Ethics Opinion 107: Third-Party Auditors, 09/18/99

Introduction and Scope

The Colorado Bar Association Ethics Committee has received a number of inquiries from attorneys concerning ethical issues raised by insurance companies’ use of outside audit agencies to review bills submitted by insurance defense attorneys. Based upon these inquiries, the Ethics Committee understands that the use of "third-party auditors" has become a common practice in the insurance industry. Under this practice insurance companies routinely submit legal billing statements or ask insurance defense counsel to submit legal billing statements directly to third-party auditors. The statements often contain detailed information concerning the representation of an insured that may be confidential, privileged, or both.

In addition, third-party auditors often promulgate "billing guidelines" that provide detailed instructions regarding the insured’s defense. The billing guidelines typically notify insurance defense counsel of items that will not be paid for by the insurer and provide limits on time and personnel for certain activities.

These practices raise a variety of ethical issues. In particular, counsel should consider how these practices implicate the attorney’s duties of confidentiality and independent professional judgment. The ultimate analysis of these issues turns on key questions of law that remain undecided in Colorado and are beyond the province of the Ethics Committee. Accordingly, this opinion seeks only to assist attorneys in recognizing certain benchmarks for ethical conduct when dealing with third-party auditors.¹

I. GENERAL DISCUSSION

A. The Use of Auditing Firms

The Ethics Committee has reviewed a variety of sources to determine the factual contexts in which an attorney may be faced with ethical issues pertaining to use of third-party auditors. Generally, insurers engage auditing firms to review legal bills for efficiency and accuracy. Debra Baker, "You Charged How Much?," ABA J. (Feb. 1999) at 20. Third-party auditors search for billing errors, abuses and inefficiencies attributable to insurance defense counsel. Accountability Services, "Management Analysis of Legal Services Rendered to ABC Insurance Company," 561 Prac. L. Inst./Litig., at 99, 158 (1997).

Legal auditing firms often employ both attorneys and accountants to review bills. William G. Ross, The Honest Hour: The Ethics of Time-Based Billing by Attorneys, 223 (Caroline Academic Press 1996). Typically, legal auditing firms are paid by the hour or according to some formula relative to the amount of savings that are realized by their clients, the insurers.

Third-party auditors’ methodology for reviewing and reporting their findings may vary. Some third-party auditors seek the submission of highly detailed information in the legal billing statements, including the scope and purpose of research, the subject matter of correspondence and the substance of communications with witnesses or the insured. See Indiana Ethics Op. No. 4, at 1-2 (1998). Some third-party auditors seek to compile and use a database or guidebook that attempts to analyze the efficiency of the legal work submitted for payment. See Alabama Ethics Op. RO-98-02, at 4 (Oct. 1998). This opinion assumes that the third-party auditors seek to obtain a broad range of detailed information relating to the matter at issue and the representation of the insured. Further, this opinion assumes that the billing guidelines provide detailed instructions regarding the scope of work and personnel that will be considered appropriate for payment.

B. CBA Ethics Opinion 91

CBA Ethics Opinion 91 ("Opinion 91") addresses at length the "tripartite relationship" among insurer, attorney, and insured. See CBA Formal Ethics Opinion 91, Colorado Ethics Handbook ("Handbook"), III-325 (CLECI) (Jan. 16, 1993) or 22 The Colorado Lawyer ("TCL"), 497 (March 1993). Opinion 91 provides extensive analysis of the attorney’s ethical duties arising from that unique relationship. This opinion incorporates and supplements the analysis set forth in Opinion 91. This opinion should not be construed as minimizing the importance or relevance of other portions of Opinion 91 not expressly republished herein. Accordingly, the entire text of Opinion 91 should be read in conjunction with this opinion.

Opinion 91 makes clear that the attorney’s primary duty in the tripartite relationship is to the insured. Opinion 91 at Handbook, III-326; TCL, 498. See also Rose Med. Ctr. v. State Farm Mut. Ins. Co., 903 P.2d 15, 17 (Colo. App. 1995) (recognizing that "defense counsel is not counsel to the insurance company" and citing Opinion 91). The duties to exercise independent professional judgment and to maintain confidentiality are of central concern in this analysis.

