Managed IT for Law Firms

Oregon RPC 1.6 requires attorneys to make reasonable efforts to prevent unauthorized disclosure of client information — and what counts as "reasonable" scales with how sensitive the data is and what it would cost to protect it, which means a firm handling family law or high-value business litigation has a higher bar than one doing routine transactional work. In practice, that baseline means strong access controls, encrypted communications, multi-factor authentication, and a written incident response plan — the kind of controls a bar complaint or malpractice claim would specifically ask whether you had in place. I build firms to that standard, not the minimum that technically gets by.

Yes. I manage the workstations, network, and Microsoft 365 environment your practice management software runs on — uptime, backup of your matter data, secure remote access for attorneys in court or working from home — and coordinate with Clio, MyCase, or PracticePanther support directly when an issue is application-specific rather than infrastructure. Most firms I work with are running one of these three; I already know their common failure points and support escalation paths.

The cleanest option is a client portal built into your practice management software, or a properly configured SharePoint/OneDrive setup inside Microsoft 365 with expiring links and access logging. Either one avoids the real risk with email attachments — an unencrypted PDF of a settlement agreement or medical record sitting in someone's inbox indefinitely, forwarded who-knows-where. I set up and support whichever fits your firm's existing workflow, and I make sure staff actually use it instead of defaulting back to email out of habit.

Oregon law requires notifying affected individuals if their personal information was accessed, and depending on how many people are affected, may require notifying the Oregon Attorney General as well. Your first calls should be to your IT provider to contain it, your cyber insurance carrier, and your malpractice or general counsel — roughly in that order, and within hours, not days. Having those numbers written down before an incident, as part of an actual incident response plan, is the difference between a controlled response measured in hours and a scramble that stretches into weeks while everyone figures out who's supposed to be doing what. I help firms put that plan together before they need it.

Client confidentiality depends on continuity, and that's exactly what you get working with me directly instead of a rotating help desk. I've spent over 40 years in IT, running Ask Erik Computer Services since 2006 and serving Lane County firms since bringing the business to Eugene in 2017. I'm a Microsoft Partner, AI-certified, and a BNI Hall of Fame member here in Eugene. I document every access control decision and security change I make — the kind of record a bar complaint or malpractice claim would actually require — and I explain it in plain English, not jargon. When something breaks, you hear why it broke and what we're changing so it doesn't happen again, from the same person who set the system up in the first place.