The penalty for breaking attorney-client privilege ranges from a private written warning to permanent disbarment, with civil malpractice liability, courtroom sanctions, and in rare cases criminal prosecution layered on top. The exact consequence turns on how the disclosure happened, how much harm it caused, whether it occurred during active litigation, and whether the attorney acted intentionally or carelessly. A single breach can trigger more than one of these consequences at the same time.
One caveat before the penalties: not every disclosure is a violation. The ethical rules carve out specific situations where an attorney is permitted or even required to reveal information. Those exceptions are covered near the end, because readers often mistake a lawful disclosure for a punishable one.
Discipline From the State Bar
Every licensed attorney answers to a state bar, and breaching client confidentiality violates Rule 1.6 of the rules of professional conduct that every state has adopted in some form.1American Bar Association. Rule 1.6 Confidentiality of Information After a complaint, investigation, and hearing, the bar can impose one of four graduated sanctions drawn from the ABA’s Model Rules for Lawyer Disciplinary Enforcement.2American Bar Association. Model Rules for Lawyer Disciplinary Enforcement – Rule 10
- Admonition. A private written warning for minor misconduct where client injury is minimal and repetition unlikely. It stays off the public record.
- Reprimand. A written reprimand from the court or disciplinary board. Court-issued reprimands are published in official reports, so they are public and permanent.
- Suspension. Loss of the license for up to three years under the model rules. The attorney cannot practice at all during the suspension.
- Disbarment. Permanent revocation of the license, reserved for misconduct so severe that even a three-year suspension would be inadequate.
Severity depends on whether the attorney acted intentionally or carelessly, how much the client suffered, and whether the attorney has prior discipline. A deliberate leak that benefits the attorney personally also triggers Rule 8.4, which treats dishonesty and fraud as independent misconduct.3American Bar Association. Rule 8.4 Misconduct Charging an attorney under both rules at once is common when the breach is intentional.
Rule 1.6(c) adds a forward-looking duty: attorneys must take reasonable steps to prevent inadvertent or unauthorized disclosure in the first place.1American Bar Association. Rule 1.6 Confidentiality of Information Storing client files on an unsecured server can itself violate the rule, even before any leak occurs.
Civil Malpractice Liability
A client harmed by an improper disclosure can sue the attorney for legal malpractice. This is a separate civil lawsuit, independent of bar discipline, and the point is money. Conflict-of-interest and confidentiality cases are a significant source of malpractice litigation. Over the past few decades, at least fifteen publicly reported conflict-related malpractice settlements or verdicts have exceeded $20 million, with another thirteen falling between $3 million and $20 million.
To win, the client generally must prove four things: an attorney-client relationship existed, the attorney breached the duty of confidentiality, that breach caused harm, and actual damages followed. Causation is where most cases get difficult.
The Case-Within-a-Case Problem
When a breach damaged the client’s underlying legal matter, courts require the client to prove a “case within a case.” The client must essentially retry the original matter inside the malpractice trial and show that, but for the breach, they would have won or achieved a better result. If the underlying claim would have lost anyway, the malpractice case fails even when the attorney’s misconduct is undisputed. For transactional work, the client must show they would have gotten a better deal or avoided the deal entirely. Proving what “would have happened” is inherently speculative, which is why plaintiffs face an uphill battle despite clear misconduct.
Damages and Deadlines
Recoverable damages can include the financial loss from the underlying matter, economic harm caused by the leaked information itself, and in some jurisdictions compensation for emotional distress. Every state imposes a statute of limitations on malpractice claims, and the deadlines vary widely. Many states apply a discovery rule that starts the clock when the client knew or reasonably should have known about the breach, which matters because confidentiality violations often stay hidden for months or years. Missing the deadline forfeits the claim entirely, so a client who suspects a breach should consult another attorney promptly.
Sanctions Inside an Active Case
When the breach happens during ongoing litigation, the trial judge has tools to address the damage immediately. These sanctions protect the fairness of the proceeding and operate independently from bar discipline or a malpractice suit. The same attorney can face all three for a single breach.
