1. 1 e-Discovery & Health Care Providers HIPAA Cow Fall 2008 Conference - September 19, 2008 Blue Harbor Resort, Sheboygan Thomas N. Shorter Godfrey & Kahn, S.C. 1 East Main Street Madison, WI 53703 tshorter@gklaw.com (608) 284-2239

2. 2 Godfrey & Kahn, S.C. Offices located in Milwaukee, Madison, Waukesha, Green Bay and Appleton. This presentation and materials are intended to provide information only on health law issues and should not be construed as legal advice. In addition, attendance at a Godfrey & Kahn, S.C. presentation does not create an attorney-client relationship. Please consult the speakers if you have any questions concerning the information discussed during this presentation. © 2008

3. 3 Electronic discovery and the health care industry Cooney, et al. v. Beverly Enter., Inc., et al., No. CV 2003-1049-3 (Saline County Circuit Court, Arkansas, June 15, 2005) –Beverly Enterprises, the nation’s largest nursing home chain, was sued in a class action lawsuit –Allegations of intentionally understaffing facilities and providing substandard care in order to increase profits

4. 4 Electronic discovery and the health care industry Electronic discovery issue –Plaintiffs requested production of documents, including email messages –Plaintiffs were told that email messages were not maintained in the regular course of business –Plaintiff filed motion for contempt and sanctions –Court entered order imposing sanctions on Beverly Enterprises for failing to comply with discover orders

5. 5 Electronic discovery and the health care industry Order included the following: –Payment of $25,000 in attorneys’ fees payable directly to plaintiff’s counsel –Full compliance with discovery orders, including those involving electronic data and email messages –Court stated that on its own suggestion, it would consider whether additional sanctions should be imposed, including whether Beverly Enterprises CEO and Vice Presidents should be incarcerated for contempt

6. 6 Electronic discovery and the health care industry Beverly still failed to produce documents –Same judge later ordered Beverly Enterprises to pay a $20 million bond – order was upheld by the Arkansas Supreme Court –Beverly Enterprises eventually settled lawsuits for $18.9 million

7. 7 Goals of Presentation Understand what electronic discovery is, why it is here and how it applies to healthcare organizations Review the new electronic discovery rules and understand the impact of the new rules on healthcare organizations Understand the relationship between the new electronic discovery rules and document retention policies Identify key elements of a good document retention policy, including best practices for retaining documents

8. 8 What is “discovery”? The process by which one party to a lawsuit exchanges information with the other side. Exchange of information is vital to proving the claim or defense of a party. Information is exchanged through document requests, interrogatories, requests to admit and depositions. Scope of discovery is extremely broad.

9. 9 What is “electronic discovery”? The process of accessing, using and preserving information, data, and records created or maintained in electronic media. Involves more than printing copies of email messages for the other party. Can involve the following:  Use of computer forensics to analyze sources of electronic data  Searching and analyzing the data behind the data (“metadata”)

10. 10 Why is it here? Increase in the creation, storage and transmission of information in electronic form, in all businesses across all industries, including healthcare. Revisions to the discovery rules were driven by a recognition of this increased use of electronic data. Goal of new rules: clarify rules governing the discovery of electronic data.

11. 11 How it applies to healthcare organizations Electronic health records (“EHR”)  Established a new office within U.S. Department of Health and Human Services (Office of the National Coordinator for Health Information Technology)  2004, President Bush called for an electronic health record for most Americans by 2014  Increasing use of EHR leads to creation of more paper medical records being created, maintained and transmitted in electronic form

12. 12 How it applies to healthcare organizations EHRs –Wealth of data to be found in patient’s EHR Provides a critical source of evidence in all kinds of legal proceedings such as medical malpractice cases and workers’ compensation cases All other records created or maintained electronically by a healthcare organization –Business records, such as contracts and accounting records –Employment records, such as offer letters and performance evaluations

