Stop Emailing Client Documents: A Better Way for Lehigh Valley Professional Firms to Share Sensitive Files

A client needs to send a tax return, signed agreement, settlement papers, insurance records, or closing documents. Someone at the firm replies, “Just email it to me.”

It’s familiar. It’s also an easy way for sensitive information to end up in the wrong inbox, remain scattered across mailboxes, or become accessible through a link no one remembers creating.

For law, accounting, financial advisory, insurance, and real estate firms in Allentown, Bethlehem, Easton, Whitehall, Emmaus, and across the Lehigh Valley, secure document exchange is part of client service. A firm-controlled portal can make sharing more convenient for clients while giving the business clearer control over access, retention, and oversight.

The goal isn’t to make every routine message complicated. It’s to stop treating ordinary email attachments and personal file-sharing accounts as the default channel for sensitive records.

Why the usual sharing habits create risk

Email is built for communication, not controlled document exchange. Standard email may be protected in transit between systems, but that does not necessarily mean an attachment is encrypted end to end or that access can be revoked after delivery. Once sent, copies may remain in the sender’s and recipient’s mailboxes, appear on synced devices, or persist in backups.

A small mistake can have an outsized effect: one wrong address selected from autocomplete, a reply sent to an outdated contact, or a message forwarded to someone who should not have received the file. Email also provides limited visibility into what happens after a recipient downloads an attachment.

Consumer file-sharing accounts can create a different set of problems. A link may be tied to an employee’s personal account, shared more broadly than intended, or left active after the project ends. If the firm doesn’t control the account, it may have little ability to manage access, apply retention rules, or review activity.

These tools aren’t inherently unsafe in every configuration. The problem is relying on unapproved channels without knowing who controls the data, how access works, and when the documents will be removed.

A portal is a client-service control, not just an IT feature

A well-managed document exchange should make it clear to clients where to upload files and where to retrieve them. It should also give the firm a consistent way to grant access to the right client, limit that access to the right records, and remove it when it is no longer needed.

That consistency matters. Clients are sharing information that may reveal their finances, health circumstances, legal disputes, property transactions, or personal identity. A confusing process can reduce confidence and invite workarounds. A clear, firm-branded portal, with straightforward instructions and a familiar place to return, helps clients understand that the firm takes their information seriously.

A properly selected and configured portal should be assessed for controls such as:

• Firm-managed access: Each client has an individual account or secure, client-specific access, not a shared password used across multiple people.
• Multi-factor authentication (MFA): Users provide an additional verification step, particularly when accessing sensitive records.
• Least-privilege permissions: Clients can access only their own information, and staff access is limited to what they need for their roles.
• Encryption: Information is encrypted in transit and at rest, with security details confirmed for the specific service and configuration.
• Expiring or revocable links: Access can be limited in time and withdrawn when the exchange is complete.
• Audit logs: The firm can review relevant activity, such as who accessed or downloaded a file and when.
• Retention and deletion rules: The firm has a defined approach for keeping records as long as required and securely disposing of unnecessary copies.
• Vendor oversight: The firm understands how the provider protects information, handles incidents, and supports the firm’s contractual and compliance responsibilities.

A portal is not automatically secure simply because it is called a portal. The firm still needs to configure it carefully, train staff, review access, and understand the provider’s safeguards.

Understand the compliance responsibilities

The right controls depend on the firm, the information it handles, and the laws and professional requirements that apply. A secure portal can support a compliance program, but it does not replace one.

For example, the FTC Safeguards Rule applies to certain financial institutions under FTC jurisdiction, including professional tax preparers. It requires a written information security program based on risk, with safeguards that include access controls, encryption of customer information in transit and at rest (or approved compensating controls when encryption is infeasible), MFA, monitoring, data-retention practices, and oversight of service providers. Firms should assess which requirements apply to their specific operations rather than assume every professional practice has identical obligations. Read the Safeguards Rule.