Disqualification
A court can remove the offending attorney from the case. Disqualification is common when an attorney receives privileged documents by mistake and uses them for strategic advantage instead of flagging the error. Courts have held that when a reasonably competent attorney would have recognized the material as privileged and inadvertently produced, that attorney must stop reviewing it, notify the privilege holder immediately, and refrain from using it until the court rules. Skipping those steps can get the attorney and the entire firm removed from the case.
Evidence Suppression
A judge can rule information that entered the case through a privilege violation inadmissible. The opposing party cannot use it, and in some cases the court will issue an adverse inference instruction or order destruction of the improperly obtained materials. Federal Rule of Evidence 502 governs waiver in federal proceedings and preserves privilege when disclosure was inadvertent, so long as the holder took reasonable steps to prevent it and moved promptly to fix the error.4Legal Information Institute. Federal Rules of Evidence Rule 502 – Attorney-Client Privilege and Work Product; Limitations on Waiver
Mistrial
In the most extreme situations, where the breach has so thoroughly contaminated the proceedings that no jury instruction can repair the damage, a judge may declare a mistrial. The case starts over with a new jury. Mistrials are rare because they are so costly to everyone involved, but they remain available when trial integrity is beyond repair.
Criminal Prosecution
Criminal charges for a confidentiality breach are uncommon. The breach itself usually is not a standalone crime; it becomes criminal when it is tied to separate illegal conduct.
The Crime-Fraud Exception
Privilege does not protect communications made to further a crime or fraud. If a client seeks legal advice to commit or conceal criminal activity, those communications can be pierced. Most courts require the party seeking to pierce the privilege to meet a prima facie standard sometimes described as analogous to probable cause. When the attorney actively participates in the scheme rather than being an unwitting tool, they can be prosecuted for the underlying offense alongside the client.
Obstruction and Misprision
An attorney who discloses or conceals information to mislead a court, interfere with an investigation, or help a client hide evidence can face charges for obstruction of justice or perjury. Under 18 U.S.C. ยง 4, anyone who knows a federal felony has been committed, conceals that knowledge, and fails to report it can face up to three years in prison and fines.5Office of the Law Revision Counsel. United States Code Title 18 Section 4 – Misprision of Felony The statute requires affirmative acts of concealment like destroying evidence or making false statements. Staying silent about a client’s past crimes does not trigger it, and privilege provides an independent legal basis for that silence.
When Disclosure Carries No Penalty
Several disclosures that look like breaches are actually permitted by the rules. Rule 1.6(b) authorizes an attorney to reveal confidential information when the attorney reasonably believes it necessary to:1American Bar Association. Rule 1.6 Confidentiality of Information
- Prevent reasonably certain death or substantial bodily harm.
- Prevent a client from using the attorney’s services to commit a crime or fraud causing substantial financial injury to someone else.
- Mitigate or rectify financial harm already caused by a client’s crime or fraud that used the attorney’s services.
- Get confidential ethics advice from another lawyer about the attorney’s own compliance with the rules.
- Defend against a malpractice suit, bar complaint, fee dispute, or criminal charge related to the representation.
- Comply with a valid court order.
The self-defense exception catches people off guard. A client who sues their attorney or files a disciplinary complaint allows the attorney to use confidential information in response. The disclosure must still be limited to what the defense reasonably requires.
When Privilege Is Lost Through Waiver
Sometimes privilege disappears not because an attorney broke it, but because the client or the attorney waived it. Sharing a privileged communication with an outsider generally waives privilege for that communication. Under Federal Rule of Evidence 502(a), an intentional disclosure can even extend waiver to other communications on the same subject when fairness requires it, though courts reserve that outcome for selective, misleading use of privileged material.4Legal Information Institute. Federal Rules of Evidence Rule 502 – Attorney-Client Privilege and Work Product; Limitations on Waiver Once privilege is validly waived, the information becomes usable in litigation and nobody is penalized for using it. Waiver is not a penalty on the attorney; it is simply the loss of the protection itself.