1. Duty of Independent Judgment

Rules 1.8(f) and 2.1, Colo. RPC, require attorneys to maintain and exercise their independent professional judgment. Additionally, Rule 5.4(c) provides that an attorney shall not permit one who employs or pays the lawyer to represent another to "direct or regulate the lawyer’s professional judgment in rendering such legal services." Colo. RPC 5.4(c). Opinion 91 confirms the attorney’s duty to maintain independent professional judgment within the confines of the tripartite relationship:

The lawyer’s duty of loyalty and duty to exercise independent professional judgment on behalf of the insured may compel defense counsel to disagree with the insurer regarding the strategy or procedures to be followed in the case, even though the insurer is paying defense costs.

1. Restrictions on Defense Costs. The insurance company may attempt to restrict the amount of discovery conducted by the lawyer, refuse to authorize the retention of expert witnesses, or refuse to authorize other work in order to reduce litigation costs. If the attorney believes that some particular action is reasonably necessary to protect the interests of the insured, the attorney must so advise the insurer and request authority from the insurer to take the requested action and incur the related fees and costs. If the insurer declines, the attorney must advise the insured of the insurer’s decision and why the action is necessary or recommended. If the insured nevertheless requests the attorney to take such action, the attorney may request payment of the legal fees and costs from the insured and should advise the insured to seek independent counsel. If the insured and the insurer are unwilling or unable to make satisfactory arrangements, the attorney should determine whether it is permissible or mandatory to withdraw.

Opinion 91 at Handbook, III-327; TCL, 498.

In short, the attorney may not allow the insurer directly to control or restrict actions that the attorney believes are necessary to protect the insured’s interests. Therefore, it follows that the attorney may not allow the insurer, via a third-party auditor, indirectly to interfere with his or her independent professional judgment.

2. Duty of Confidentiality

Likewise, the attorney may not allow the insurer or the third-party auditor to compromise privileged and/or confidential material. According to Opinion 91:

B. Duty to Maintain the Confidentiality of Client Information.

Rule 1.6 prohibits the attorney from revealing "information relating to representation of a client unless the client consents after consultation, except for disclosures that are impliedly authorized in order to carry out the representation. . . ." The comment to this rule indicates that it applies "not merely to matter communicated in confidence by the client but also to all information relating to the representation, whatever its source."

While Rule 1.8 allows payment of fees by one other than a client, Section (f)(3) of the rule specifically requires the same protection of information relating to representation as that required by Rule 1.6.

The goal of Rule 1.6 is to assure that the client has confidential access to his or her attorney in order to facilitate communication and the successful disposition of the case. Whether or not information regarding the insured coincides with the interests of the carrier, the attorney’s duty to preserve the confidentiality of that information requires the attorney to refuse to disclose certain information to the insurance company absent the insured’s consent. The principle supporting this view "is that the attorney does represent the insured and assumes all of the duties imposed by the attorney-client relationship."

Opinion 91 at Handbook, III-328; TCL, 500 (italics supplied in Opinion 91, bold emphasis added) (internal citations omitted).

The Ethics Committee recognizes that the insurer has a legitimate interest in obtaining information needed to monitor the costs of defense. But the attorney may not allow the interests of the insurer to interfere with the interests of the insured. Accordingly, the attorney must ensure that any communication with the insurer or the third-party auditor does not breach the duty of confidentiality owed to the insured.

