Both Ohio and Indiana expect lawyers to protect client information and to understand the technology they use, but the duty sits in different places. Ohio writes it into the rule itself: Ohio Rule of Professional Conduct 1.6(c) says a lawyer "shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to," client information. Indiana puts the duty in the comments to its Rule 1.6, which say a lawyer "must act competently to safeguard" client information.
Neither state's rules list specific technologies a firm must use. What follows is a summary of the rule text and a practical way to think about it, not legal advice. Your own reading of the rules, and your malpractice carrier's guidance, should drive your firm's decisions.
| Duty | Ohio | Indiana |
|---|---|---|
| Protect client information | Rule 1.6(c), in the black-letter rule: "reasonable efforts" to prevent unauthorized disclosure of, or access to, client information | Rule 1.6, Comment [16]: act competently to safeguard client information against inadvertent or unauthorized disclosure |
| Sending client information | Covered by the same "reasonable efforts" duty | Rule 1.6, Comment [17]: take reasonable precautions so it doesn't reach unintended recipients |
| Understand your technology | Rule 1.1, Comment [8]: keep abreast of "the benefits and risks associated with relevant technology" | Rule 1.1, Comment [6]: keep abreast of "the benefits and risks associated with the technology relevant to the lawyer's practice" |
| People who help you | Rule 1.6, Comment [18]: the duty extends to others participating in the representation or subject to the lawyer's supervision (citing Rules 1.1, 5.1 and 5.3) | Rule 1.6, Comment [16] says the same; Rule 5.3, Comment [1] notes assistants may be "employees or independent contractors" |
Sources: Ohio Rules of Professional Conduct (amended effective January 1, 2026); Indiana Rule 1.6, Indiana Rule 1.1 and Indiana Rule 5.3.
Ohio's duty is in the rule; Indiana's is in the comments. In practice, both point the same direction: know the risks of the technology you use, and take reasonable steps to keep client information from people who shouldn't see it. A firm with offices or clients on both sides of the state line can build one set of safeguards that answers both.
The rules say "reasonable," not which tools. These are the safeguards we put in place for the firms we support, and they're a practical starting point:
Both states extend the confidentiality duty to people who help with the work and who are subject to the lawyer's supervision, and Indiana's Rule 5.3 commentary notes that assistants can be independent contractors. A reasonable reading is that an outside IT provider with access to your systems is someone you should vet and set expectations for. That's why we make sure every technician, and our owner, is security-trained to CJIS standards and background-checked. Before you hire anyone, work through the 16 questions to ask before signing a managed IT contract.
Every safeguard on the list above is part of our managed IT plans, which run $200 to $350 per user per month, with Gold starting at $200. For a 12-person firm, that's $2,400 to $4,200 a month. See the full breakdown of what managed IT costs for a small law firm.
See how we support law firms across Ohio and Indiana.
This article summarizes the text of the Ohio and Indiana Rules of Professional Conduct for general information. It is not legal advice. Tomorrow's Technology Today is an IT provider, not a law firm.
Want to see how your firm's safeguards measure up? Book a 10-minute discovery call. Call us at (419) 678-2083 or visit www.TomTechToday.com/discoverycall to schedule yours.