
228 Wis.2d 231 (1999)
597 N.W.2d 449
Arlene A. THIERY, Plaintiff-Appellant,
v.
Charles M. BYE, Bye, Goff & Rohde, Ltd., Cornelia Larson, in her capacity as an employee of Bye, Goff & Rohde, Ltd. and XYZ Insurance Company, Defendants-Third-Party Plaintiffs-Respondents,[]
v.
CHIPPEWA VALLEY TECHNICAL COLLEGE, and Cornelia Larson, in her capacity as an employee of Chippewa Valley Technical College, Third-Party Defendants.
No. 98-2796.
Court of Appeals of Wisconsin.
Submitted on briefs March 10, 1999.
Decided May 4, 1999.
*235 On behalf of the plaintiff-appellant, the cause was submitted on the briefs of Bradley D. Lawrence of Phillip M. Steans, S.C., Menomonie.
On behalf of the defendants-respondents, the cause was submitted on the brief of John M. Moore of Bell, Gierhart & Moore, S.C., Madison.
Before Cane, C.J., Myse, P.J., and Hoover, J.
MYSE, P.J.
Arlene A. Thiery appeals a summary judgment dismissing her legal malpractice claim against Charles M. Bye, and his law firm, Bye, Goff & Rhode, Ltd., and her invasion of privacy claim against Cornelia Larson, as a law firm employee. Thiery contends that Bye committed malpractice when he released unredacted medical records and deposition transcripts that he obtained as a result of representing Thiery on a personal injury claim. The released records and transcripts identified Thiery as the subject of the records contrary to Bye's representation that her identity would be concealed. Thiery contends that Bye's representation created a duty on Bye to assure that the redaction was completed before releasing the records for teaching purposes at Chippewa Valley Technical College (CVTC), where he knew they would be placed in the public domain. Thiery contends that the trial court erred when it concluded that Bye had no duty to redact the records before their release.
The undisputed facts establish that Bye was acting as Thiery's attorney at the time he solicited her consent to release her records. We conclude that an *236 attorney owes a duty to assure that the confidentiality of a client's records is maintained and protected as a result of the attorney-client relationship, both during and after services are rendered. We further conclude that Bye's representation that the records would be redacted to conceal Thiery's identity prior to their release created a duty of reasonable care to protect her confidential information in his possession. Because the trial court erred when it concluded that Bye had no duty to assure the redaction of confidential information in Thiery's records was completed, the judgment dismissing the malpractice claim against Bye and Bye, Goff & Rohde, Ltd., is reversed. We remand this claim to the trial court for a determination as to whether Bye breached his duty and what, if any damages flowed therefrom.
Thiery also claimed invasion of privacy against Larson as an employee of Bye's law firm. We conclude that the claim against Cornelia Larson, as a law firm employee, was properly dismissed because Larson's conduct in collecting, editing, photocopying and distributing Thiery's medical records was in her capacity as CVTC's employee and was not as a result of her employment with the law firm. We therefore affirm the judgment dismissing the claim against Larson in her capacity as a law firm employee.
Thiery retained Bye to represent her in a personal injury action arising from a motor vehicle accident. During Bye's preparation of Thiery's claim, Thiery's medical records were gathered, and deposition transcripts were prepared in support of the litigation. Ultimately, her personal injury claim was settled. Before the settlement's completion, however, Bye sent Thiery the following letter:

*237 Cornelia Larson, the nurse/investigator in our office, will be teaching a class this summer to registered nurses who are going into the legal field. The main emphasis in the class is how to read and summarize medical records and depositions in preparation for trial and she needs some extensive medical records which can be photocopied and used for teaching purposes.
If you are willing to in effect sell your records and depositions for teaching purposes, please sign the attached and return to me. The records and depositions would all be sanitized such that your name would be removed and I understand they are willing to pay $500.00 for the right to use them.
If I do not hear from you then I will assume that you do not want your records used and they will be returned to you along with the settlement proceeds.
Larson, a nurse-investigator for the law firm, was also employed part-time by CVTC as an instructor for a class of nurses seeking certification as legal nurse consultants.
Thiery agreed to the proposal to use her records by executing a release enclosed with Bye's letter and returning it to Bye. The release stated:
The undersigned, Arlene Thiery, hereby agrees to release all of her medical records and depositions in the possession of Bye, Goff & Rohde, Ltd. to the Chippewa Valley Technical College to be photocopied and used in teaching classes where medical records are needed.
