Litigation Response Planning and Policies for E-Discovery. AHIMA Model E-Discovery Policies: Production and Disclosure of Health Information and Records for E-Discovery

AHIMA Model e-Discovery Policy

Subject/Title

Production and Disclosure of Health
Information and Records
for e-Discovery

 

Page _ of _

Revision History

Effective Date:

Departments
Affected:

Health Information Management
Information Technology
Legal Services

Original Issue Date:

Last Reviewed:

Last Revision:

PURPOSE: The purpose of this policy is to outline the steps in the production and disclosure process for health information and records related to e-discovery for pending litigation.

SCOPE: This policy addresses e-discovery production and disclosure procedures related to the Federal Rules of Civil Procedures. Health information and records include both paper and electronic data related to relevant patient medical records and enterprise sources.

POLICY: It is the policy of this organization to produce and disclose relevant information and records in compliance with applicable laws, court procedures, and agreements made during the litigation process.

PROCEDURE:

Accurate Patient Identification

Responsible

Action

HIM

For litigation involving an individual’s medical records, verify the patient’s identity in the master patient index, including demographic information and identifiers including the medical record number. [Note: When conducting searches, it is critical to accurately identify the correct patient and relevant information.]

HIM

Note multiple medical record numbers, identifiers, aliases, etc., that will be used during the search process to find relevant information.

Subpoena Receipt and Response

Responsible

Action

Litigation Response Team

Upon receipt, subpoenas should be reviewed to determine that all elements are contained, the parties and the purpose are clearly identified, and the scope of information requested is clear.

  • Validate the served subpoenas before official acceptance. The validation process includes at a minimum:                                                                                                                                                  
  • Verification of appropriate service of the subpoena and that the organization is under legal obligation to comply with it
  • Verification that seal and clerk of the court signature are present and valid

Review of the venue and jurisdiction of court of the case and verification that the court is located within legal distance/mileage requirements.

HIM

Notify the Litigation Response Team that subpoena has been received and determine if a legal hold is in place. If not, the Litigation Response Team should determine whether a legal hold should be applied.

HIM

If the subpoena requests “any and all records,” HIM and/or Legal Services should work with the judge and/or plaintiff attorney to clarify the scope and type of information being requested.

[Note: The e-discovery process will identify vast volumes of data which can overwhelm a case; the parties should identify information that is necessary and relevant rather than providing all information.]

Litigation Response Team/Legal Services

Provide direction to HIM in the processing of the subpoena, including the specific information to produce, agreed-upon file formats and forms of production, whether an objection will be filed, timeframe to produce and disclose. and whether on-site testing/sampling will be conducted by requesting party.

Search and Retrieve Process

Responsible

Action

Litigation Response Team

Identify the potential sources of information which may hold potentially relevant information, such as:

  • Legal Health Record/EHR System (including source information systems such as nursing, ED, lab, radiology, etc.)
  • Local area server for the office
  • Personal share or personal folders on server
  • Dedicated server for organization
  • Laptop and/or department computer
  • Home computer, PDA
  • E-mail, including archived e-mail and sent e-mail
  • E-mail trash bin, desktop recycle bin
  • Text/instant message archives
  • Removable storage media (e.g., disks, CDs, DVDs, memory sticks and, thumb drives)
  • Department/office files such as financial records
  • Personal desk files
  • Files of administrative personnel in department/office
  • Files located in department/office staff home
  • Web site archives

HIM, Data Owners

Based on direction from the litigation response team on the potential locations of relevant information and the information agreed upon in the discovery plan and/or subpoena, establish search parameters (patient identifiers, search terms, key words, etc.) and conduct the search process.

Maintain a record of the systems searched, search methodology, search parameters (terms), and search results.

IT

Provide assistance to HIM and Data Owners in the search and retrieval process for various systems and data sources.

HIM, Data Owners

Screen or filter the search results, eliminating inappropriate information (e.g., wrong patient, outside the timeframe, not relevant to the proceeding, etc.).

Legal Services

Review the content of the data/data sets found to determine relevancy to the proceeding and identify information that is considered privileged.

Legal Services, HIM, Data Owners

Determine the final list of relevant data/data sets, location, and search methodology.

Production of Records/Data

Responsible

Action

HIM, Data Owners, IT

Determine the format the information will be disclosed, such as: paper, ASCII, PDF, TIF, screen shot, mirror copy of data file, or review of material on-line.

