Electronic Discovery and Electronic Health Records

Page created by Nicholas Ayala
 
CONTINUE READING
Electronic Discovery and Electronic Health Records
Electronic Discovery and
Electronic Health Records:
The Impact of “e-Discovery” Involving “EHR”
Upon Healthcare Entities
Gerald “Jud” E. DeLoss, Krahmer & Nielsen PA, Fairmont, MN
and Edward F. Shay, Post & Schell PC, Philadelphia, PA

Amendments to the Federal Rules of        eral discovery requirements. Safe-         The EHR may encompass a wide
Civil Procedure governing electronic      guards should be implemented to            variety of types of information. ESI
discovery (“e-discovery”) took effect     ensure that the EHR information will       such as patient vital signs, radiologi-
on December 1, 2006. These amend-         not be altered, improperly disclosed       cal films and reports, and consulta-
ments have tremendous potential to        to third parties, or improperly            tion reports, although in different
either simplify litigation or over-       destroyed. Healthcare enterprises          formats, could be stored side-by-side
whelm litigants not prepared to           should not underestimate this chal-        in the EHR. The manner or means
address the enormous volume and           lenge given the sheer volume of ESI        by which this data is stored in the
variety of electronically stored infor-   stored in the databases of EHR sys-        EHR could also vary. The storage
mation (ESI) subject to production        tems. Further, the production of ESI       media utilized may be widely dis-
in discovery. This article is the sec-    contained within the EHR system            persed throughout the organization.
ond part of a two-part series on e-dis-   must remain accessible over time           It is up to the healthcare entity to be
covery.1 While the first part focused     despite the technological advances         able to track each of these types of
on the requirements of the amend-         and/or obsolescence of the system          data and access it within the dead-
ments, this part will attempt to apply    on which it is stored.                     lines imposed under the Rules to
them to e-discovery in healthcare,                                                   produce it in discovery.
particularly to the electronic health     Healthcare entities may face difficul-
record (EHR) and related health           ties attempting to locate every source     Storage formats may change over
information technology systems. It is     of ESI in order to produce it in litiga-   time as technology advances and
further the position of this article,     tion. Much will depend upon the            changes allowing for more efficient
shared by many observers of e-discov-     architecture of the EHR system. The        backup and storage media. Tapes,
ery, that the federal model will most     ESI itself may be located in one cen-      discs, and hard drives may give way to
likely be followed in future litigation   tral repository, but it could be the       new and exotic storage mechanisms
by the courts of the several states,      compilation of several parties’ input.     in the future. The organization must
making the observations here useful       Furthermore, portions or copies of         keep in mind that not only must this
to those who may be engaged in liti-      the EHR could have been transmit-          information be accessible on a future
gation often brought in state courts      ted electronically to other locations.     date; it must also be producible to
(e.g., medical malpractice).              The EHR could be downloaded or             opponents in litigation as well.3
                                          accessed by practitioners or author-       Under the amendments, opponents
ESI, and Therefore EHR, Is                ized users via the Internet. The           may request the ESI in any reason-
Discoverable                              advent of handheld computers also          ably reproducible form, including
                                          means that portions of the EHR             native file format. To the extent that
The amendments specifically provide       could reside in the memory of a mul-       the ESI is reasonably accessible by
that ESI is discoverable.2 And, EHR       titude of mobile devices. If ESI is pro-   the organization, the same process
content is clearly ESI. Upon receipt      duced from multiple sources, the           for accessing the information may
of a document hold request, a             authenticity and integrity of the          need to be provided to its opponent
healthcare entity must review its EHR     “original” electronic record will be       in litigation in order to review and
system and the internal policies and      crucial to deflecting charges of alter-    analyze the ESI.
procedures governing EHR to ensure        ation of ESI or even spoliation of evi-
that it can comply with the new fed-      dence.

