Now that I finished my post on setting up a secure Internet connection, I want to write about equipment, confidentiality, and connecting that to a work from home policy for your employees.
I previously mentioned that the first thing you should do is talk to and train your employees on issue surrounding confidentiality. The same is true for your entire work from home policy. That conversation should be a precursor to having your employees to sign off on the fact that you explained the policy and they understood it. It is much harder to successfully challenge the notion that you discussed your policy with your employees when you have written proof that you did so.
You Probably Shouldn’t Write Your Own Policy
You can find sample work from home policies for ideas on language all over the place. Here I will provide a caveat. If you are not an employment lawyer this is the time to hire one. If you try to overreach in your work from home policy you could easily get yourself in trouble. You don’t need complaints with the NLRB because your policy or actions go too far.
There are plenty of employment lawyers out there who can help you, either by drafting the policy from scratch or looking at the policy you create. In my experience, it is often better to tell the employment attorney your concerns and let them draft the policy. They very likely already have one that can be the basis for a solid policy and craft your specific policy from there. If you are in Pennsylvania and need the name of a couple of employment law lawyers drop me a note and I will give you some.
Yes, you can write your own policy, but should you? Well, that is up to you, of course.
Measure Your Expectations
I don’t need to tell you that we are in the middle of a pandemic. That pandemic is having an extreme impact on everyone and everything. In a normal work from home situation, you have every right to expect the same output from a home employee as one in the office. Right now though, you need to measure your expectations based on the emotional and mental shock people are experiencing, the potential for depression, and the other tasks they have no choice but to handle right now. This is not a normal situation and you cannot expect your employees to produce the way they normally do. Nor can you expect the same from yourself. In other words, give yourself and your employees a break.
Explain your Expectations
Gather your staff together in a group or individually, via video or phone of course, and explain your expectations. Tell your staff what to expect from you and what you expect from them. Be clear with them, but again, also be reasonable under the circumstances. If you do not explain what you expect your staff will not know what you want from them. This is something you should do regardless of whether your staff works from home or in an office. Every six months, or even more often, you should tell your staff what you expect and how they are doing.
I often hear people complain about their employees, but when I ask, have you addressed the issue, I am normally told no. You cannot expect employees to meet your requirements if you don’t tell them what they are. If something makes you unhappy, tell them. Try to work it out.
Decide how to Measure Results
There are myriad ways to measure productivity and results. It is better to measure by whether the work you need is getting done than it is to focus on hours worked. But hours matter too, especially if that is how you pay or bill.
Address these expectations in your written policy. Make it clear what you expect in general and what you expect of each specific employee, based on their role in the office. Write it out and have them initial it. If there is a lack of clarity around job responsibilities, this is a good time to put together job descriptions and have employees sign off on those as well.
Keep Track of Hours
Obviously, you can simply have employees keep track of their hours. Your hourly employees need to keep track so you can pay them. You may want your non-hourly employees to keep track of time, but I suggest you consider whether that is really necessary. Remember, time you require employees to spend filling out hours is time they could have been doing other things.
There are many tools for phones, tablets, and computers that will allow your employees to track their hours. Many of them are free. Just look around for something that works for you and/or them. They do not all need to use the same tool, as long as it creates whatever kind of reports you want. You also could have them keep track in Word or Excel. However if there is something compatible with a system you use, look for it. It will make life easier. Especially for hourly employees and your bookkeeper.
Discuss Schedule Ahead of Time
In a situation like this, your employees may not be able to work their normal hours in a straight forward way. By that I mean they may not work from 9-5 with a lunch break. Remember, pandemic, childcare, distracted, and so on. Be flexible about the situation. The key is you need the work to get done. Don’t expect them to be glued to the desk all day though. Be flexible. If the job requires they be available at certain times, that is another matter. See how you can work it out.
Address Schedule in the Policy
Address schedule expectations in the written policy. Create different schedules as is appropriate for the work and each person. If your employee has to watch a child all day long, they aren’t going to be efficient employees during that time. Let them work in the evening, in between homeschooling, in between naps, whatever is necessary.
Provide a Daily Report
One of the best ways to keep track of productivity is to ask your employees to send you a quick report at the end of the day. You most likely don’t need a detailed report, just something simple identifying what they accomplished during the day. If you are billing their hours you probably won’t need something separate for this, but if you want to keep track of the non-billable time you could always ask for a short report of such efforts.
Judge Based On Results
If your employees are in constant contact with you or their supervisor throughout the day you can probably judge their productivity based on such communications. You may well be able to get enough of a sense of their work and results to be satisfied that they are doing enough.
How Do you Normally Judge Productivity?
Think about how you judge work every single day when you are seeing people. Do you need to judge it in a different way simply because they are out of sight? You may feel better about it, but decide if it is really necessary. Then do what you think is best.