The undersigned is paid $500.00 for her medical records and depositions for the rights of Chippewa Valley Technical College to use these records with the specific understanding that the undersigned's *238 name will be removed from all records prior to photocopying and release for teaching purposes.
Bye then released Thiery's records to CVTC. For some reason, however, Thiery's identity was not entirely redacted from the records, which were photocopied and distributed to students at the college.
Upon learning that her identity had not been removed from the records before their public distribution, Thiery filed a malpractice lawsuit against Bye and the law firm and against Larson as the law firm's employee. Thiery also filed suit against CVTC and Larson as CVTC's employee. CVTC and Larson, as its employee, settled Thiery's claim and were released from the suit by Thiery's execution of a Pierringer release.[1] The trial court granted summary judgment dismissing Thiery's claims against Bye, the law firm and Larson in her capacity as a law firm employee. The trial court concluded that Bye was not acting as Thiery's attorney when he released the records and had no duty to redact the records because the agreement between Thiery and CVTC placed the burden of redacting the records on the college.
In reviewing summary judgments, we apply the same methodology as the trial court and consider the issues de novo. Green Spring Farms v. Kersten, 136 Wis. 2d 304, 315, 401 N.W.2d 816, 820 (1987). That methodology has been repeated often, see Preloznik v. City of Madison, 113 Wis. 2d 112, 115-16, 334 N.W.2d 580, 582-83 (Ct. App. 1983), and we need not recite it here except to note that summary judgment is appropriate only when there is no genuine issue of material fact and the moving party has established entitlement *239 to judgment as a matter of law. Schapiro v. Security S&L Ass'n, 149 Wis. 2d 176, 181, 441 N.W.2d 241, 244 (Ct. App. 1989). All reasonable inferences are drawn in favor of the non-moving party. Grams v. Boss, 97 Wis. 2d 332, 339, 294 N.W.2d 473, 477 (1980).
[1]
We begin our analysis with Thiery's malpractice claim against Bye and then discuss Thiery's invasion of privacy claim against Larson as a law firm employee. An actionable legal malpractice claim consists of the following elements: (1) the existence of an attorney-client relationship giving rise to a duty; (2) acts constituting negligence; (3) negligence as the proximate cause of the alleged injury; and (4) the existence and extent of injury. Lewandowski v. Continental Cas. Co., 88 Wis. 2d 271, 277, 276 N.W.2d 284, 287 (1979).
[2]
To prevail on summary judgment, Bye, as the moving party, must prove facts that establish a defense that defeats Thiery's claim as a matter of law. See Krezinski v. Hay, 77 Wis. 2d 569, 572-73, 253 N.W.2d 522, 524 (1977). Bye interposes two defenses to the legal malpractice claim. First, Bye asserts that when he released the medical records, no attorney-client relationship existed between the law firm, Bye and Thiery. Apparently, Bye and the law firm maintain that the records were released only after the personal injury claim was settled and that the settlement terminated any attorney-client relationship between Bye and Thiery. We disagree. We conclude that a duty to assure that the confidentiality of Thiery's records was maintained existed as a result of an existing attorney-client relationship between Thiery and Bye. We also conclude that a duty to assure the effective redaction of Thiery's identity from the records was created as a *240 result of Bye's representation that such redaction would be performed before the records were released.
Bye contends no attorney-client relationship existed, precluding his duty to assure the redaction was properly completed. When the facts that allegedly give rise to the duty are not in dispute, whether a duty exists is a question of law. Johnson v. Misericordia Community Hosp., 99 Wis. 2d 708, 723, 301 N.W.2d 156, 164 (1981). Despite conflicting legal arguments disputing the existence of an attorney-client relationship, our review of the record reveals undisputed facts establishing that the attorney-client relationship between Bye and Thiery had not yet ended when Bye solicited Thiery's consent to release her records. Bye's own submissions belie his contention otherwise. Bye's affidavit attests that Larson approached him with the request to contact Thiery to use her records, "In March of 1996, as the personal injury case of Arlene A. Thiery was reaching a conclusion . . . ." (Emphasis added.) Furthermore, the release, which Bye drafted, indicates that Bye had not yet distributed the settlement proceeds to Thiery and was still in possession of Thiery's records pursuant to his representation of her personal injury claim. Larson's affidavit substantiates our conclusion. She attests, "In March of 1996, I was aware that Arlene A. Thiery's personal injury lawsuit was reaching a conclusion." (Emphasis added.)