C. Authority from Other States

Many state ethics committees have addressed the usage of third-party auditors by insurance companies. See, e.g., Alabama Office of General Counsel Opinion Letter (June 1998); Alabama Ethics Op. RO-98-02 (Oct. 1998); Alaska Bar Ass’n Ethics Op. 99-1 (1999); District of Columbia Bar Legal Ethics Comm. Op. 290 (Apr. 20, 1999); Florida Bar Staff Op. 20591 (Dec. 31, 1997), Hawaii Office of Disciplinary Counsel Formal Op. No. 36 (March 25, 1999); Indiana Ethics Op. No. 4 of 1998; Kentucky Ethics Op. E-368 (1994); Kentucky Ethics Op. E-404 (June 1998); Maryland State Bar Ass’n Comm. on Ethics Op. 99-7 (Dec. 1998); Massachusetts Ethics Op. 1997-T53 (1997); Missouri Ethics Informal Op. 980124 (1998); New York State Bar Ass’n Op. 716 (March 1999); North Carolina State Bar Formal Ethics Op. 98-10 (July 16, 1998); Oregon State Bar Legal Ethics Comm. Formal Op. 1999-157 (June 1999); Pennsylvania Comm. Informal Op. 97-119 (Oct. 7, 1997); South Carolina Ethics Op. 97-22 (1997), Tennessee Formal Ethics Op. 99-F-143 (June 14, 1999); Utah Ethics Op. 98-03 (April 17, 1998); Vermont Bar Op. 98-7 (1998); Virginia Ethics Op. 1723 (Nov. 1998); Washington State Bar Ass’n Formal Op. 195 (1999); and, Washington State Bar Ass’n Informal Op. Re: Inquiry No. 1758 (April 1997); Wisconsin State Bar Comm. on Professional Ethics Formal Op. E-99-1 (1999).

Without exception, these authorities indicate the need for caution before an attorney submits potentially confidential and/or privileged information, directly or indirectly, to a third-party auditor. These authorities also address the dangers inherent in the use of detailed billing guidelines and they caution insurance defense counsel to maintain their independent professional judgment.

D. Balance of Interests

The need for caution arises from the delicate balance of interests inherent in the tripartite relationship. The attorney’s duties to exercise independent professional judgment and to maintain confidences stem from the attorney’s overall duty of undivided loyalty to the client. See Model Rules of Professional Conduct, Rule 1.7(b) Comment. The duty of loyalty requires that counsel hold as sacrosanct the attorney-client relationship. Id. The attorney’s conduct is governed by how his or her dealings or relationships with other parties may impact the relationship with the insured, the client.

The attorney in the tripartite relationship owes his or her primary duty to the insured. Opinion 91 at Handbook, III-326; TCL, 498. But the attorney also must abide by other obligations on the insured’s behalf that derive from the insurance contract. Id. Further, the attorney, as always, also is governed by the Rules of Professional Conduct. The attorney therefore must ensure that these multiple obligations do not interfere with the attorney-client relationship. See Rose Med. Ctr., 903 P.2d at 17 (recognizing "inherent tension in the tripartite relationship").

These obligations must be understood in the context of the differing arrangements between the interested parties. The relationship between the insurer and the third-party auditor can range from an ongoing contractual relationship to a matter-by-matter engagement. In contrast, the third-party auditor does not have any direct relationship with the insured and does not provide any service that inures directly to the benefit of the insured. See Indiana Ethics Op. No. 4, at 2; Virginia Ethics Op. 1723. Further, the third-party auditor and the attorney operate from positions that potentially are antagonistic to each other’s economic interests. As such, they may find themselves at cross-purposes in a given matter. The attorney therefore must consider the third-party auditor to be an outsider to the attorney-client relationship and even as a potentially adverse party to the attorney.

III. ETHICAL DUTIES

Adherence to the duties to exercise independent judgment and to preserve client confidentiality requires a separate analysis and separate precautions. In many cases, the attorney can take steps, independent of the insured, to protect his or her independent professional judgment. But the issues surrounding client confidentiality require consultation with the insured. Therefore, the attorney must be careful to take steps that address the ethical concerns while respecting the confines of the tripartite relationship.

A. Adherence to Billing Guidelines

The Colorado Rules of Professional Conduct preclude an attorney from allowing anyone to "direct or regulate the lawyer’s professional judgment." Colo. RPC 5.4(c). Billing guidelines or any other requirement or restriction imposed by the insurer that unreasonably impair or influence the unfettered exercise of the attorney’s independent professional judgment therefore are impermissible. Colo. RPC 5.4(c); see also Alabama RO-98-02. The Rules also prohibit fee agreements "whose terms might induce the lawyer improperly to curtail services for the client or perform them in a way contrary to the client’s interests." Colo. RPC 1.5 Comment.

