14 Client Confidentiality Dilemmas Not Addressed by Ethics Rules: How Did You Resolve Them?"
Client confidentiality rules provide a framework, but real-world scenarios often present gray areas that demand careful judgment and creative problem-solving. Legal professionals across practice areas have encountered situations where standard ethics codes offer little guidance, forcing them to develop their own strategies for protecting privileged information. This article presents 14 challenging confidentiality dilemmas and the practical solutions that experienced attorneys have used to resolve them.
Secure Privacy With In Camera Review
As a seasoned attorney, I faced a dilemma that wasn't in the Model Rules of Professional Conduct: A client in a messy divorce and custody battle accidentally uploaded her entire iCloud photo stream—including thousands of deeply personal, non-relevant images—to our secure client portal as part of "discovery." Opposing counsel, a notoriously aggressive litigator, immediately subpoenaed "all documents uploaded to the portal," technically making them discoverable. The rules said I had to turn over relevant evidence, but they were silent on the accidental disclosure of irrelevant, highly sensitive material that could be used solely to embarrass my client without legal merit.
I resolved this by filing a Motion for Protective Order and In Camera Inspection. I argued that while the portal contained discoverable financial documents, the "data dump" included privileged, non-relevant personal property that would cause "annoyance, embarrassment, and oppression" (Rule 26(c)). I essentially asked the judge to look at the files privately (in camera) rather than handing them over to the opposing attorney.
This strategy protected my client's dignity without suppressing evidence. The judge reviewed the files, agreed 99% were irrelevant, and ordered only the financial documents produced. It maintained my integrity by adhering to the discovery rules while fiercely advocating for my client's privacy in a digital age where "upload all" buttons create legal landmines. It was a victory for common sense over technicality.
Impose Boundaries Split Clients
I represented three businesses owned by longtime friends. Each company handled a different piece of a shared operation, and for years the arrangement worked. That changed when they brought in an outside investor. The deal moved fast, the documentation was incomplete, and within weeks the relationship began to fracture. There were concerns about withheld information, movement of funds, and a breakdown of trust.
As things unraveled, each owner began preparing for litigation. The complication was that I had worked with the group collaboratively for years, and each of them assumed they were still entitled to the same information. They were not. Their interests were no longer aligned. What had been a shared enterprise was now a set of potentially adverse parties.
The confidentiality issue was not neatly addressed by any single rule. Each client expected transparency based on years of working together, but I had an obligation to protect confidential information as their positions diverged. That tension was made worse by the fact that the owners, and even their spouses, continued speaking informally about the business, blurring the line between what was shared and what was protected.
I drew a firm boundary. I made clear that I could no longer function in a joint advisory role and that any continued representation required separate engagements with strict confidentiality. I declined to share information without express consent from the client it belonged to and advised each of them to retain independent counsel.
It was not a clean situation, but the answer was clarity. When interests break apart, confidentiality has to follow the reality, not the history.
Call The Bar Ethics Hotline
Any time I have run into a scenario where it is unclear what I can or cannot say related to a certain case, I always seek guidance. When in doubt, contact the BAR ethics hotline. Each state has one, and they are extremely helpful. Normally you can get a number associated with the call, which is recorded, so you can always refer back to that call and the advice you were given if there is any allegation you violated any rules. This is the best way to handle any dilemma regarding what confidential information can and cannot be shared.
Give Upjohn Warning Report Internally
I was hired by an organization to work on an internal case of harassment. During witness interviews, one of the employees of the organization disclosed critical information regarding the defendant. This information didn't directly affect the harassment case but it involved illegal conduct related to the manipulation of financial reports.
Of course, my team was in the dilemma of what to do next. My rule of thumb for such ethically gray areas is to choose the option that benefits my client. My client was the organization, not the employee. So, ethically, I was not obliged to maintain confidentiality of the employee. I was, however, bound by law to be transparent with my client, specially because the information I got from the witness affected my client.
After giving my team the 'UpJohn warning', I communicated the information to the relevant team at my client's company without disclosing the identity of the person that gave me this information. As their employment lawyer, I recommended them to file an independent case for this issue based on their financial compliance process. This helped maintain the integrity of the harassment case.
Limit Information To Legal Necessity
The best way I can speak to this is in my role as a disability lawyer. In our cases, there are often times when our clients' employers reach out saying they want to "help our clients return to work." Unfortunately, many times this is not true. Instead, they want to gather information about our clients that they can turn around and use against them in their case and/or use to justify firing them. Basically, we must walk a tightrope between providing employers with enough information (generally, medical information) to help our clients keep their jobs without revealing details that could harm our clients' cases. The most effective method for handling this issue is to have a minimum necessary disclosure policy. This is exactly what it sounds like. Only provide employers with the specific legal and medical documents/information required by law and nothing more. This ensures that you protect your clients' privacy and still meet the legal requirements of the situation.