                                                                                                         MAY 2007       5
ing information. However, for many          sent functionality not only creates
 HEALTH INFORMATION AND TECHNOLOGY
                                           enterprises with home grown, patch-         and applies the informed consent
 PRACTICE GROUP LEADERSHIP
                                           work, or transitional electronic            template, stepping the physician
 Edward F. Shay, Chair                     record systems, this may not be the         through the relevant risks and
 Post & Schell PC, Philadelphia, PA        case and could, for example, compli-        advice, but it also may create in
 eshay@postschell.com                      cate a defense based upon demon-            parallel a progress note that shad-
                                           strating what was known and when it         ows how and when the consent
 Gerald “Jud” E. DeLoss, Vice Chair –      was known.                                  was obtained—including alter-
 Membership                                                                            ations and modifications. A tradi-
 Krahmer & Nielsen PA, Fairmont, MN        Production of EHR-based ESI also            tional paper form of consent will
 gdeloss@fairmontlaw.com                   brings with it the potential responsi-      not show the need to go back
                                           bility to provide opposing counsel          and add a new risk or modify the
 Phyllis F. Granade, Vice Chair –
                                           with the means to review that infor-        consent, but some EHRs will
 Educational Programs
 Carlton Fields PA, Atlanta, GA
                                           mation in its native electronic format.     show this interplay. Enlightened
 pgranade@carltonfields.com                Ideally, electronic review will take        by e-discovery and EHR function-
                                           place off-site without granting oppos-      ality, in an informed consent driv-
 Becky Williams, Vice Chair –              ing counsel real-time access, for           en cases, things will not be as
 Publications & Editor                     example, to a medical group’s inter-        straight-forward.
 Davis Wright Tremaine LLP, Seattle, WA    nal computer system. If the organiza-
 beckywilliams@dwt.com                                                                • Clinical decision support or
                                           tion’s EHR system does not allow for
                                                                                        adverse drug alert tools are dis-
                                           off-site review, then it is faced with a
 Robert Q. Wilson, Vice Chair –                                                         coverable. When operating, these
                                           dilemma. Can the ESI be translated
 Research & Website                                                                     alerts may be either non-interrup-
                                           into a readable form acceptable to
 The Bogatin Law Firm PLC, Memphis, TN                                                  tive or interruptive. Interruptive
                                           opposing counsel; or, will opposing
 rwilson@bogatin.com                                                                    alerts will require an override,
                                           counsel and/or their experts want
                                                                                        possibly an explanation to move
                                           access to the organization’s comput-
 Thanks go to the Practice Group for                                                    forward. That activity will be doc-
                                           ers to review the ESI firsthand, poten-
 sponsoring this feature.                                                               umented by the EHR system and
                                           tially including metadata as discussed
                                                                                        it will be discovered. In many
                                           below?
Healthcare entities may have to pro-                                                    cases due to alert fatigue, the
duce ESI from a record that is con-                                                     alert function will be turned off
stantly changing over time. This           EHR Discovery Challenges                     because it gets overridden repeat-
evolving record will be different          Healthcare enterprises faced with            edly, perhaps more a function of
depending upon the date and possi-         requests for production of EHRs              the underlying software and
bly even the time of access. In accor-     must recognize that EHRs are funda-          knowledge base limitations than
dance with long-standing discovery         mentally different information sys-          clinical disregard. Nonetheless,
rules, a litigant’s discovery responses    tems from paper records. In terms of         the decision to turn off an alert
must be supplemented to provide for        information capture and display,             function can be discovered and
additional information.4 Subject to        EHRs well exceed a traditional chart.        will need to be explained. In con-
objections based upon relevance,5          The key difference is EHR functional-        trast, neither the decision nor the
the organization will be required to       ity. EHRs are simply far more robust         explanation would have arisen
update ESI previously produced to          in terms of what they do and what            with a paper chart.
comply with these discovery require-       they record. Discoverability of this
ments. The difficulty will lie in track-                                              • EHRs have login/logout access
                                           expanded and integrated functionali-
ing how and when the EHR was sup-                                                       features that track and time-
                                           ty will make e-discovery a challenge.
plemented with the new or additional                                                    stamp access in terms of
                                           For healthcare enterprises producing
information. The organization must                                                      create/view/update/delete activi-
                                           a patient electronic medical record
be able to capture the data at each                                                     ty by a user. EHR audit logs will
                                           some key aspects of EHRs to watch
moment in time to determine what                                                        identify literally everyone who
                                           for are as follows:
information changed and how it                                                          looks at patient X’s record. The
                                              • Legibility issues go away and that
changed in order to properly                                                            identity of all of these persons
                                                may be the good news.
respond to initial discovery requests                                                   will be discovered in a request for
and to supplement or amend existing          • Built-in tools tell a more complex       production of patient’s EHR. The
responses. New EHR systems with                and revealing story. For example,        list of persons who accessed the
robust functionality will track evolv-         in some EHRs the informed con-           EHR will begin to look a lot like

