HIPAA HITECH - E-Discovery and the Healthcare Industry

This week, I'd like to talk about HIPAA HITECH.


What is HIPAA HITECH?


Well, HIPAA is a 1996 federal law on health insurance, and it stands for:


Health
Insurance
Portability and
Accountability
Act


In 2009, HIPPA was amened to add the HITECH Act. This, in turn, stands for:


Health
Information
Technology for
Economic and
Clinical
Health
Act


It's the 'Information Technology' of HITECH that hints at the law's purpose. According to the U.S. Department of Health and Human Services (HHS), HITECH is intended "to promote the adoption and meaningful use of health information technology." HITECH covers security and privacy issues when a person's health information is transmitted electronically.


HIPAA HITECH brings the world of electronic discovery to the world of health care in the form of "electronic health records" and how these records are handled.


HIPAA HITECH is complicated, and has many aspects. I'd like to touch on just a few, this week:

• The law extended privacy protections to 'business associates' of 'covered entities'. Basically, health information has to be kept private not only by health care providers, but also by their business associates.
• The law also has new breach notification requirements. If health information is released to the outside world, notification must be made, as per new regulations of HHS (which were required under the new law).
• Another significant change in the law includes new rules on how to account for disclosures of a person's health information.

These changes are just a few of the changes under HIPAA HITECH (although they are some of the more significant ones). In the months to come, I plan to discuss more, and more detailed, aspects of HIPAA HITECH.

E-Discovery basics: The Sedona Conference

This week on Discovering E Discovery, I'd like to talk about the Sedona Conference.

The Sedona Conference is a research and educational institute based in Sedona, Arizona. The Conference strives to improve law and policy in the areas of antitrust law, complex litigation and intellectual property rights.

The Sedona Conference's first Working Group is called 'Electronic Document Retention and Production', and it deals with the subject of e-discovery. Starting in 2002, a lot of very smart people have met together to talk about current issues in, and challenges to, the world of electronic discovery.

Working Group 1 released its first publication in 2003, and it was cited by Judge Scheindlin in the Zubulake cases.

The Sedona Conference's website can be found here. The documents published by Working Group 1 are found here. They are a very valuable resource for e-discovery professionals.

Everyone who works in electronic discovery should be familiar with the Sedona conference, and its Working Group 1!

(A short post this week, but Discovering E Discovery is in a brief summer hiatus.)

E-Discovery Basics: Spoliation and Metadata

This week, I'd like to define the term 'spoliation'. If you are not familiar with the word, you may have to be a little careful - you could mispronounce it. It's not 'spoil-ation' (which isn't a word, according to the Merriam-Webster dictionary), but 'spo-li-ation'.

'Spoliation' is related to the word 'spoil', however, and its first definition comes from the Latin word for 'plundering'.

We are more interested in its second definition, which is to alter a document so that evidence is lost, destroyed, or even just changed.
Spoliation is a bad thing - it can be done intentionally or negligently, and it can be a criminial act.

Spoliation can occur quite often in the electronic discovery context. It usually happens to metadata.
What is metadata? 'Metadata' is data about data. For example, most electronic documents have a creation date, the name of the document's author, the date the document was last saved, etc. All of this is considered 'metadata'.

If the contents of an electronic document are changed (such as text in the body of an email), this is clearly spoliation. However, if even the creation date of a document is changed, this is also considered spoliation.

Why is spoliation important in e-discovery? Spoliation can lead to a judge imposing sanctions or even giving adverse inference instructions to a jury, which, as we have seen, can be devastating.

In my experience, the problem with spoliation usually arises in the context of restoring electronic documents from back-up media such as back-up tapes. It is very possible that some of the metadata is changed in the restoration process. I've found that if spoliation has occured, it is usually the document's creation date that is changed, and it is changed to the restoration date.

For example, an email may be written and sent on 1/1/2005. Its creation date is therefore 1/1/2005. At some point, the email is backed up into an archive. If the email is restored from the archive on 6/25/2009, and the email's creation date is changed from 1/1/2005 to 6/25/2009, then this is spoliation.

Spoliation can happen this way quite often - many regulators and judges are familiar with the problem, and may allow minor spoliation of documents turned over to the court or to the other side, so long as the original archive copy of the data is clean and unaltered.
However, being aware of the situation and notifying the court or the other side is extremely important in this case. Handing over data that has undergone spoliation, and not telling the recipient, is a recipe for disaster.