|Oregon State Bar Bulletin FEBRUARY/MARCH 2007|
Events that disrupt what defines a law firm — its people and physical space — need not be of catastrophic proportions. They can be as basic as the surprise snowstorm that struck Portland in January.
For varying parts of one week, law firms and courts in northwest Oregon were in the same boat as everybody else, subject to the great leveler that snow and ice can become in a place where both elements are uncommon.
In a small test of technology, Schwabe, Williamson & Wyatt had 45 firm members "coming in remotely on their computers, even if they were not in the office," says Don Williams, chief operating officer.
Legal consultants say lawyers should think of disaster planning in the same vein as they approach their line of work in advising clients: as contingency planning to ensure business continuity, or simply as managing risk. They should consider the time, effort and money spent on preparation for business disruption as a long-term investment in the viability of the firm.
Disruptive events could be on a large scale — such as floods, earthquakes or windstorms — where businesses and homes are affected over a widespread area. Or events can be localized to the office or building, such as a fire, explosion or toxic spill that causes damage or prevents access. And no one in 2007 needs reminding that emergencies can be caused by intentional acts, as well.
Consultants such as Virginia Grant with Altman Weil advise all law firms to establish and maintain an emergency action plan. The best-prepared firms have set up a system that allows firm members to evacuate safely during an emergency situation, and ensures that most of the firm’s vital operations can continue to function without interruption, at an off-site location, she says.
A firm’s clients want the assurance that if the physical space of the firm is damaged or inaccessible, clients’ records will be in safe hands, and the firm will continue to be able to represent them and do work for them.
Perhaps because of that business factor, or because disaster preparation is a complex, emerging area for legal practices — and thus many firms either have not begun preparing plans or have not debuted them yet — it is a topic that makes people nervous to discuss. Several firms large and small, from throughout the state, declined the opportunity to participate in this article.
Soon, law firms’ ability to demonstrate preparedness may be considered a competitive advantage, if not a standard part of doing business. That already is happening on the East Coast. According to Washington Lawyer (July/August 2006): "For some clients, how a law firm handles disaster recovery and business continuity may be a factor in their selection. Clients have been known to ask firms to submit disaster planning information in their requests for proposals." But for now, in the early stages for some Oregon firms, it is a subject that may be uncomfortable to think about.
"It is something every business should have in place," but some law firms don’t, says Brad Miller, claim and risk manager for JBL&K Risk Services in Portland.
For one thing, he points out, the Occupational Safety & Health Administration requires that all business of 11 or more employees have a written "emergency action plan in place" that, among other requirements, includes a contact list for everyone covered by the plan, and specifies procedures for: reporting a fire or other emergency; shutdown of electrical equipment; and rescue and medical directives.
Firms with under 11 members do not have to have such a plan in writing, but it "is still a good idea," counsels Miller, whose firm assists and provides advice for a business, but does not write the plan. Miller adds that although OSHA is unlikely to case a firm unannounced, law firms are subject to the same workplace regulations that apply to a manufacturing facility.
Schwabe’s Williams likens disaster planning to an amoeba. "When you push one place, two more pop out. It’s really a challenge, because there are so many aspects to it." He adds that whenever office motivation to prepare becomes a problem, he needs only point to Portland’s most recent earthquake — as of this writing — which "had as its epicenter the northeast corner of our building," Williams says. "That brought it home."
Schwabe embarked on a contingency and disaster recovery plan about seven or eight years ago. The firm hired an outside consultant and involved Schwabe managers. The premise was to prepare for one key scenario: a fire in the firm’s Portland office.
"You have to make plans dynamic or they become out of date," he says. The firm’s focus the last two years has been on information services: developing an off-site website to allow people to communicate and find out what is happening; and backup capability for data. The latter system passed an unexpected, actual test when Schwabe’s Bend office flooded during remodeling, and the same day’s information was backed up, as it is supposed to be.
Early last year, Schwabe cooperated with several other firms and brought in a representative from its commercial liability insurer to talk about "why a plan is necessary and potential problems," Williams says.
"Our plan is far from perfect. It’s better than many, but (improving it) is a priority for 2007. Our managing partner said, ‘It’s fine to be ahead, but we need to be close to perfect, because once it happens, you don’t have the chance to go back.’"
Davis Wright Tremaine first developed a "business-resumption plan" in the early 1990s. But after 9/11, the firm was inspired by the story of how Marsh & McLennan Cos. in the former World Trade Center dealt with its many business and communication issues in the aftermath of the disaster, says Rodney E. Lewis Jr., Portland partner-in-charge of Davis Wright.