13. 13 Overview of new electronic discovery rules Discovery rules govern the process by which parties exchange information with each other during litigation Amendments to rules were approved on April 13, 2006 New rules went into effect on December 1, 2006

14. 14 Overview of new electronic discovery rules New discovery rules govern discovery in federal cases - BUT Many states will likely amend their rules to specifically address electronic discovery Today’s presentation will focus on these key rules:  Rules 16, 26, 33, 34, 37 and 45

15. 15 Rule 16 Describes, before the case even begins, the litigation process attorneys will follow, including discovery Creates a framework for parties and court to give early attention to issues relating to electronic discovery Provides for pretrial scheduling orders to include provisions for electronic discovery and the process by which such discovery will occur

16. 16 Impact of Rule 16 HIM and IT professionals must work with the healthcare organization’s attorney prior to pre-trial conferences to discuss the electronic information available for discovery and identify the need for added protections for sensitive records (i.e., “treatment records”)

17. 17 Rule 26(a)(1)(B) Makes “electronically stored information” explicitly subject to discovery Term “electronically stored information” not specifically defined in the new rules Term generally thought to mean information created, manipulated, communicated, stored, and best utilized in digital form, requiring the use of computer hardware and software

18. 18 Rule 26(a)(1)(B) The term encompasses a wide range of data –Electronic communications, such as email messages, digital voicemail messages, digitally transcribed tapes, PDAs and cell phones –Word processing files and databases –Computer desktops and laptops, including in the office and at home –Optical disks, such as CDs and DVDs, and flash drives –Deleted files –Data that is “hidden” from view (metadata) Date data was created, its author, when and by whom data was edited, what edits were made

19. 19 Impact of Rule 26(a)(1)(B) HIM and IT professionals must work with legal counsel to identify what information maintained by the healthcare organization constitutes “electronically stored information” HIM professionals need to be aware that “electronically stored information” is exponentially greater in volume than hard- copy documents

20. 20 Rule 26(b)(1) Describes parties’ legal duty to maintain and disclose “records relevant to the claim or defense of any party”

21. 21 Impact of Rule 26(b)(1) HIM and IT professionals must work with legal counsel to know what documents are being requested and whether they are relevant to the claim or defense –Example – patient’s entire medical record might not be relevant in a case involving allegations of a physician’s incompetence during a knee surgery

22. 22 Rule 26(b)(2)(B) Provides exceptions for electronically stored information that is not “reasonably accessible,” that is, information that would be costly and burdensome to produce Addresses the issues raised by difficulties in locating, retrieving, and providing discovery of some electronically stored information Grants judge authority to order the production of electronically stored information even if not “reasonably accessible” if requesting party can show “good cause”

23. 23 Impact of Rule 26(b)(2)(B) HIM and particularly IT professionals must be able to explain why certain data is not reasonably accessible and be able document the true cost and burdens of producing the data being requested

24. 24 Rule 26(b)(5)(B) Establishes a procedure for parties to present claims to the court that inadvertently produced information is protected by the attorney-client privilege or work-product doctrine

25. 25 Impact of Rule 26(b)(5)(B) HIM and IT professionals should work with legal counsel to ensure that information protected under the attorney-client privilege or work- product doctrine is not inadvertently disclosed One court recently made sweeping changes in the availability of the attorney-client privilege, especially with respect to e-mail communications among in-house counsel and other corporate employees. In re Vioxx Products Liability Litigation, 2:05-md-01657-EEF-DEK

26. 26 Impact of Rule 26(b)(5)(B) Avoid inadvertent loss of attorney-client privilege under the Vioxx Rules –Document that the primary purpose of the communication was to seek legal advice (this is particularly important when seeking edits and comments to non-legal documents even though they carry legal implications) –Avoid sending communications to mixed audiences of lawyers and non-lawyers –Avoid forwarding attachments received from a lawyer to a non-lawyer

