Author: Onit

Before looking at UTBMS issues affecting law firms and in-house departments, we first need to distinguish between ”full” e-billing compared to the uploading of a copy of a paper bill or the keying of invoice details to a client or third-party web site. Full e-billing involves the production of an electronic file, usually in one of the LEDES formats (Legal Electronic Data Exchange Standards), which contains not just the invoice header, matter information and bill totals but a detailed breakdown of timelines and expenses. This detail is coded using the Uniform Task-Based Management System (UTBMS), also known as ABA task codes, which is comprised of sets of codes that help breakdown legal work and expenses across a timeline of activity to a fine level of detail. The codes were designed to provide clients and law firms with a common method for identifying the work breakdown and cost information of legal services.

There are legal task code sets for different types of legal work (e.g., Litigation, Bankruptcy, Trademark, Project/Transactional and Counseling) and a set of activity codes to categorise “how” the work on the matter is being done. For every matter, the in-house client receives an itemised bill with full transparency of the outside counsel fee earners who worked on the account, what tasks (e.g., taking a witness statement) and activities (e.g., drafting a letter) they undertook, and the time taken, the rate and cost of the item of work. Once the e-bill is generated, the information is validated against client guidelines held in the e-billing solution.

The e-bill passes various levels of validation before being uploaded to the client’s systems where it is then authorised and paid. The in-house legal team is then able to use legal spend management software to analyse the billing data using the UTBMS code detail and compare like-with-like information across all their outside counsel submitting e-bills.

The benefits of this approach are many. Corporate legal operations teams can easily compare and contrast the cost and efficiency with which different law firms execute similar matters. Such insight allows in-house lawyers to have intelligent and well-informed conversations during law firm reviews and re-negotiations. Over time, this enables the corporate legal department and law firm to become smarter in the way they execute matters.
THE IMPORTANCE OF ACCURATE LEGAL TIME RECORDING

It is outside counsel’s responsibility to maintain accurate time records, detailing the time spent on each item of work throughout the day. Without proper time records, the billing entries must be reconstructed from memory and the time spent on each task could be based on nothing more than a guess. This practice could ultimately lead to overbilling. Therefore, it is imperative that bills are based on accurately documented time records that detail each task and activity performed. However, daily time records are not enough if the entries are recorded in a block billed format.

BREAKING THE BLOCK BILLING PRACTICE

Block billing occurs when several discrete tasks or activities are recorded under a single time unit, rather than itemising the time spent on each separate activity. In-house clients usually prohibit this practice because it makes it difficult, if not impossible, to determine whether the work performed and the fees incurred are reasonable. Although most examples of outside counsel billing guidelines prohibit attorneys from submitting invoices that are block billed, clients typically allow their attorneys to correct such entries without penalty.

POSITIVES OF USING UTBMS CODES

As noted above, the UTBMS codes are a powerful tool for analysing patterns and comparing performance.

UTBMS information is, of course, useful to compare how law firms deploy their resources for work on similar phases/tasks/activities of like matters (e.g., percent of partner, associate or paralegal time and fees) but also reveals the average and median rates, as well as by level of resource for that legal work. Examining activity at this level across firms invariably reveals diverse practices with the best and worst practices being immediately apparent. When addressing such issues with firms, the client has the data, and the data is based upon that firm’s actual invoice entries.

The information is also useful for examining billing on diverse matters, as the UTBMS information can be used to compare the performance of multiple firms working on the same matter as well as compare individuals within the same firm working on the same matter.

In the past 20 or so years, there has been a shift. Clients are now requiring their outside counsel to conform to billing practices that provide more than just a basic level of standardisation. These standards are designed to make non-compliant charges stand out where they may have been buried previously.

PROBLEMS WITH UTBMS CODES

On the one hand, the standardisation offered by the Uniform Task-Based Management System (UTBMS) and Legal Electronic Data Exchange Standard (LEDES) codes have created a path towards greater transparency in legal spend management. Their implementation, however, created issues of their own.