Promote Honesty To Preserve Credibility
An issue that injury law can present when it comes to client confidentiality and ethics rules is when a client doesn't want to reveal a past, unrelated injury. In some cases, disclosing past injuries can impact how the judge, jury, and other side views the client's credibility. Obviously, it's against ethics rules to lie to the court. However, it's less clear if it's against ethics rules to keep information, such as a past injury, private if there's a chance it could impact the case. The best way to approach this problem is to emphasize the importance of honesty early on. Sit your client down and explain how damaging it can be if they try to keep information private that the other side could find out and reveal as a way to question their character. Many times, it's not that the information itself is that damaging but just that you felt the need to hide it that hurts your case. That's why it's important to get ahead of these things. If you can and if you think it's necessary, try to persuade your client to disclose the information voluntarily. It may be the best way to avoid hurting their case, protect their legal rights, and uphold their reputation.
Confront Harmful Posts Set Limits
Social media has added a whole new layer of issues to legal matters, especially client confidentiality. From the perspective ethics rules and client confidentiality, one of the most problematic issues that social media is causing concerns clients publishing posts that infer that they are taking part in questionable behavior that could negatively impact their case. In some instances, these posts don't just point to risky behavior but come as close as possible to crossing the line into new criminal activity without crossing that line. While ethics rules are clear about how to deal with "future crimes," they aren't as clear about how to deal with a client who has bad judgment that leads them to do things that border on criminal. Absent clear ethical rules on an issue like this, it's up to the lawyer to act with integrity. This often involves having a direct conversation with your client and being brutally honest with them about their behavior, the ethical lines their behavior is threatening to cross, and how they are or could negatively impact their case if they don't change their behavior and how they approach posting on social media. Let them know in no uncertain terms how what they post on social media can be used against them in court and put them in a position to suffer real world consequences. Remind them that when it comes to client confidentiality, your office is a safe space for their secrets, but anything they post on social media is subject to prying eyes and can be used against them.
Honor Posthumous Confidentiality Until Authority Exists
A client died and her adult daughter called within the week. She'd been handling everything for years, finances included, and assumed I'd just walk her through what the estate plan said. She wasn't being calculating about it. She was wiped out and trying to figure out what happened next.
I couldn't tell her. She hadn't been appointed personal representative. No one had, yet. Until that happened there was no one with authority to waive confidentiality, and the duty doesn't end when a client does.
She was frustrated. Understandably. I've thought about that call a lot.
The ethics rules are clear enough in the typical scenario and genuinely unhelpful at the edges. What if no probate is ever opened? What if everything passes by beneficiary designation and no one ever gets formally appointed? I've been in situations where I wasn't confident there was a right answer, just a defensible one.
What I've settled on: confidentiality protects what the client was trying to accomplish, not just what they wanted kept private. Disclosing things prematurely, to the wrong person, can undo the whole plan. So I held the line, explained why, and waited.
She eventually got there. But it wasn't a good call.
Rebuild Evidence Through Independent Sources
With over 20 years in Pennsylvania courts, including as Lackawanna County DA and Chief Narcotics Prosecutor before founding my Scranton firm, I've defended dozens of serious cases like DUI, assault, and PFAs while navigating dual-sided advocacy.
A tough dilemma hit during a PFA modification for a defendant client. He presented social media evidence of the plaintiff's new living situation suggesting no ongoing risk, but it came via a mutual contact from my old SWAT advisory role--ethics rules didn't clearly bar using that incidental, non-confidential intel gained pre-private practice.
I resolved it by sourcing identical public records independently, redacting any sourced references in filings, and centering arguments on client's documented counseling and clean record. The court approved termination without challenges, safeguarding all parties' safety.
This reinforced always building multiple evidentiary layers upfront, letting facts speak without gray-area crutches--key for any litigator facing switched roles.
Separate Care Facts From Claim Facts
I handle cruise ship passenger and maritime worker injury claims (Jones Act/LHWCA/general maritime law) in Florida, and a lot of my confidentiality gray areas come from shipboard "company worlds" where HR, medical, and security all want information yesterday. One that wasn't cleanly answered by a rulebook was when a crewmember client's shipboard doctor and the cruise line's shoreside adjuster both pushed me to "just confirm" what the client told me happened, so they could "coordinate care" and "get maintenance and cure moving."
The dilemma was that parts of what the client told me were legally sensitive (liability details, witnesses, timeline), but the client also needed medical treatment and wage support fast. I resolved it by separating "care facts" from "case facts": I authorized release of medical records and treatment recommendations only (with a narrow written consent), and I refused to verify or expand on the client's narrative outside a formal, protected channel.