  6   HEALTH LAWYERS NEWS
the list of persons who will be           more than knowing where the              enterprises. For these organizations,
   deposed in most cases. When               information is and then waiting          serious role-playing exercises
   persons not authorized to access          for a request. It requires fore-         through various e-discovery scenarios
   the EHR turn up in the mesh of            thought about how it will be pre-        will be time well spent.
   the e-discovery net, look for spin-       sented and explained.
   off Health Insurance Portability                                                   Healthcare enterprises involved in lit-
                                            • Despite some recent efforts at
   and Accountability Act workforce                                                   igation have long been able to assert
                                              standardization, EHRs are not
   sanctions and the predicable                                                       certain evidentiary privileges that
                                              one size fits all, may reflect enter-
   employment law litigation.6                                                        apply to specific types of health infor-
                                              prise culture, and will require
                                                                                      mation. However, as that privileged
  • EHRs have tools and efficiencies          extensive policies and proce-
                                                                                      health information migrates onto
    that may require new and exten-           dures to adapt system features
                                                                                      electronic health information systems
    sive explanation once discovered          such as: (1) when and by whom
                                                                                      and databases, and it becomes subject
    in litigation. Simply put, EHRs           modification to the record may
                                                                                      to e-discovery, the old ways of assert-
    do not create information in the          be made; (2) whether to deploy
                                                                                      ing privilege need to be re-visited.
    same manner as a traditional              or disable a “break the glass”
    chart. EHRs use many of the               tool; or, (3) whether the adverse
                                                                                      EHRs typically interface with other
    same tools as other software pro-         drug alerts system is system-wide,
                                                                                      HIT systems (e.g., patient account-
    grams (e.g., copy and paste               on or off. All of this is fair game
                                                                                      ing, lab, pharmacy, clinical data
    entries, templates). Sometimes            for e-discovery and needs to be
                                                                                      repositories). EHRs will likely be orig-
    these tools provide efficiencies,         considered well before the first
                                                                                      inal source documents; but clinical
    but they may lend themselves to           hold letter arrives.
                                                                                      data repositories with quality of care
    the perception that caretakers
                                          In short, EHR technology is new and         benchmarks may or may not be an
    are saving time by cutting cor-
                                          rapidly evolving for most healthcare        original source. These databases may
    ners. If doctor A simply cuts and
                                          enterprises and the e-discovery rules       be the repositories where the statuto-
    pastes doctor B’s progress note,
                                          are likewise new to most healthcare         rily protected deliberations of a
    the appearance of an identical
    note may require a different
    explanation than a handwritten
    note. Nonetheless, A’s cut and
    paste will be discovered.
Given the robust functionality of
EHRs, healthcare enterprises using
EHRs that are engaged in e-discov-
ery need to know several things in
addition to the legal and practical
requirements of the e-discovery
rules. These enterprises need to:
  • Carefully examine and under-
    stand the discoverable content of
    their EHR systems before discov-
    ery is commenced (i.e., what can
    the system do?). In light of the e-
    discovery rules, it is clear that a
    healthcare enterprise cannot sim-
    ply print its selection of entries
    from an EHR system or database
    and send it to court with the
    record room custodian to testify
    that it is the organization’s stan-
    dard business record. Virtually all
    of the electronic information
    and related metadata is discover-
    able. Good preparation requires

