it easy to report a mistake. A person who fears punishment for a misdirected email will hide it, and the firm loses the chance to contain the problem.
Plan for a mistake
Write down what the firm will do if a document goes to the wrong person, a laptop is lost or an account is compromised: contain the access, notify the client and the insurer, document what happened and decide whether a legal notification is required.
The plan should name who leads the response and who talks to the client. A calm, documented response protects the client and the firm's reputation better than an improvised one.