[3]
Bye's solicitation of Thiery's consent to release her records was done during the existence of her personal injury case and the alleged breach of Bye's commitment to assure redaction of the records is measured from the time he made the representation to her. We conclude that there was an ongoing attorney-client relationship at the time Bye undertook a duty to redact *241 the records. That the breach occurred after the attorney-client relationship terminated is irrelevant because Bye undertook the duty to assure the redaction was completed during his active representation of Thiery. Even if Bye's contention is that the personal injury case was concluded at the time his duty to redact the records occurred, he fails to assert a legitimate defense because the duty of maintaining the confidentiality of a client's records is ongoing and transcends the termination of the case.
[4-7]
The relationship between an attorney and a client is fiduciary and confidential in character demanding a high degree of trust and confidence. Ott v. Hood, 552 Wis. 97, 104, 139 N.W. 762, 764 (1913). The attorney-client relationship is also one of agent to principal and as an agent, an attorney must act in conformity with his or her authority and is responsible to the principal if he or she violates that duty. State v. Divanovic, 200 Wis. 2d 210, 224, 546 N.W.2d 501, 507 (Ct. App. 1996). As agent, an attorney occupies a confidential relationship to his or her client. In re Faulks' Will, 246 Wis. 319, 358, 17 N.W.2d 423, 439 (1945). Principles of agency recognize an agent's duty to protect a principal's confidential information. RESTATEMENT (SECOND) OF AGENCY § 395 (1958), states:
Unless otherwise agreed, an agent is subject to a duty to the principal not to use or to communicate information confidentially given him by the principal or acquired by him during the course of or on account of his agency or in violation of his duties as agent . . . to the injury of the principal . . . . *242 Accordingly, we conclude that an attorney has a duty to maintain confidentiality to his client during and after the attorney-client relationship terminates.
Our conclusion is supported by the Rules of Professional Conduct and the attorney-client privilege statute, both of which recognize this duty of confidentiality. See SCR 20:1.6(a) (1998); see also § 905.03(2), STATS.[2] The Rules of Professional Conduct recognize that it is a fundamental principle of the attorney-client relationship that a lawyer maintain confidentiality of information relating to the representation. SCR 20:1.6 (cmt.). In recognizing the duty of confidentiality inherent in the attorney-client relationship, the comment to SCR 20:1.6 states, in relevant part:

The principle of confidentiality is given effect in two related bodies of law, the attorney-client privilege (which includes the work product doctrine) in the law of evidence and the rule of confidentiality established in professional ethics. The attorney-client privilege applies in judicial and other proceedings in which a lawyer may be called as a witness or otherwise required to produce evidence concerning a client. The rule of client-lawyer confidentiality applies in situations other than those where evidence is sought from the lawyer through *243 compulsion of law. The confidentiality rule applies not merely to matters communicated in confidence by the client but also to all information relating to the representation, whatever its source. A lawyer may not disclose such information except as authorized or required by the Rules of Professional Conduct or other law. (Emphasis added.)
As to former clients, the comment states, "The duty of confidentiality continues after the client-lawyer relationship has terminated."
[8]
We conclude, therefore, that an attorney has a duty to maintain the confidentiality of documents in his possession as a result of legal services rendered to a client. This duty exists notwithstanding that litigation may or may not be pending or that services are completed. To contend otherwise is inconsistent with an agent's duty to protect a principal's confidential information and would limit an attorney's obligation to his client to only that conduct performed while litigation is being prosecuted. It would remove any obligation for the reasonable care and handling of confidential documents in counsel's possession as a result of his legal representation of a client. Accordingly, Bye's duty to protect the confidentiality of Thiery's records arose as a result of his representation of Thiery in her personal injury action, which had not yet been completed. However, even had that litigation terminated, Bye's duty to protect the confidentiality of Thiery's records would have continued.
We also conclude that Bye's duty arose from his representation to Thiery that her identity would be redacted from the records before they were released. While representing Thiery, Bye authored a letter stating that if Thiery signed a release authorizing the use *244 of her records, Thiery's name would be redacted from those records to conceal her identity before their release in the public domain. Bye made this representation, not CVTC. Bye's commitment to Thiery in the letter created a duty on Bye to use reasonable care in protecting Thiery's records by assuring that the redaction was completed consistent with his representation. While Thiery authorized the release of her confidential information, her authorization was conditioned on the redaction of her identity, as Bye represented in his letter. Bye has no privilege to release Thiery's confidential records other than in accordance with the conditions imposed pursuant to his representation and Thiery's authorization.