UTBMS codes are problematic for several reasons but primarily because they can be unreliable and the system is totally reliant on each timekeeper to provide accurate data, which they often fail to do. Firstly, timekeepers must be trained and become familiar with the expansive list of codes – a large undertaking. For instance, the Litigation Task Codes (one of several such code sets) has close to 30 legal task codes, each of which rolls up to one of five phases. Adding to the complexity, there are nearly 30 activity codes that may also be applied and many more expense codes.

Secondly, this complexity can cause confusion as to which UTBMS code to apply to which task/activity. In addition, timekeepers may intentionally assign incorrect codes because they are either too busy to search for the correct code or are indifferent to how these codes may benefit them or their clients. One common action is that a timekeeper will select the first legal task code or a commonly used code from the UTBMS drop-down list in their billing software. This saves them time, and they do not see a negative impact from doing so. Other mistakes might be unintentional, involving issues with the billing software or accidental errors that can occur from a user typing or using a drop-down menu to input one of 30 codes. All these errors affect the integrity of the data, making the codes unusable for analytics and therefore frustrating the in-house client.

In truth, the framework of legal task codes was a great achievement for the industry and while it may be possible to refine the UTBMS codes it may not be feasible to make them any simpler. Solving this problem requires being active, adaptive, and creative with the data that is available.

USE OF AI (ARTIFICIAL INTELLIGENCE) IN LAW FIRM TIMEKEEPING

At a law firm, manual time and task logging is a time-consuming, error-prone process that does not benefit itself from being billable. Adding UTBMS or LEDES billing coding to the mix slows the process even further. On top of that, coding mistakes can lead to invoice rejections, while compromising collection rates along the way.

However, new AI (Artificial Intelligence) and machine learning applications can offer solutions to these problems. Instead of submitting bills without review and hoping the client does not dispute the charges, or manually reviewing billing entries prior to submission in order to comply with the client billing rules, new applications are being used to automate the process at law firms.

With previous e-billing solutions, lawyers and other timekeepers would have to manually look up the corresponding UTBMS code for each specific task or expense. With the new artificial intelligence applications, the software will automatically determine the correct code from the task, activity, or expense description. The code selection process uses the law firm’s own data to make sure the codes are accurate and uses machine learning to adjust to any changes. The outside counsel saves valuable time – addressing the issues mentioned above – and the in-house client receives accurate legal bills that have the level of data necessary for analysis of their matters, legal spend, and law firms.

Features and benefits of a legal spend management product like BusyLamp include:

• Easy to use and configure, and use intelligent defaults and data driven user set-up.
• Use text recognition software to read/convert the data from the e-bills or from pdf documents.
• Automate manual, low-skilled processes so both the in-house team and the law firm can spend more time on high value work instead of admin.
• Take advantage of the latest developments in AI (Artificial Intelligence) to automate the bill review process, categorise narratives and provide pricing analytics.
• Combine the above with machine learning to enhance the data mining possibilities of the invoice information for the client to make better and informed decisions.
• Offer a low cost of ownership as they require no on-site installation and are delivered as web services.
• Easily integrated with other client applications such as document/knowledge management, project management, calendaring, and the standard desktop – thus reducing costs for corporate legal IT.
• Cover a wide range of the business processes – from Requests for Proposals and Procurement, matter budgeting, resource planning, project management, through e-billing to a reporting and management information suite with easy-to-understand metrics for corporate legal departments and the law firms.
• They facilitate collaborative working between the client and their outside counsel and allow the client to review WIP and expenses in the pre-billing stages of each matter.

Request a demo of BusyLamp eBilling.Space today.