The format will vary depending on data, source, and agreement made in the Discovery Plan/Form 35.

HIM, Data Owners, IT

Produce the information in the agreed-upon format as outlined in the discovery plan/Form 35.

Legal Services, HIM, Data Owners, IT

Mask, redact, or retract non-relevant, privileged, or confidential information (such as on a different patient) as appropriate.

Legal Services

Conduct final review of information before disclosing to requesting party.

Legal Services

Retain a duplicate of information disclosed to requesting party.

Charges for Copying and Disclosure

Responsible

Action

HIM, Data Owners, IT

For the information searched and disclosed, calculate the costs for search, retrieval, and disclosure methods using the organization’s established formula and governmental formulas for reproduction charges.

HIM

Invoice requesting parties for allowable charges related to reproduction of health information and records.

Legal Services

Determine whether other expenses may be charged in accordance with the discovery plan or negotiation with litigants and/or judge.

Testing and Sampling

Responsible

Action

Legal Services

A party to the legal proceeding may request to test and sample the search and retrieve methodology. Testing and sampling should be discussed and agreed upon during the pretrial conference and part of the discovery plan, including whether an external party will test and sample the search and retrieve methodologies. The costs and charges should also be determined and negotiated.

HIM, Data Owners

Retain information on all of the searches, including methodology, key words, and systems in case the methodology has to be recreated for testing purposes and to determine if sample was statistically valid.

Litigation Response Team, HIM

Assign a monitor for the outside party during their testing protocols.

Attorney/Third Party Request to Review Electronic Data

Responsible

Action

Litigation Response Team

Determine the procedures for allowing an attorney or third party to review the electronic records and search results on-line. This includes where the review will occur, system access controls, monitoring during the review session, and the charges, if any.

Legal Services, IT, HIM, Data Owners

Mask, redact, or retract non-relevant, privileged, or confidential information (such as on a different patient) as appropriate.

HIM, Data Owners

Verify the outside party is allowed access to the record and systems by reviewing all supporting documentation (e.g., signed consent, credentials from retained firm, etc.).

HIM, Data Owners

Prepare for access by identifying the types of information that party is allowed to access. If an authorization has been signed by patient or legal representative, allow access to legal medical record and/or other information as outlined in the authorization. If other types of information will be reviewed, access is allowed based on the subpoena, court order, state/federal statutes, or agreed-upon discovery plan.

Responding to Interrogatories, Deposition, Court Procedures

Responsible

Action

Legal Services

Legal Services manages the process for completion of the interrogatories and will coordinate processes related to a deposition and testifying in court.

HIM (official record custodian)

HIM may provide information for an interrogatory, be deposed, or testify in court. HIM is the official custodian of the record and can testify whether the records were kept in the normal course of business and the authenticity of the records. In addition, HIM also addresses the good faith operations related to records management, retention/destruction, and the search and retrieval process/parameters.

IT (official system custodian)

IT may provide information for an interrogatory, be deposed, or testify in court. IT is the official custodian of the information system and may testify about the technical infrastructure, system architecture, security practices, source applications, and the good faith operations from a technical infrastructure perspective.

Data Owners

Data owners may provide information for an interrogatory, be deposed, or testify in court. The data owners may testify about the specific issues related to their department/business process area.

Primary/Direct Custodian

Primary/direct custodians may provide information for an interrogatory, be deposed, or testify in court. The primary/direct custodians are those person(s) who work with the data directly or have direct involvement/knowledge of the events the litigation. For example, a staff nurse who has made an entry into the medical record and is knowledgeable about the events of a case in litigation.

Business Associates/Third Parties

Business Associates/Third Parties may provide information for an interrogatory, be deposed, or testify in court. These include contractors and others who serve a variety of functions associated with a party’s information but who themselves are not parties to the litigation. Examples include Internet service providers, application service providers such as a claims clearinghouse, and other providers who provide services ranging from off-site data storage to complete outsourcing of the IT Department.

APPROVALS:

Legal Department Approval:

Date:

HIM Department Approval:

Date:

IT Department Approval:

Date:

[Specify Other Department]

Date:


Article citation:
AHIMA e-Discovery Task Force. "Litigation Response Planning and Policies for E-Discovery. AHIMA Model E-Discovery Policies: Production and Disclosure of Health Information and Records for E-Discovery." Journal of AHIMA 79, no.2 (February 2008): BoK Extras