The Ethics Committee does not find there to be any bright line that can be used to distinguish the point where the attorney’s professional judgment is compromised. The attorney, however, is cautioned against agreeing to guidelines prior to evaluating how they would apply to foreseeable situations in the cases to which the guidelines would apply. As long as the guidelines are in effect, the attorney should continue to monitor whether the guidelines as applied are interfering with the attorney’s independent professional judgment. In particular, billing guidelines that arbitrarily and unreasonably restrict compensation for time spent by counsel performing services deemed necessary by counsel or that impose arbitrary rates for specific services may discourage the performance of such services. See Washington State Bar Ass’n Formal Op. 195.

The attorney may comply with billing guidelines that do not compromise his or her independent professional judgment. But if the attorney believes that a particular set of billing guidelines or an individual billing guideline unreasonably interferes with his or her independent professional judgment, the attorney must either: (1) obtain the insurer’s permission not to follow the guideline(s); (2) decline to abide by the guideline(s) and withdraw; (3) obtain the insured’s permission, after consultation, to forego action that is contrary to the guideline(s); or (4) seek payment directly from the insured. See Opinion 91, at Handbook, III-327; TCL, 498. Alternatively, the attorney could choose to complete the work without seeking compensation.

B. Disclosure of Billing Statements

The Colorado Rules of Professional Conduct preclude an attorney from revealing confidential information absent the client’s informed consent. In particular, Rule 1.6(a) provides:

(a) A lawyer shall not reveal information relating to representation of a client unless the client consents after consultation, except for disclosures that are impliedly authorized in order to carry out the representation. . . .

Colo. RPC 1.6(a). Legal billing statements often include detailed information relating to the representation of a client. This material and the substantive information therein clearly is within the ambit of Rule 1.6(a) and may be privileged. Consequently, the attorney may not reveal the information without the client’s informed consent. Id.

1. Disclosure to the Insurer

Since most insurance contracts include a "cooperation clause" whereby the insured agrees to cooperate in its defense under the insurance agreement, there exists an implied authorization for disclosure directly to the insurer of information necessary to accomplish the representation by the attorney. See Kentucky Ethics Op. E-404. Colorado Rule of Civil Procedure 26(b)(3) recognizes this principle by extending the work product privilege to include disclosures made to an insurer. Arguably, the third-party auditor, as the insurer’s agent, could fall within the same protection. See Stephen Gillers, Ethical Issues in Monitoring Insurance Defense Fees: Confidentiality, Privilege and Billing Guidelines, 11 (Law Audit Services, Inc. 1998). But no Colorado authority exists for the principle of extending this implied authorization to a third-party auditor. (There also is no Colorado authority that determines whether the auditor is indeed the insurer’s agent.)

To the contrary, recent cases have determined that voluntary disclosure of confidential and privileged material to an outside auditor destroys the privileged nature of the material. See United States v. Massachusetts Inst. of Tech., 129 F.3d 681, 684 (1st Cir. 1997); United States v. South Chicago Bank, No. 97 CR 849-1, 2, 1998 U.S. Dist. LEXIS 17445, *7 (E.D. Ill. 1998). In South Chicago Bank, the court held that "auditors are not generally part of the circle of persons, including secretaries and interpreters, for example, with whom confidential information may be shared without destroying the privilege." Id., 97 CR 849-1,2, 1998 U.S. Dist. LEXIS 17445, *7; see also Gottlieb v. Wiles, 143 F.R.D. 241, 246 (D. Colo. 1992) (finding that disclosure to "outsiders" may destroy the confidential nature of documents and result in a waiver of privilege).

Whether particular material is privileged is a question of law and fact. See D.A.S. v. People, 863 P.2d 291, 295 (Colo. 1996) (analyzing the applicability of the attorney-client privilege under the facts at issue). Therefore, that analysis is beyond the scope of this opinion. But considering the risk to the client posed by disclosure to a third-party auditor, and the duty to maintain confidentiality of information whether or not it is privileged, prudence and the Rules of Professional Conduct require that the attorney obtain the client’s informed consent prior to disclosing, or allowing a disclosure of, confidential and/or privileged material or information to a party, such as an auditor, that has no direct relationship to the insured.