                                                                                                           MAY 2007      7
patient safety committee or a peer           requirements of the Security                 should contain an explanation of the
review committee are stored. The             Standards simply hands one’s oppo-           litigation or event to provide a con-
ability to assert a healthcare related       nents an easy collateral win.7               text for employees to understand the
evidentiary privilege may depend                                                          hold. To further assist employees, a
upon who can or cannot access the            A legal hold may be implemented              quick list of the criteria necessary to
information. E-discovery can test the        for a variety of reasons and circum-         identify potentially relevant ESI
integrity of the access assumptions          stances. The duty may arise if the           should be drafted. Finally, the hold
upon which an asserted privilege             party suffers from a higher number           announcement should describe the
rests to determine whether access to         of lawsuits such that the party should       process for protecting or preserving
protected information has been lim-          more reasonably anticipate legal pro-        the ESI. Legal counsel, inside or out-
ited to those involved in the protect-       ceedings in which the information            side, may serve as contact points for
ed activity. To prepare for e-discovery,     may be needed. When implementing             questions and to assist in the preser-
healthcare enterprises need to closely       a litigation hold, it is extremely           vation of the ESI.
examine access/use rights to poten-          important to identify custodians and
tially privileged databases. We recom-       key employees who hold or access             In addition to the internal announce-
mend that healthcare enterprises             the EHR and relevant information.            ment of a legal hold, the entity
review, map, and audit access to             These individuals should be at the           should notify external parties of the
potentially privileged databases.            top of the list of those to be notified      requirements to preserve evidence.
                                             in the event a hold needs to be insti-       Counsel should continue to monitor
The “Legal Hold” and EHR                     tuted. Identifying key individuals           the hold throughout the litigation. A
                                             assists not only in understanding the        lifting of the hold should be formally
Litigants in any proceeding and              location of the ESI, but also the dif-       communicated upon the conclusion
potential litigants have a legal duty to     ferent ways in which it may be used          of the litigation to ensure that the
preserve evidence in the event of liti-      and stored.                                  data retention and management poli-
gation or reasonably anticipated liti-                                                    cy are reinstituted fully.
gation. Healthcare litigants have an         A legal hold announcement or letter
arguably higher duty to preserve
electronic evidence with respect to
                                             should be distributed throughout the         “Metadata” and the
                                             organization, but targeting key per-         Production of EHR
EHRs. Not only do the e-discovery            sonnel. The announcement should
rules carry their own sanctions, but         contain the following elements. First,       The Rules allow for the requesting
failure to preserve an EHR that              it should include a reference to the         party to obtain the ESI in any form
meets the authenticity and integrity         entity’s retention policy. Further, it       that the responding party can reason-
                                                                                          ably produce.8 The production of
                                                                                          ESI in its native file format raises the
  UPCOMING HEALTH INFORMATION AND TECHNOLOGY PRACTICE GROUP EVENTS                        issue of production of the metadata
 Health Information and Technology           • Security Breach Concerns: Legal and        accompanying the data itself. The
 Practice Group Annual Luncheon                practical considerations with respect      Comment to the amendment pro-
 “Interactive Dialogue on Current HIT          to notification in the wake of a securi-   vides:
 Legal Issues”                                 ty breach, including state notification
                                               laws, HIPAA mitigation, etc.                 Computer programs may retain
 Monday, June 25, 2007                         Discussion Leader: Becky Williams, RN,       draft language, editorial com-
 12:30–1:45 pm                                 JD, Davis Wright & Tremaine LLP              ments, and other deleted matter
                                             • EHR Legal Issues: Legal issues impact-       (sometimes referred to as “embed-
 The Health Information and Technology         ing EHRs, including but not limited to       ded data” or “embedded edits”) in
 Practice Group will hold a lunch meeting      e-Discovery, Stark exceptions, and AKS
 at the 2007 Annual Meeting that will                                                       an electronic file but not make
                                               safe harbors and liability.                  them apparent to the reader.
 focus on an interactive dialogue on cur-      Discussion Leader: Jud DeLoss,
 rent HIT legal issues. HIT Practice Group                                                  Information describing the history,
                                               Krahmer & Nielsen PA
 and other AHLA members are invited and                                                     tracking, or management of an
 urged to share their views and pool their   • A Transactional Look at PHI: Secondary       electronic file (sometimes called
 experience on leading HIT legal issues.       uses of PHI and “ownership”/licensing        “metadata”) is usually not appar-
 We will explore three issues through a        issues between providers and third           ent to the reader viewing a hard
 structured dialogue involving audience        parties relating to PHI, de-identified       copy or a screen image.9
 participation.                                information, and what lies in between.
                                               Discussion Leader: Rob Wilson, The         EHRs contain a wealth of metadata
                                               Bogatin Law Firm                           including audit logs of who accessed
                                                                                          the record and when, times and

