4.1 Confidentiality

The current National Federation of Paralegal Associations (NFPA) Code of Ethics and Professional Responsibility was comprehensively updated on June 18, 2022, and the Board adopted minor updates on July 19, 2022. The word “Model” was removed from the title. On the Paralegal CORE Competency Exam (PCCE), confidentiality is Rule 1.5, conflicts are Rule 1.6, integrity and client funds are Rule 1.2, title disclosure is Rule 1.7, and unauthorized practice of law is Rule 1.8. Do not answer a 2026 item as if the old “EC-1 through EC-8 only” scheme were still the current numbering.

Rule 1.5 is one sentence and it is heavily tested: a paralegal shall preserve all confidential information provided by the client or acquired from other sources, before, during, and after the course of the professional relationship.

The Code defines confidential information as information relating to a client, whatever its source, that is not public knowledge and is not available to the public. The source can be the client, a spouse who sat in on intake, a treating physician, a claims adjuster, an opposing production, a vendor spreadsheet, or a remark the paralegal overheard in the lobby. The duty starts at the first inquiry — even before the attorney-client relationship is formed — and it survives the representation, the client’s death, the paralegal’s departure from the firm, and the file’s trip to off-site storage. “The case settled last year” is not a license to tell the story.

Broader than privilege

Confidentiality is an ethics duty. It applies in the office, in the carpool, on social media, and in the courthouse elevator. Attorney-client privilege is a narrower evidence rule that can exclude certain confidential lawyer–client communications from being used as evidence in a proceeding. Section 4.2 develops privilege and work product. For Rule 1.5 items, the exam-safe instinct is simpler: if the information relates to a client and is not public, do not use it and do not reveal it unless the Code’s narrow revelation path has been followed.

American Bar Association (ABA) Model Rule 1.6 is the attorney-facing counterpart (confidentiality of information). A leak by the paralegal is attributed to the lawyer under ABA Model Rule 5.3 (responsibilities regarding nonlawyer assistance). The PCCE will often mix the ethics label and the evidence label in one stem. If no proceeding, no subpoena, and no privilege log is in the facts, you are usually in Rule 1.5, not in the courtroom privilege objection.

EC-1.5(a) through (g)

EC-1.5(b) and (c) are the “use” rules, not only the “speech” rules. You may not short the client’s stock, tip a sibling about a coming acquisition, feed a reporter a “background” fact that hurts the client, or recycle a former client’s pricing strategy into a new client’s pitch. Silence in the hallway is not enough if you are quietly trading on what you learned.

EC-1.5(d) and (f) work as a lock and key. The paralegal is not the person who decides to disclose. The sequence is consult the supervising attorney first. After that consultation, the Code’s authorized paths are (1) the client’s written consent after full disclosure, (2) law or court order, and (3) prevention of death or serious bodily harm. “The spouse asked,” “the insurer is on deadline,” “my roommate already knows I work there,” and “the client nodded on the phone” are not on the list. Oral consent, standing alone, is not the written consent EC-1.5(d) specifies.

EC-1.5(e) is the opposite of a gag order inside the legal team. Hiding a damaging fact from the supervising attorney is not “protecting” the client. The duty is to inform the team so the lawyer can do the job, while not informing the world. If the client confesses a future crime, EC-1.3(f) separately requires an immediate report to the supervising attorney.

The paralegal cannot waive

Waiver of confidentiality or of attorney-client privilege belongs to the client, exercised through the lawyer. A paralegal who “clears” a reporter, forwards the draft will to a cousin, tells a court clerk “it’s fine, you can look,” or posts “the client said I could share this” has not created a valid waiver. The client did not consent in writing after full disclosure, and the supervising attorney did not authorize the revelation. On a PCCE item, any option in which the paralegal personally waives, “partially waives,” or “informally waives” is almost always wrong.

Hallway, elevator, and social-media leaks

The classic Rule 1.5 fact pattern is not a formal subpoena. It is a casual leak:

• Recounting “a crazy intake” on a crowded elevator
• Naming the client in a restaurant so the next table can identify the matter
• A Facebook, TikTok, Reddit, or group-chat post that is “anonymized” but contains unique facts (the rare disease, the intersection, the employer’s slogan)
• A home-office screen visible to a spouse, roommate, child, or delivery driver (EC-1.5(g))
• Client portable document format (PDF) files sitting in a personal Gmail draft or on an unlocked coffee-shop laptop
• Asking a former classmate for a “second opinion” by forwarding the client’s email

If a stranger who knows the community could identify the client or the matter, the post is a Rule 1.5 problem even without a name. Closed representations are not fair game. The word after in Rule 1.5 is literal.

Remote-work cybersecurity (EC-1.5(g))

The 2022 Code defines remote working and virtual work and then gives remote confidentiality its own Ethical Consideration. EC-1.5(g) requires two precautions: cybersecurity and a physical workspace that third parties cannot reach.

Cybersecurity, in exam language, means firm-approved tools, unique passwords, multi-factor authentication (MFA), no personal email for client documents, no consumer file-share links, encrypted devices, and no public Wi-Fi without a firm virtual private network (VPN). Physical security means facing the monitor away from household traffic, locking the screen when you stand up, using a privacy filter on a train, and not leaving paper files on the kitchen table. Competence under EC-1.1(d) overlaps: staying current on device and data security — in the office and remotely — is part of being a competent paralegal.

Worked path

Priya interviews a new employment client. The client mentions an undiagnosed medical condition that is not in any public filing. That afternoon Priya’s roommate asks why she looks stressed. Priya may not “de-identify” the story if the facts are unique. She may tell the supervising attorney (EC-1.5(e)). She may not tell the roommate, post about “toxic workplaces I’m seeing this week,” or later use the medical fact in a side consulting gig (EC-1.5(b)–(c)). If a court later orders production of a non-privileged business record, she still consults the attorney before producing anything (EC-1.5(d), (f)). She cannot tell the clerk “go ahead and copy the whole folder — I’ll waive it.”