27. 27 Rule 26(f)(3) Directs parties to discuss “any issues relating to disclosure or discovery of electronically stored information, including the form or forms in which it should be produced”

28. 28 Impact of Rule 26(f)(3) HIM must be apprised of the parties’ proposed discovery plan in order to produce electronic documents agreed upon by the parties and in the agreed format

29. 29 Rule 33(d) Allows a party to respond to an interrogatory by producing electronically stored information containing the answer to the interrogatory, but only if the burden of deriving the answer will be substantially the same for either party

30. 30 Impact of Rule 33 HIM and IT professionals must be able to verify the authenticity of electronically stored information produced in response to an interrogatory HIM and IT professionals must ensure that information can be located and identified by the interrogating party and give the interrogating party a “reasonable opportunity to examine, audit, or inspect the information”

31. 31 Rule 34 Provides that electronically stored information are as discoverable as paper documents and must be produced, unless the request clearly indicates the party is only seeking traditional documents Applies to documents that are stored by the healthcare organization in the “usual course of business”

32. 32 Impact of Rule 34 HIM and IT professionals must establish policies and procedures for retention, storage, destruction and production of data in order to show that documents produced were kept “in the usual course of business” or if documents were not produced, that they were not kept in the usual course of business

33. 33 Rule 37(f) Describes if, and what, sanctions will be imposed for failing to provide agreed upon documents Provides a safe harbor for failing to provide electronically stored information that was lost as a result of “routine, good faith operation of an electronic information system”

34. 34 Rule 37(f) continued… Courts will not hesitate to use sanctions for violations of discovery rules and discovery orders Coleman Holdings v. Morgan Stanley & Co., 2005 WL 679071 (Fla. Cir. Ct. 2005)  Morgan Stanley was found to have failed to comply with the court’s order governing the discovery of its email message  Court awarded plaintiff $1.45 billion

35. 35 Rule 37(f) continued… Zubulake v. UBS Warburg, LLC, 217 FRD 309 (SDNY 2003) –First decision in a discovery dispute, rapidly defining e-discovery standards and records management practices for business and health care –Case involved claims of sex discrimination (failure to promote and retaliation for filing charge with EEOC) –Consisted of 5 separate decisions, all with fairly significant rulings on the issue of discovery

36. 36 Rule 37(f) continued… Zubulake III, 216 FRD 280 (S.D.N.Y. July 24, 2003) –Sample evidence showed that UBS manager deleted especially relevant email messages –Court ordered complete restoration and production and shifted ¼ of the estimated $166,000 cost of searching and restoring 77 back-up tapes to plaintiff –Court denied cost-shifting of estimated $108,000 for producing email messages produced from back-up tapes Significant e-discovery rulings from Zubulake cases

37. 37 Rule 37(f) continued… Zubulake IV, 220 FRD 212 (S.D.N.Y. Oct. 22, 2003) –Employer failed to take adequate steps to collect and preserve evidence Some back-up tapes were missing Some relevant email messages created after UBS supposedly started to retain relevant email messages were not saved at all –Court ordered re-depositions of witnesses and additional discovery Employer had a duty to preserve evidence

38. 38 Rule 37(f) continued… Zubulake V, 229 FRD 422 (S.D.N.Y. July 20, 2004) –Plaintiff presented evidence of more deleted email messages and deliberate conduct by UBS managers –Many of the email messages were indeed relevant and were the proverbial “smoking gun” evidence that supported plaintiff’s claim of retaliation –Party’s duty does not end with implementation of a litigation hold Locate relevant information Continue to preserve information Product relevant non-privileged material

39. 39 Rule 37(f) continued… Safe harbor: what is meant by “good faith” –One factor is whether the party reasonably believes the information is likely to be discoverable and not available from reasonably accessible sources –Another factor is whether the party was subject to an obligation to preserve information (“litigation hold”) and whether the party took steps to comply with a court order to preserve specific information –May involve a party’s intervention to modify or suspend certain features of routine operation to prevent the loss of information –Means that a party may not exploit routine operation of an information system to thwart discovery obligations