  8   HEALTH LAWYERS NEWS
dates when actions were taken and decisions were
made, and many other tracking activities. Courts that
have addressed the issue of the production of metadata
have generally concluded that it should be produced
and not purged from the ESI.10 If the metadata were
somehow purged from the ESI, the question arises
whether it would amount to spoliation of the evidence.
This and other questions relating to metadata produc-
tion remain to be determined. In any event, if the meta-
data contained privileged information there is no ques-
tion it should not be produced.

Counsel should recognize the importance of metadata
and fully utilize it for their own purposes when dealing
with their own client’s ESI. In addition, it may be proper
and ethical to utilize computer forensics to review the
opponent’s ESI for metadata and utilize it for their own
benefit.

Conclusion
The amendments to the Federal Rules governing
discovery will provide for many new opportunities and
problems for healthcare entities utilizing EHR. While
the technology may create greater efficiencies in patient
care and business operations, it can also reduce the
time and expense necessary to comply with discovery
during litigation. However, in order to capitalize on the
opportunities available, healthcare entities and their
legal counsel need to address proactively the burden of
managing the enormous amount, types, and locations
of ESI.

Gerald “Jud” E. DeLoss practices with the law firm of Krahmer
& Nielsen, PA in Fairmont, MN. Jud is Vice Chair of
Membership for the Health Information and Technology
Practice Group. Edward F. Shay is a partner at Post & Schell
PC in Philadelphia, PA, and is chairman of the Health
Information and Technology Practice Group

End Notes
1    John H. Martin, Lori L. Dalton, and Ramsey Lauren Burke,
     “How to Get a Clean Bill of Health in the Age of Electronic
     Discovery: Recent Developments and the Role of Counsel,”
     11 Health Lawyers News at p. 6 (April 2007).
2    FED. R. CIV. P. 26(a)(1).
3    See, e.g., Wild v Alster, 377 F. Supp. 2d 186, (D.D.C. 2005),
     for how changing computer systems gives rise to the
     appearance of altered electronic evidence.
4    FED. R. CIV. P 26(e).
5    Committee Note to FED. R. CIV. P 26(b)(2).
6    See Petryszak v Kalispell Reg’l Med. Ctr., 2002 Mont. Dist. Lexis 3391.
7    45 C.F.R. § 164.312.
8    FED. R. CIV. P. 34(a).
9    Committee Note to FED. R. CIV. P. 26(f).
10   Williams v. Sprint/United Mgmt. Co., 230 F.R.D. 640 (D. Kan. 2005).

                                                                               MAY 2007   9
You can also read