Tax preparers should also distinguish secure delivery from permitted use or disclosure. Internal Revenue Code Section 7216 separately governs the use and disclosure of tax-return information by preparers. Using a secure channel does not, by itself, authorize a disclosure for a purpose that otherwise requires taxpayer consent. The IRS Section 7216 Information Center provides regulatory information and guidance.

HIPAA has a narrower scope than many firms assume: it applies to covered entities and business associates handling electronic protected health information, not automatically to every business that handles confidential data. HHS explains that email transmission of e-PHI is not categorically prohibited, but organizations must assess risks and use appropriate safeguards. See HHS guidance on email and e-PHI.

The IRS also advises tax professionals to encrypt sensitive files and emails, use MFA, limit access, keep audit trails, and use secure file transfer instead of ordinary email for sensitive data. Its Publication 4557, Safeguarding Taxpayer Data, is a practical reference for tax firms. Professional firms should consult qualified legal and security advisors to map requirements to their services, records, contracts, and clients.

Identify, quantify, mitigate, monitor

B&R Computers uses an identify–quantify–mitigate–monitor approach to cyber risk. It works just as well for document sharing.

Identify: Map how files leave the firm

Start by listing the sensitive documents clients send or receive: tax returns, financial statements, contracts, medical records, insurance applications, settlement papers, and closing documents. Then document how each type moves.

Ask staff which email accounts, messaging tools, shared drives, or file-sharing links they use. Check whether any process depends on a personal account. Include both directions: documents clients send to the firm and files the firm delivers to clients.

The goal is to understand actual behavior, not just what the written policy says.

Quantify: Consider the impact of one mistake

Imagine a settlement statement sent to the wrong recipient or a file-sharing link that remains accessible after a transaction ends. What information could that person see? How many clients might be affected? Could the incident trigger contractual, regulatory, professional, or state notification obligations?

The answer will vary by information type and firm. The practical point is to evaluate the business impact: time spent investigating, client communications, possible legal or insurance consequences, and damage to trust. Do not assume that a single-client exposure is automatically minor.

Mitigate: Set one approved way to exchange sensitive files

Choose a firm-controlled channel and make it the standard for sensitive documents. Confirm access controls, MFA, expiration or revocation, audit logging, encryption, retention settings, and vendor safeguards before rollout.

Then make the workflow easy to follow:

1. Inventory the files clients exchange and the channels employees use today.
2. Select one approved channel for sensitive documents and define when exceptions are allowed.
3. Change the habit: Provide staff with a short, repeatable response directing clients to the approved upload or download process.
4. Set retention rules that align with legal, professional, contractual, and business requirements.
5. Train the team to verify recipients, avoid personal accounts, and report misdirected messages or exposed links promptly.
6. Explain the change to clients. Tell them where to upload and retrieve files, how access is protected, and who to contact if they need help.

For clients who cannot use a portal, define a documented, approved alternative rather than letting each employee improvise. The IRS guidance for tax professionals includes encrypted files and secure file transfer as alternatives to ordinary email for sensitive information.

Monitor: Check that the process stays controlled

Review sharing activity and external links at least quarterly. Remove access that is no longer needed, look for unusual download patterns, and confirm that the firm’s retention settings still match its policy. Revisit the process when new staff join, a practice area expands, or the firm changes technology providers.

Make secure sharing easier than the workaround

Clients should not need a technical manual to send a document. A clear instruction, a reliable firm-controlled portal, and responsive support can make the secure choice the convenient choice.

If your firm in Allentown, Bethlehem, Easton, Whitehall, Emmaus, or elsewhere in the Lehigh Valley is reviewing its document-sharing process, B&R Computers provides managed IT services for professional firms. For additional guidance, explore the B&R Computers resource hub and the IRS/FTC Safeguards Briefing.

To review how your current IT environment supports secure client file exchange, request a Business Review or Strategy Session. We’ll help you identify the gaps, understand the risks, and plan practical next steps.