40. 40 Rule 37(f) continued… Litigation holds –Suspend an organization’s normal practice or disposition, including destruction, of paper and electronic records –Create duty to preserve information

41. 41 Rule 37(f) continued… What is meant by “routine, good faith operation of an electronic information system”? –Focuses on the distinctive features of computer operations and the routine alteration and deletion of information that attends ordinary use –Refers to the ways in which such systems are generally designed, programmed and implemented to meet the party’s technical and business needs –Includes the alteration and over-writing of information, without the operator’s specific direction or awareness, which are essentially to the operation of electronic information systems

42. 42 Rule 37(f) continued… Court imposed $1 million in sanctions for destroying documents relevant to pending litigation –see In re Prudential Ins. Co. of America Sales Practices Litig., 169 F.R.D. 598 (D.N.J. 1997) Court found that defendant acted in bad faith in its failure to suspend email and destruction policy or preserve essential personnel documents; sanctions were imposed, including an adverse spoliation jury instructions – see Broccoli v. Echostar Communications Corporation, 229 F.R.D. 506 (D. Md., 2005)

43. 43 Impact of Rule 37(f) HIM and IT professionals must work with the healthcare organization’s legal counsel to understand what the organization’s discovery obligations are, including any litigation holds and how those obligations will be met HIM and IT professionals must understand how its electronic information storage system operates and be able to describe routine losses of information

44. 44 Relationship between new rules and document retention policies Two key rules –Rule 34: Documents produced, or not produced in the “usual course of business” Policies can establish whether documents were produced or not produced in the usual course of business –Rule 37(f): Safe harbor for loss of information due to routine, good faith operation of electronic information system Policies can establish whether information was lost as a result of a good faith operation of an electronic information system

45. 45 Justification for document retention policies Documents compliance with new discovery rules Documents compliance with statutorily mandated record retention requirements Good risk management and business practice

46. 46 Considerations for document retention policies Business needs for the information and the costs of retention State and federal requirements applicable to the organization or the records “best practices” in the industry for retention of records Current hardware and software alternatives that support retention strategies Litigation issues, such as responding to discovery requests

47. 47 Elements of good document retention policies Identify all records covered under the policy –Should address all records retained by the organization, including paper and electronic records, medical records and other business records Include a retention schedule for each type of record, based on legal requirements under state and federal laws, statute of limitations, as well as good business practices

48. 48 Elements of good document retention policies Adopt document destruction policies and procedures and identify the specific circumstances under which documents can be destroyed, including routine destruction of data Adopt policies and procedures for responding to discovery requests, including institution of litigation holds  Streamline requests

49. 49 Best Practices Implement a formal document retention policy Make litigation preparedness a part of employee’s daily work Establish an ongoing working relationship between legal counsel and IT personnel Organize data storage efforts and establish systems that simplify later identification, retrieval, and production of responsive information

50. 50 Best Practices Outline a litigation hold plan for suspension of document destruction and back-up tape recycling protocols. Designate and train an IT department representative to act as the company’s Rule 30b(6) deposition witness when electronic data storage may be at issue

51. 51 Action Plan Consult with legal counsel regarding document retention practices and procedures Identify broad-based team within organization to be undertake and be accountable for the project  Should involve more departments than HIM and IT Adopt or update comprehensive document retention policies and procedures in light of new electronic discovery rules

52. 52 Action Plan Present policy to senior management Communicate policy to all those within the organization as well as outside vendors who have any involvement or access to organization’s records Monitor compliance with policies and procedures

53. 53 Questions Thomas N. Shorter Godfrey & Kahn, S.C. 1 East Main Street Madison, WI 53703 tshorter@gklaw.com (608) 284-2239 3155693_1