Therefore, we conclude Bye was required, as a result of his attorney-client relationship with Thiery and his written representation regarding the manner in which her records would be utilized, to use reasonable care in protecting the records and documents in his possession as a result of resolving Thiery's personal injury claim. He was required to assure that those records would be properly distributed and released in the manner which he represented in his letter and which Thiery subsequently authorized. Bye's argument that no attorney-client relationship existed and that therefore he assumed no consequent duty as to Thiery's records fails.
[9]
Bye next suggests that the duty to redact the records was solely CVTC's and that CVTC alone breached its obligation when it failed to effectively redact Thiery's identity from the records. We agree that CVTC had a duty to redact the records consistent with its representation to Thiery that her identity would be concealed from the records before they were *245 publicly used. This conclusion, however, does not end the inquiry. Bye's commitment to Thiery in his letter also created a duty on Bye to use reasonable care to assure the appropriate redaction was completed. The negligent conduct which resulted in unredacted records is attributable to Bye as well as to CVTC because each committed to assuring that Thiery's identity would be removed from the records before they were placed in the public domain. To suggest that CVT C owed the duty does not eliminate the separate duty Bye had to Thiery when she authorized the use of these records on condition that her identity would be redacted. We therefore conclude that Bye has failed to establish a defense sufficient to defeat Thiery's malpractice claim against Bye and the law firm.
Although not a basis upon which the trial court relied, it appears that the trial court was concerned that no expert witness had been named to express an opinion that Bye's failure to redact the records was negligence. Thiery contends the trial court should have granted her request for a continuance to produce expert testimony, particularly when the scheduling order deadline for naming experts had not yet expired.
[10,11]
Expert testimony is generally required to establish the standard of care and breach of duty in a malpractice action, except when the breach is either so obvious that it may be determined by the court as a matter of law, or when it is within the ordinary knowledge and experience of laypersons. See Helmbrecht v. St. Paul Ins. Co., 122 Wis. 2d 94, 112, 362 N.W.2d 118, 128 (1985); see also Olfe v. Gordon, 93 Wis. 2d 173, 184, 286 N.W.2d 573, 578 (1980). Here, Bye's failure to assure the redaction of the records is the type of claim that need not be proved through expert opinion. A layperson *246 would have little difficulty understanding the duty Bye accepted in his letter to Thiery or determining whether Bye's failure to assure the redaction was completed was a breach of his obligation to his client. We have concluded as a matter of law that Bye owed a duty to maintain the confidentiality of Thiery's records. The failure to introduce expert testimony is not fatal to Thiery's malpractice claim against Bye and his law firm and is not a basis on which the trial court could dismiss Thiery's claim.
In sum, we conclude that the undisputed facts establish that Bye was acting as Thiery's attorney when he solicited her consent to release her records. We further conclude that when Bye represented in a letter that the records would be redacted to conceal Thiery's identity before their release in the public domain, he assumed a duty of reasonable care to protect her confidential information in his possession. Because the trial court erred when it concluded Bye had no duty to assure that the redaction of Thiery's identity was effectively completed, the summary judgment dismissing Thiery's malpractice claim against Bye and Bye, Goff & Rohde, Ltd. is reversed. We remand for a determination as to whether Bye breached his duty and what, if any, damages flowed therefrom.
We next consider Thiery's invasion of privacy claim against Larson in her capacity as a law firm employee. Larson contends that she was not acting within the scope of her employment as a nurse-investigator for the law firm when she edited and distributed Thiery's records. The trial court agreed and dismissed Thiery's claim. Thiery contends the trial court erred because the record suggests that whether Larson was acting within the scope of her employment with the law *247 firm is a disputed issue of material fact precluding summary judgment. We disagree.