I also insisted all communications go in writing to a single designated contact, and I pre-briefed my client on what the cruise line could ask and what they didn't need to answer. If the line wanted a statement, it happened on a scheduled call with me present and ground rules stated up front, so confidentiality wasn't chipped away by "informal" shipboard conversations.
Confirm Authorization Before Any Case Updates
In personal injury work, situations involving confidentiality don't always look like formal ethics questions. Sometimes it's just an everyday moment that forces you to slow down.
I remember a case where a client had been injured in a car accident and was still going through medical treatment. During that period a relative began calling our office asking about the case if whether negotiations had started or how things were progressing. The calls didn't sound hostile or suspicious. It sounded like someone trying to help a family member who was overwhelmed.
The problem was that the person wasn't someone we had permission to speak with about our client's case.
That's where you have to pause. It would have been easy to assume the client wouldn't mind, especially since the relative seemed involved in helping them day to day. But confidentiality isn't something you assume your way through.
So we didn't get into the details. We simply explained that we needed to check with the client before discussing the matter with anyone else. After that we contacted the client directly and asked how they wanted communication handled. The client later confirmed they were comfortable with that family member receiving updates, and we documented that before sharing anything further.
Those small moments are where professional judgment really shows up. Slowing the conversation down and letting the client decide who gets access to their information is often the simplest way to protect both confidentiality and trust.
Wall Off Conflicts Narrow Counsel
With 23+ years in family law and mental health law -- including sitting as a Special Justice on civil commitment hearings -- I've faced confidentiality gray areas that the ethics rules simply don't anticipate.
The hardest one: a parent hired me in a custody case, then confided that their spouse was genuinely deteriorating mentally and becoming unsafe around the children. The spouse was also briefly my firm's former client. Nothing in the rules cleanly addressed the conflict between protecting the child, the current client's interests, and the residual duty to a former client.
I resolved it by drawing a hard line -- I withdrew from anything touching the former client's information, brought in co-counsel to wall off that conflict, and advised my current client through that narrow lane only. Messy, slower, more expensive. But the alternative was compromising the integrity of everything.
The lesson I'd pass on: when the ethics rules go silent, your instinct to protect *everyone's* dignity -- not just your current client's case -- is usually the right compass. Document your reasoning in real time, because if it ever gets questioned, your thought process matters as much as the outcome.
Refuse Compromised Channels Control Messages
I run Ammon Nelson Law PLLC (family law in Northern Utah) and wrote *Attorney Reinvented*, so I've had to live in the messy gap between "the rule says X" and "real humans behave like Y"--especially in high-conflict custody and divorce cases.
A recurring dilemma wasn't "can I disclose" but "what counts as disclosure" when tech is involved: a client emailed me a giant thread that included their spouse, the spouse's new partner, and even a school admin, then told me to "reply-all so everyone finally hears the truth." The ethics rules are clear about confidentiality, but they're not always clear about whether you can safely use a compromised channel the client handed you without accidentally confirming strategy, representation details, or privileged facts.
I refused to reply-all, moved the client to a clean channel (new email thread + portal), and got a written instruction that we would not communicate on any thread with third parties copied unless it was a deliberate, court-strategy decision. I then drafted a neutral message for any necessary third-party logistics (pickup times, school notices) that revealed nothing about legal positions, and I documented why I chose the "least revealing" communication route.
Integrity-wise, my rule is: if a message can be screenshot and used as Exhibit A, I write it so I'm still proud of it in front of a judge--and I'd rather annoy my own client for 10 minutes than accidentally waive privilege or hand the other side ammunition.
Steer Strategy To Trigger Court Safeguards
25 years of family law puts you in some genuinely murky ethical waters that the rulebook doesn't always illuminate clearly. The hardest situations I've faced involve a client disclosing something that suggests their child may be at risk, but stops short of the legal threshold that would mandate reporting.
In one case, a client shared details during strategy sessions that painted a troubling picture of the other parent's behavior around their kids. Nothing rose to the level of mandatory reporting, but my gut said something was wrong. The ethics rules gave me no clean answer -- confidentiality pointed one way, my duty as an officer of the court pulled another.
What I actually did was redirect the legal strategy itself. I used what I knew to aggressively pursue custody arguments and requested a minor's counsel appointment, letting the court's own investigation surface what I couldn't disclose directly. The system did the work confidentiality prevented me from doing myself.
The lesson I'd pass on: when the ethics rules go quiet, your strategy doesn't have to. You can often advocate for the right outcome through legitimate legal channels without ever breaking confidence -- but only if you know the process well enough to engineer those opportunities. That's where 25 years of exclusive family law focus genuinely matters.
