Both Ohio and Indiana expect lawyers to protect client information and to understand the technology they use, but the duty sits in different places. Ohio writes it into the rule itself: Ohio Rule of Professional Conduct 1.6(c) says a lawyer "shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to," client information. Indiana puts the duty in the comments to its Rule 1.6, which say a lawyer "must act competently to safeguard" client information.
Neither state's rules list specific technologies a firm must use. What follows is a summary of the rule text and a practical way to think about it, not legal advice. Your own reading of the rules, and your malpractice carrier's guidance, should drive your firm's decisions.
Ohio vs. Indiana at a Glance
| Duty | Ohio | Indiana |
|---|---|---|
| Protect client information | Rule 1.6(c), in the black-letter rule: "reasonable efforts" to prevent unauthorized disclosure of, or access to, client information | Rule 1.6, Comment [16]: act competently to safeguard client information against inadvertent or unauthorized disclosure |
| Sending client information | Covered by the same "reasonable efforts" duty | Rule 1.6, Comment [17]: take reasonable precautions so it doesn't reach unintended recipients |
| Understand your technology | Rule 1.1, Comment [8]: keep abreast of "the benefits and risks associated with relevant technology" | Rule 1.1, Comment [6]: keep abreast of "the benefits and risks associated with the technology relevant to the lawyer's practice" |
| People who help you | Rule 1.6, Comment [18]: the duty extends to others participating in the representation or subject to the lawyer's supervision (citing Rules 1.1, 5.1 and 5.3) | Rule 1.6, Comment [16] says the same; Rule 5.3, Comment [1] notes assistants may be "employees or independent contractors" |
Sources: Ohio Rules of Professional Conduct (amended effective January 1, 2026); Indiana Rule 1.6, Indiana Rule 1.1 and Indiana Rule 5.3.
Why the Difference Matters Less Than It Looks
Ohio's duty is in the rule; Indiana's is in the comments. In practice, both point the same direction: know the risks of the technology you use, and take reasonable steps to keep client information from people who shouldn't see it. A firm with offices or clients on both sides of the state line can build one set of safeguards that answers both.
7 Practical Safeguards for a Small Law Firm
The rules say "reasonable," not which tools. These are the safeguards we put in place for the firms we support, and they're a practical starting point:
- Multi-factor sign-in for every user, so a stolen password alone doesn't open client files.
- Access set by client matter, not one shared drive everyone can see.
- Immediate access removal when someone leaves the firm.
- Security awareness training, including simulated phishing tests, because email is still the most common way in.
- Security monitoring by a human-staffed security operations center.
- Immutable, restore-tested backups. Ours are immutable as standard and get a full restore test every other week. Here's how to tell whether your backups would survive ransomware.
- An IT agreement that covers confidentiality. Ours explicitly covers attorney-client privileged materials, binds subcontractors to terms at least as protective, and commits to notifying you within 72 hours of a confirmed security incident involving your data.
Your IT Provider and the People You Supervise
Both states extend the confidentiality duty to people who help with the work and who are subject to the lawyer's supervision, and Indiana's Rule 5.3 commentary notes that assistants can be independent contractors. A reasonable reading is that an outside IT provider with access to your systems is someone you should vet and set expectations for. That's why we make sure every technician, and our owner, is security-trained to CJIS standards and background-checked. Before you hire anyone, work through the 16 questions to ask before signing a managed IT contract.
What It Costs to Get There
Every safeguard on the list above is part of our managed IT plans, which run $200 to $350 per user per month, with Gold starting at $200. For a 12-person firm, that's $2,400 to $4,200 a month. See the full breakdown of what managed IT costs for a small law firm.
Why Law Firms Work With Tomorrow's Technology Today
- More than 20 years in business, headquartered in St. Henry, Ohio, serving firms across Northwest Ohio and Northeast Indiana
- Woman-owned and woman-led
- Every technician is security-trained to CJIS standards and background-checked
- Owner Lisa Niekamp-Urwin wrote Sitting Duck: Why Your Business Is a Cybercriminal's Ideal Target, a #1 Amazon Best Seller, and is a past president of InfraGard Toledo
- Microsoft Partner
See how we support law firms across Ohio and Indiana.
This article summarizes the text of the Ohio and Indiana Rules of Professional Conduct for general information. It is not legal advice. Tomorrow's Technology Today is an IT provider, not a law firm.
Want to see how your firm's safeguards measure up? Book a 10-minute discovery call. Call us at (419) 678-2083 or visit www.TomTechToday.com/discoverycall to schedule yours.