[12,13]
An employer can be held vicariously liable for the negligent acts of its employees while they are acting within the scope of their employment. Shannon v. City of Milwaukee, 94 Wis. 2d 364, 370, 289 N.W.2d 564, 568 (1980); see also RESTATEMENT (SECOND) OF AGENCY § 219(1) (1957) ("A master is subject to liability for the torts of his servants committed while acting in the scope of their employment."). Our supreme court has stated that the "[c]onduct of a servant is not within the scope of employment if it is different in kind from that authorized, far beyond the authorized time or space limits, or too little actuated by a purpose to serve the master." Scott v. Min-Aqua Bats Water Ski Club, Inc., 79 Wis. 2d 316, 321, 255 N.W.2d 536, 538 (1977). In addition, the employee's intent must be considered when determining whether his or her conduct was within the scope of employment. Olson v. Connerly, 156 Wis. 2d 488, 498-99, 457 N.W.2d 479, 483 (1990). An employee may be found to have acted within the scope of employment if the employee was at least partially actuated by a purpose to serve the employer. Id. With these precepts as guidance, we consider whether the summary judgment record is subject to disputed issues of material fact or reasonable conflicting inferences.
As the moving party, Larson, a nurse, attested that she worked for the law firm as a legal investigator but worked for CVTC as an instructor teaching nurses seeking certification as legal nurse consultants. She attested that her position as an instructor was completely independent of the work she performed for the law firm and that CVTC controlled the details of Larson's work as an instructor. In addition, Larson *248 averred that she told Bye that as the course instructor, she would redact Thiery's name from the records and that she undertook this task solely in her capacity as an instructor for CVTC. In fact, she attests that she did this work at home, that the work was not in any way associated with her employment at the law firm, and that the law firm received no benefits from the work. Considering the scope of employment precepts above, we conclude that this evidence is sufficient to establish a prima facie defense that Larson was not acting within the scope of her employment as an investigator with the law firm; rather, she was acting as an employee of CVTC when she undertook to secure the use of Thiery's records.
Pursuant to summary judgment methodology, we next consider Thiery's evidentiary submissions, which she claims raise a disputed issue of material fact as to Larson's scope of employment. Thiery's only submission is her affidavit to which she has attached Bye's letter and the release. Thiery attests that she understood from the letter and release that Bye and the law firm would remove her name from the records and that she was dealing only with Bye and the law firm, not CVTC. From this evidence, Thiery contends that Larson's conduct is blurred with respect to which particular employer she undertook this project for.
Thiery offers no direct evidence refuting Larson's testimony that her actions were solely within the scope of her employment for CVTC. Instead, Thiery suggests that reasonable competing inferences can be drawn that Larson was also working in her capacity as an investigator with the law firm because: (1) otherwise Larson would not have known Thiery had medical records; and (2) Thiery believed from the letter and release that she was dealing only with Bye, not CVTC.
*249 [14]
While reasonable inferences which might be drawn from underlying facts in a party's summary judgment affidavits must be viewed in the light most favorable to the party opposing the motion, we emphasize that the inferences must be reasonable. Grams v. Boss, 97 Wis. 2d 332, 339, 294 N.W.2d 473, 477 (1980). "An inference is reasonable if it can fairly be drawn from the facts in evidence." In re A.M.C., 144 Wis. 2d 621, 636, 424 N.W.2d 707, 713 (1988). A proper inference is one drawn from logic and proper deduction. Id. Thiery's belief as to who bore the duty to redact her records and how Larson acquired knowledge of the existence of Thiery's records have no relevance to whether Larson was acting within the scope of her employment for the law firm. No reasonable inference can fairly be drawn from this evidence that Larson was acting in her capacity as an investigator for the law firm when she failed to redact Thiery's name from records she was authorized to use as a teaching tool. Because no disputed issues of material fact or reasonable conflicting inferences exist, we conclude that the trial court properly dismissed the claim against Larson as a law firm employee.
By the Court.Judgment affirmed in part; reversed in part and cause remanded with directions. No costs to either party.
NOTES
[]  Petition to review denied.
[1]  Pierringer v. Hoger, 21 Wis. 2d 182, 124 N.W.2d 106 (1963).
[2]  Section 905.03(2), STATS., states in relevant part:

A client has a privilege to refuse to disclose and to prevent any other person from disclosing confidential communications made for the purpose of facilitating the rendition of professional legal services to the client . . . .
SCR 20:1.6(a) (1998), states:
A lawyer shall not reveal information relating to representation of a client unless the client consents after consultation, except for disclosures that are impliedly authorized in order to carry out the representation, and except as stated in paragraphs (b), (c) and (d).