If Necessary Start Restrictive and Loosen Up
You may find you want to watch more closely in the beginning, but over time you become comfortable with the efforts and realize it isn’t necessary. It is always easy to relax controls later, so start with what you think is necessary and reduce if you feel you can. Watch out for morale though. If your employees feel like you are spying on them and don’t trust them, it will impact their morale and how well they perform their jobs.
Include Expectations and Reporting in the Policy
Avoid confusion by making what you expect in terms of reporting and results clear in the policy. Have the employees initial that they understand. Follow up if there are any issues later on. Talk to employees if you see problems or have concerns. Don’t wait and let concerns or problems get out of control.
A Word of Advice: Don’t Overdo It
Don’t expect employees to answer every phone call immediately, especially on their cell phones. Don’t call them one minute later if they don’t answer an email right away. They may be caring for a child, or using the bathroom, or who knows what. People are anxious enough already. Don’t cause yourself and your employees more anxiety by trying to be overly controlling in a situation that is not controllable.
Security & Confidentiality
Now let’s talk about the other issue of major concern for lawyers. Confidentiality of client data. Attorneys must make it very clear to their employees that security and confidentiality are critical. Your work from home policy should clearly address the obligation to provide appropriate security and confidentiality.
Creating a Secure Home Office Space
There are four basic parts to having a secure home office. These include training, having an appropriate physical location, dealing with other people in the residence, and using appropriate tools. Let’s look at each in turn.
Training
I mention training a lot because it is so important. You must educate your employees on the confidentiality requirements for attorneys. You must make it clear in your policy that failure to keep appropriate confidentiality is grounds for punishment up to and including termination.
Explain the ethics rules as well as the potential for malpractice lawsuits so your employees understand why confidentiality is so critical. Let them know that the fact they are working from home is no excuse to violate client confidentiality, and boredom is no excuse to discuss clients with their family and friends.
You should provide training on the technology you expect your employees to use. In addition, provide training on technology security. For example, weak passwords are unacceptable and scammers try to fool people into sharing information.
Last, make sure you provide your employees with the equipment they need so they can do their jobs in a secure and efficient manner.
Physical Location
Your employees need a private place to work. A place where they can keep any physical documents secure and where they will not be overheard on the phone. The problem is that not everyone will have a space like this in their homes. Your employees will have to do the best they can under the circumstances.
Ask your employees what kind of space they have and address any security issues with them. If they do not have a locking desk, file cabinet, or some other secure space to put documents and small devices, get them something that locks. Amazon is delivering. So are other companies.
Set your employees up for success and give them what they need. You cannot complain about a lack of security if you do not give them the tools they need to keep client data safe.
Families/Roommates
Chances are good your employees live with someone. They need to have conversations with the people who share their living space about staying away from their files and technology, not eavesdropping on conversations, and not sharing any information they might happen to overhear. While neither you nor your employees can control the actions of those who share their living space, employees can explain the serious nature of attorney/client confidentiality. Young children are not likely to understand this concept so all your employees can do is their best. Normally you would not let someone work from home if they could not secure a private space that would help avoid these issues, but these are not normal times.
Equipment
I have already addressed the need for a secure Internet connection and how to set one up. You also need to have a conversation with your employees about their overall equipment at home. You should consider whether you want to provide all equipment so you have greater control over it.
IT Folks are Available
Keep in mind that many IT people can help you from a distance. A good way to make sure everything is secure and properly set up is to work with an experienced IT person who understands confidentiality and security.
Computers
If you have employees bring their work computers home or you buy them new computers, then you can insist they only use the machines for work purposes. You also can put tools on computers that allow for a certain amount of monitoring (leaving aside the question of whether you should use such tools), as well as security features that will allow you to find machines if they get stolen or lost. Obviously, you want quality malware protection on every computer.
If your employees are using their own computers, you cannot control everything that goes on them, who uses them, or how they are used. This is risky so you are better off providing your own equipment. Regardless, you can insist that they set up a separate account and password on their computers so no one else can access the work. If your employees use their own computers, ask if they have malware protection and find out what they have. If they don’t or what they are using isn’t great, buy some and ask them to install it.
Phones & Tablets
Cell phones need to have secure passwords. This does not mean 11111111.
If employees are using their own cell phones that limits the control you have. If you provide a cell phone, you can insist they not let anyone else use it. They can simply keep it locked up when they aren’t working. You can also do away with cell phones entirely by providing a desk phone or having them use the computer as a phone. Since they are home anyway, they don’t really need a cell phone for work, and cell phones come with their own unique set of risks that can be avoided if you stay away from them. They are also expensive.