The Panama papers and Paradise papers cyberattacks against law firms. The issues of data harvesting emerging from the Cambridge Analytica scandal. The volume of reported data breaches. Cyber-attacks and data breaches are becoming inevitable as increasingly high quantities of information are stored electronically. In addition, GDPR has introduced requirements to notify the relevant supervisory authorities and individuals who may be adversely impacted much more promptly (within 72 hours of becoming aware).

As a result, there is a greater need for stronger controls around data security, both within your organization and for companies holding your data. A robust records management policy is integral to your company’s ability to understand what information is available, where it is, and in what format. Most importantly, it sets a clear framework for handling, managing, and storing that data.

You may have agreements with your external partners on how they manage and handle your data; historically, companies may have relied on this with little further investigation.

However, if you have ever handled the fallout of a data breach by one of your suppliers, you will appreciate the pressures of trying to assess the potential risk and exposure the breach might have on your company. All of which must be done within very tight timescales if you need to notify the authorities and individuals concerned.

USING LEGAL SPEND MANAGEMENT SOFTWARE TO IMPROVE DATA SECURITY

One often-overlooked tool that can help (both with an immediate investigation and future risk assessments) is a legal spend management system (Onit’s European legal spend management solution BusyLamp eBilling.Space). Integrated legal spend and matter management software can provide a wealth of information to help legal operations understand and manage the data that the law firms hold for you and can support you in building a records inventory.

Legal spend management tools can provide clarity on the following:

• The external law firms used,
• What type of work outside counsel are undertaking, and
• Who at the law firms has worked on the matter and therefore had access to your data.

Knowing the data shared with your law firm is vital for an immediate investigation. Access to the matter details in your legal spend management system will provide you with a good starting point to gather information. Basic information will include the law firm’s name and the person(s) in your firm who may be working on the matter(s). It will also provide a contact point at the law firm. Finally, based on the work, you will have a rough idea of the documents shared with the firm.

If you are looking to assess the risks of sharing your data both now and in the future, legal spend management software will provide details of the number of times your company has used the firm. With this, you can assess the risks and controls in place with all your outside counsel and carry out appropriate system security assessments. You can also more easily check that the law firms have implemented and are complying with your records management and retention policies.

The amount and sensitivity of the data sent to your law firms comes from the type of work undertaken. Most companies will generally share similar types of data for specific categories of work with their external partners. As an example, for an employment issue, details about the employee and the grievance will be shared with the external counsel. Using the information in a legal spend management system about the types of work done by the law firms will help you assess the risks and controls each law firm has in place to protect your data and consider the best and most appropriate ways to transfer your data. Furthermore, it can help you build your records inventories.

Finally, as law firms record the time that a timekeeper spends working on a matter, invoice data captured by e-billing software will allow you to see who has access to your information at the firm.

Knowing and understanding the type and volume of data that your company has shared with your law firms will help you a) respond to and manage any data breach or data loss and b) understand the potential risks to your data. This knowledge will help you assess whether you are using the best legal technology for sharing your data and whether the processes you have in place to transfer your data are appropriate.

Learn more about BusyLamp from Onit, our end-to-end legal spend management solution built for European corporate legal departments. 

As legal data is highly sensitive, data privacy, cybersecurity, and compliance are the top corporate organizational focus areas. Yet despite the scrutiny in-house legal rightly applies to business activities and counsel, they are not necessarily applying this same focus when evaluating the legal technology, they use within their departments. The sensitive nature of the information that passes through legal systems means that data security should be paramount.

Anecdotally, we hear of legal tech projects where data security requirements are raised late in the game, sometimes after IT becomes involved in the project, and can result in the favourite vendor getting immediately disqualified from the selection because of weak security features and policies.

This is understandable. Most lawyers and even technology-savvy legal operations managers are not data security experts. The main focus when buying legal software are the features that assist in daily work and decision-making, so the “under the bonnet” functionality is not always front of mind, nor do in-house counsel necessarily know the right questions to ask.