2. Informed Consent

The informed consent could take many forms. But the attorney must ensure that the insured has been made aware of the risks posed by disclosure. See Colo. RPC 1.4(b). At a minimum, the potential risks discussed with the insured should include the risk that information disclosed to a third-party auditor may (1) result in a waiver of evidentiary privileges, (2) become available to adverse parties or third parties, and (3) be used adversely to the client’s interests.

The attorney should be careful to avoid a conflict of interest between the insurer and the insured. If the insured’s informed consent to disclose to the third-party auditor information in the billing statements is not obtained or if it is withdrawn in the course of representation, the attorney should not disclose the refusal or withdrawal of consent unless the insured expressly authorizes the attorney to do so. If such authorization is not obtained or is withdrawn and the attorney cannot make satisfactory alternative arrangements with the insurer regarding disclosure of information in the billing statements, the attorney should request that the insured, with or without independent counsel, resolve the conflict directly with the insurer. If, after this, the matter is not resolved, then the attorney should determine whether it is permissible or mandatory to withdraw.

Before the attorney communicates with the insured regarding the risks of disclosure to the third-party auditor, the attorney should inquire of the insurer and consider whether there are ways to limit the information disclosed, and to obtain confirmation that internal confidentiality procedures are employed by the third-party auditors. See Massachusetts Ethics Op. 1997-T53; Virginia Ethics Op. 1723. If the attorney is not satisfied regarding the existence of these safeguards, the attorney should consider whether he or she ethically can even seek the insured’s informed consent. See Colo. RPC 1.1 (competence), 1.3 (diligence), and 1.4(b) (communication). In any event, the attorney is advised to designate any information disclosed to the third-party auditors as "Privileged and/or Confidential, for internal use only."

The Ethics Committee does not express an opinion on whether the informed consent must be in writing. Nor does the Ethics Committee express an opinion on whether a "cooperation clause" or some other provision in the original insurance agreement relating to informed consent for the use of a third-party auditor is sufficient to compel the insured’s consent to disclosure. The effectiveness of an informed consent is a question of law that turns on the particular facts of the case. People v. McDowell, 718 P.2d 541, 545 (Colo. 1986). But, in any event, the attorney should be mindful of his or her duty to use independent professional judgment in the decision to seek the insured’s informed consent and in the decision to disclose. Colo. RPC 2.1.

3. Direct Versus Indirect Disclosures

The Ethics Committee does not recognize a distinction between direct (lawyer to auditor) and indirect (lawyer to insurer to auditor) disclosure of confidential and/or privileged material. If the attorney knows or reasonably should know that the insurer intends to submit its bills to a third-party auditor, the attorney still must seek the informed consent of the insured prior to releasing the material. See Maryland Op. 99-7 (requiring the attorney to request that an insurer not forward confidential material to a third-party auditor). The Rules of Professional Conduct, in particular the duties of loyalty, communication and competence, do not allow an attorney tacitly to participate in conduct that may jeopardize his or her client’s legal interests. See People v. Doherty, 908 P.2d 1120, 1121 (Colo. 1996) (discussing positive duty to keep client reasonably informed about matter); People v. Kuntz, 908 P.2d 1110, 1111 (Colo. 1996) (discussing positive duty to keep client updated about matter); see also Colo. RPC 1.3 (diligence), 2.1 (exercise of independent judgment).

Conclusion

The attorney always must maintain his or her independent professional judgment. Therefore, attorneys ethically may not adhere to billing guidelines that unreasonably restrict their ability to perform services that are in the best interest of their clients, the insureds.

Colorado courts have not taken a position on the extension of any privilege or other protection to information disclosed to a third-party auditor. The risk posed to the insured by the disclosure of privileged material to a third-party auditor triggers the attorney’s duty to seek the client’s informed consent prior to disclosure. Furthermore, the Rules of Professional Conduct preclude the disclosure of confidential material absent the client’s informed consent prior to disclosure.