If employees are using a cell phone, regardless of who it belongs to, ask them to turn on encryption and wipe/find lost phones apps. If it is their own phone they will likely object to sharing the ability for you to have the power to wipe their phone, which is understandable. But if it gets lost or stolen, they can wipe it themselves. Phones should have malware protection too. If you pay for malware protection you can purchase something that can be used on several computers and devices. Tablets should also have passwords and encryption turned on. The same malware programs that work on phones work on tablets. In addition, tablets have find/lost apps that can be activated.
Phone Headset
I recommend you get your employees a headset. This will avoid the need for putting private phone calls on speaker and can also be used during online video/audio chat to avoid having third parties overhear what others are saying. It will also decrease the likelihood that other people in the house will be overheard saying something inappropriate.
Scanners and Printers
If you need your employees to scan or print, you will need to either buy the equipment or let them take something home from the office. If they have their own equipment and are willing to use it, be prepared to reimburse them for toner or ink. Keep in mind that certain types of scanners and printers have memory. This memory can be a source of security issues. These issues are easily managed with proper security protocols and training.
Shredder
Ask your employees if they have a shredder. If they don’t, get them one. You want a micro-cut shredder. It is very important that your employees shred documents, pictures, cds, and dvds that contain confidential information. If your employees will have a lot of documents to shred, don’t buy a small shredder. The labor involved will discourage them from using it. Spend the money to get them what they need to effectively do their job. You can always use it in the office later on.
You need to provide a work email account for your employees and you need to insist they use it. You do not want your employees using a personal email account to communicate with clients or to send documents around. As I have written previously, your best options are Office 365 or the Business Google suite.
Neither you nor your employees should be sharing confidential documents or data via email. Email is not secure unless you add additional security to it. Keep this in mind when communicating via email. There are many tools you can use to add security to your email and you can insist that your employees use these tools. Provide training on how to use these tools. In the alternative, pick a secure cloud storage service and use that to share confidential documents.
Cloud Storage
You will likely be storing data in the cloud. In addition to making sure you choose the correct cloud provider, you should make it clear to employees they are only to use the cloud service you provide and they are only to use it for work. No personal files should be placed in your cloud storage. Employees should not venture out on their own to use something else. In addition, make sure you train your employees on how to properly and securely share documents. It is easy to improperly share documents, entire folders, or even entire accounts. Training is critical here.
Backups
Provide the ability to backup the computer. You should have two forms of backup. Two cloud or one local and one cloud. If you use a local device such as a USB drive or external hard-drive it should be encrypted. Local devices should be stored securely.
Warning Clients – Use Disclaimers
Don’t be afraid to tell your clients that you and your employees are working from home. They know you don’t have a choice. You should provide appropriate disclaimers to your clients about security risks. You should have been doing this anyway. You can send an amended agreement to your clients for them to sign, making them aware of the new situation as well as any risks that come with your forms of communication, especially if you are using tools such as Zoom.
Create a Computer, Internet Use & Equipment Policy
Each of the technology items I mentioned should be addressed in the policy. As noted, you should have a specific section for confidentiality in general. You should also have a specific section for computer and Internet use. As with the confidentiality policy, have your employees initial by each section of the computer and Internet use policy.
- Keep all technology secure with appropriate passwords, and when possible, encryption. Portable technology should be locked up and not shared with anyone.
- Make it clear in your policy that your employees must use the tools you provide and that they should not use personal devices for work, assuming you provide equipment. Nor should they allow anyone else to access these devices. They should not use work devices for personal reasons. This is one of the reasons it is better to provide the equipment.
- If you do not provide the equipment, you need to make it clear those tools must be properly secured from third parties. For example, as noted, if they are using a personal computer they should set up a separate username and password for their work.
- They must use the email, cloud storage, and other items you provide for work and must not use any of those items for personal purposes.
- Require all paper, cds, dvds to be shredded with the shredder you provider or a shredder they already have.
Conclusion
You have a right to expect a good day’s work from your employees, but do not expect, in these stressful times, for employees to be as efficient as they normally might be. Discuss work hours with them, but recognize they might not be able to work normal hours due to home responsibilities, such as taking care of children. Make your expectations clear both verbally and in writing. Have your employees sign that they understand.
Provide the technology your employees need so they can do their jobs, and make sure that you give them training so they can use what you provide. Create a written computer and Internet use policy that makes clear what they may and may not do with the equipment you provide and what you require of them. It is better to provide the equipment yourself so you have better control over it. If you do not, you will be limited in how much control you have, but you can still require certain levels of security from your employees.
Make sure you have clear discussions with your employees about your expectations. Stay in touch with them and speak up if you see something that disturbs you. The only way you can continue running a successful law office with employees is to keep an open field of communication with them. Especially when you are unable to see each other every day.