The following list of security considerations will aid you in asking pointed questions so you can address system safety at the same time as the ‘core’ functional requirements of the technology. This will save you time in the selection process and make picking the right solution for you that bit easier. There is already a lot of cyber risk that could be affecting your company, your legal technology should not be one of these worries.

ENCRYPTION (“AT-REST-ENCRYPTION”)
Legal documents contain sensitive data. Therefore, encrypt with a secure and up-to-date algorithm. Many legal tech vendors encrypt the hard disk while storing unencrypted data in the database. This interpretation of at-rest encryption is a measure that prevents data leaks in the unlikely event of the theft of a hard disk. Onit’s European legal spend management solution BusyLamp eBilling.Space takes at-rest encryption to the next level by using AES256 to store customer data (including backups) with individual keys securely on the hard disk and in the database. The latter means we apply an additional layer of security as a countermeasure for potential cyberattacks.

ENCRYPTED TRANSMISSION (“IN-TRANSIT-ENCRYPTION”)
The data must not only be stored in encrypted form but must also reach the user securely. Therefore, all communication should be encrypted. Since the methods are prone to attack, always use an up-to-date secure version. BusyLamp uses TLS with the version >= 1.2.

DATA SEPARATION
Especially with software as a Service (SaaS) offerings, it is common for an application to be used by several customers. In this scenario, store client data separately from that of other customers. This prevents access to your data by other users “by accident” (e.g., due to software programming errors). There are several ways to separate data, and BusyLamp offers the most secure options. We can provide physical separation, i.e., a customer has their own server, or the most effective logical separation, i.e., a customer owns its database on shared servers.

DATA ACCESS RIGHTS
GDPR and other internal and external regulations often require access rights to be set at a need-to-know level. Therefore, the legal software must allow data visibility to be set individually for each user. BusyLamp works according to the “principle of least privilege” – the normal user can initially see nothing. Then, specific data access for in-house and outside counsel users is activated on an individual or via group logic.

DATA LOCATION
Everyone is talking about the U.S. PATRIOT Act, CLOUD Act, CCPA, GDPR, and similar data security regulations that can have a massive impact on our client’s data hosting strategies. Onit’s BusyLamp legal spend management software is a German product and hence not subject to any potential claims by the U.S. government under such acts. We store data securely at your preferred geographical location.

FIREWALLS AND SERVERS
Any application is only as secure as the servers it runs on. Every application connected to the Internet becomes a daily victim of automatic or targeted attacks. Therefore, a well-thought-out strategy to defend against these attacks by the legal software operator is essential to ensure the protection and integrity of your legal data. This strategy should include several nested measures (the “onion technique”). First, a web application firewall protects the application itself. In addition, the server group gets protected by a firewall. The last link in the chain is an optimally configured server that fends off all unauthorized access. An independent service should monitor all components and actively report deviations from the norm. Regularly updating all systems involved should go without saying to guarantee up-to-date and optimal protection.

INDEPENDENT SYSTEM PENETRATION TESTS
Precautions taken always look good on paper. But is the vendor keeping their promises? To find out, the legal software provider should have their systems tested regularly by an independent third party. This “planned attack” attempts to remove all security measures before a malicious attacker does. All vulnerabilities found are documented and submitted to the vendor for an immediate fix. BusyLamp is tested at least once a quarter by a team of experts; we also allow all BusyLamp customers to view the corresponding test protocols.

SOFTWARE PASSWORD PROTECTION
Robust passwords are essential to prevent unwanted access to the legal system. BusyLamp has configurable password settings that administrators can set to ensure user passwords are sufficiently strong and meet your company’s password policies.

DATA SECURITY RIGHT FROM THE START
The ability to mitigate the impact of any security breaches is important, but security gaps should not arise in the first place. Therefore, your chosen legal tech vendor must deliver regular training to those involved in developing the software to maintain a consistently high level of data security. When testing the software, check the actual functions and search known security holes (e.g., OWASP Top 10).

Request a demo of BusyLamp eBilling.Space today.