As a result, the firm broadened its plan to include evacuation and communication procedures, he says. Representatives from systems, accounting, central records, facilities, library and marketing departments were given the task of creating business record protection and resumption plans, "which provided the basis for the disaster preparedness and recovery plan we use today," says Lewis.
The plan is available to Davis Wright’s attorneys and staff firm wide by logging into the private system through the firm’s external website. There is also an 800-number for each office for the purpose of distributing information.
An electronic version of the disaster recovery manual also is available to attorneys and staff on the firm’s intranet, as well as by logging into the private system through Davis Wright’s external website. The manual contains procedures, phone numbers and forms necessary to communicate the firm’s client needs.
The manual also addresses local or national emergencies that affect the building. Covered are:
The firm’s manual also lists all employees, the types of possible business interruptions, recommended basic emergency supplies, and a disaster-recovery organizations resource list.
Office administrators revisit Davis Wright’s communication plan annually, and the human resources department has implemented software that will make it easier to track people via a database in the event of an evacuation, according to Lewis.
Miller Nash’s disaster plan focuses on being able to "get our people out safely and protect our employee and client records," says Erica Daley, executive director and chief financial officer. When she arrived at the firm a year ago, Daley took on as one of her tasks to institute a several-step implementation that would prepare the firm as much as feasible to protect people and data.
"There’s no way you can put together a plan to prepare for every type of emergency," Daley says. "We are using a common-sense approach that will protect our people and our information if any one, or all, of our offices are affected at any given time. Ultimately, we will come up with a plan that will work under most circumstances."
Daley says that every conference she attends has included this topic on the agenda, and a number of seminars are being taught. She also receives inquiries from smaller firms asking what Miller Nash is doing.
The firm has an in-house information technology team, which keeps up with the tech side of how to prepare law firms for business continuity when an emergency strikes. The system now in place backs up everything except the current day’s work, and the firm is working toward being able to back up that, as well. To do so requires new software and hardware.
"It can be very expensive, but I think most organizations are doing this one step at a time," she says. "We are taking efficient steps today, and upgrading our internal systems as we go."
Joan Brambani, the new director of administration for Harrang Long Gary Rudnick, has made a priority of developing a comprehensive plan for disaster recovery and business resumption. The firm is designing an awareness and education program that includes evacuation protocols and training in first aid, CPR, defibrillation equipment, fire safety and biohazard safety, she says.
It also is concurrently taking measures to appoint lines of authority for emergency decision-making; establish off-site, rotational storage of backup data tapes; procure an external HIPAA-compliant facility for emergency business resumption; update appraisals and asset inventories for off-site storage; and procure all equipment and supplies necessary for human and data protection.
Brambani adds that although the plan will be highly detailed, protocols will be stated in simple, direct language, so as to ensure easy comprehension and recall.
"Unfortunately, this kind of project is all too easily placed on the back burner and, of course, should be a priority for all," she says.
Jordan Schrader has done some initial planning and implementation, including storing backups of electronic files, establishing computer setups off-site on a weekly basis and keeping daily backups on-site in a fireproof safe.
"And nearly everything we have is in electronic form, so nearly all of our client information would be preserved in the event of a catastrophic on-site event," says Bev Davis, chief operating officer. "Our attorneys can log into our systems remotely, and our systems have backup power generation that will last several hours."
A longer-term plan for Jordan Schrader is to create a password-protected extranet that all employees can log into for information and updates, as well as forms that could be used for emergency court filings.
Courts Rising to the Challenge
The need for Oregon’s courts to prepare can be attested to by Marion County’s courthouse, which was displaced for a year, notes Scott C. Crampton, director of appellate court services for the Oregon Judicial Department. But an emergency for a court could be as simple as: What are you going to do if your computer system goes down, and it is more than for a short time? You need to be thinking in advance, and have backup systems ready, he says.
State courts received a mandate, House Bill 2792, from the 2005 Legislature, which requires all state courts to develop court security, emergency preparedness and business continuity plans.
Those courts, which include circuit courts, the Court of Appeals, the Tax Court, the Oregon Supreme Court, and the Office of the State Court Administrator, are engaged at the department level in developing these plans by June 30, says Crampton.
The Judicial Department engaged a consultant on the business continuity plan, and has developed some manuals and templates. A state security preparation committee developed draft manuals so that courts would not have to create from scratch.
Once the plans are in place, they must be tested and revised constantly, Crampton says. Courts that have been struck by disasters such as earthquakes will tell you that the best-laid preparations don’t always work exactly as planned, he adds.
ABOUT THE AUTHOR
Cliff Collins is a Portland-area freelance writer and a frequent contributor to the Bulletin.
© 2007 Cliff Collins