102 ediscovery Shakedown: Lowering your Risk Long-Term Care Session HCCA Compliance Institute April 27, 2009 Las Vegas, Nevada Presented by: Diane Kissel, Manager IS Risk & Compliance Kindred Healthcare, Inc. Marty Diller, Chief Information Officer Complete HealthCare Resources Kindred Healthcare Hospital Division Long-term Acute Care Hospitals Health Services Division Nursing and Rehabilitation Centers Rehabilitation Division Peoplefirst Rehabilitation Services Largest operator in U.S. 82 hospitals with 6,428 licensed beds Second largest nursing center operator in U.S. 228 nursing centers with 28,378 licensed beds 6 assisted living residences with 317 licensed beds Second largest contract therapy company in U.S. 348 external locations served through 4,900 therapists and 8,500 total employees 658 sites of service: 310 facilities in 40 states 33,500 patients and residents per day 54,300 dedicated employees 1
What we will cover today Special challenges that ediscovery imposes Practical tips to help ready your organization for an ediscovery request The ediscovery team: aligning IT and the legal department DISCLAIMER: verbal and written opinions of the authors are not to be construed as legal advice. Consult your legal counsel for guidance. Background What is Discovery? Definition: right of the plaintiff (the person seeking damages) to request of the defendant (respondent) any information, in any format, related to the case. Prior to December 2006, electronic evidence was included in the category of documents. Revisions to the Federal Rules of Civil Procedure (FRCP) created a new category of evidence: ESI. So then...what is ESI? Definition: electronically stored information. 2
Legal Discovery - then versus now Then Paper documents Know where they are, easy to segregate from rest of filing cabinet Now Electronic data Need to identify all systems where data resides, including electronic dumpsters No easy way to segregate data Explosion of data Electronic data doubles every 12-18 months New data formats TIFF? PDF? HTML? NO! Challenges Inexpensive storage technology$ Stricter regulations Tighter timeframes Expanding networks Technology alone won t fix the issues - in fact technology often introduces as many problems as it solves through either inadvertent omission or spoliation of data. 3
First How to best prepare? Develop a comprehensive document and data retention/destruction policy and follow it all levels Second Address email as a special case Third Be able to adapt to special situations - litigation holds FIRST Develop a comprehensive document and data retention/destruction policy and follow it all levels 4
Document and Data Retention/Destruction Policies Benefits Allows a company to know what, where and for how long data is kept Allows for cleaning house of data that has lost its business purpose, bogs down operations, and increases litigation risk and discovery cost Has evidentiary value in helping a company defend against e-sanctions Managing ESI as a Strategic Asset (rather than a liability) Best practices: Restrict amount of data that is being retained Define timeframes and processes for disposition Control, or minimize replication of ESI across multiple repositories Establish metadata to aid in classification and retrieval of ESI Outline accessibility and security of ESI in its native form Strategies: Acquire less: Identify opportunities to limit the amount of ESI being captured and stored in the first place. Organize better: Improve the way ESI is organized to facilitate awareness and utilization. Improve access: Enhance the ability to access ESI where and when it is needed as a routine course of business. Replicate less: Reduce or eliminate unnecessary copies of ESI. Retain less: Limit retention and dispose of ESI when appropriate. 5
Know what data exists and where -- how data is being created and stored What applications are used to create messages and/or documents? Where are files stored? - desktop and laptop computer hard drives - mapped network share drives - portable flash drives, CDs, DVDs - PDAs, Blackberries, smart phones - voice mail systems - home computers - broken computer equipment, leftover backup tapes, floppy disks, systems no longer in use Document Retention Program Program relies on the systematic review, classification, retention and destruction of both paper and electronic documents. Valid policy should be in place, routinely enforced, and managed. A strong information governance policy: Restricts the amount of information retained Defines schedules and process for data destruction Controls the replication of data in multiple repositories Establishes metadata to classify and aid in the retrieval of ESI Determines the accessibility and security of ESI in its native format 6
Document and Data Retention/Destruction Policies Checklist Is there a retention policy? Does the policy cover paper AND electronic documents? Is the policy based on business concerns or simply IS capability? In what format will documentation be maintained? Does the policy take into account all applicable regulations for all geographies where the company does business? What is the effective date (and what happened before)? How is the policy articulated and disseminated? Does everyone follow the policy (and how do you know?) How does the policy adapt to special situations? SECOND Address email as a special case 7
Email - why a special case? Per Ian Ballon, How Companies Can Reduce the Costs and Risks Associated with Electronic Discovery Email inverts the normal pattern of document retention whereas with paper documents an employee must make an affirmative decision to file--and hence retain--a given piece of paper, most email systems will automatically store all communications that are not affirmatively deleted. Email comprises 50% of evidence in court cases Email considerations Loses its context quickly -- much of it never had any business purpose easy to shed doubt on and misinterpret context of email (can t see writer s facial expressions, body language, hear tone of voice, etc. to know true intent) much email is of personal nature, i.e. lunch invitations, jokes Can be stored anywhere from the company network to an employee s PDA or home computer 8
Checklist Email What systems and processes are in place for the classification, management, storage, and retention of company email? Is there a policy regarding use and transmission of sensitive information in email? Is email screened and monitored? How will email be searched, indexed, reviewed, retained, and produced if relevant to litigation? THIRD Litigation Holds 9
What is a litigation (legal) hold? Definition: protection of information from destruction or alteration due to current or expected civil proceedings Requirements: quickly identify, track and manage ESI suspend routine destruction of potentially relevant ESI issue legal hold notices to all custodians who may possess relevant evidence reissue litigation hold instructions regularly and monitor compliance Requires right combination of people, process and technology Benefits: Legal Holds ensures matter remains focused on facts of case instead of ediscovery practices better position to negotiate fair and reasonable scope of discovery during meet & confer conference because counsel can better demonstrate clear understanding of relevant ESI and impact to organization demonstrates good faith in effort to preserve all potentially relevant ESI 10
Collection of Evidence What constitutes a record? Voice mail? Document drafts? Database content? Each person produces almost 800 megabytes of data each year that is the equivalent of a 30 foot high stack of paper! Collection methods: User discretion - employee chooses which files are appropriate Full forensics imaging - investigative software used to preserve an entire hard drive (typically refers to creating a bit-by-bit replication of a hard drive - not only active files, but also deleted files, swap space, and unallocated slack space) 1 gigabyte of data = 75,000 printed pages Collection of Evidence Context can be lost when files are no longer stored as they were originally created and stored during the normal course of business native format but understand that current technology doesn t allow for the redaction of privileged or confidential information without changing the native files and metadata. Use a methodology that preserves both content and metadata (data about data) in a legally-defensive matter. (Entire folders can be copied without changing underlying metadata.) Example: files copied from a source repository, such as a PC s hard drive to a target repository, such as a removable USB hard drive. Cost substantially less than with forensic imaging and can be performed by a company s trained IT professional as opposed to 3rd party computer forensic experts. Be comprehensive but reasonable example: 1) creating a forensic image of all hard drives in question can assure preservation but may result in unnecessary costs for restoration, 2) failing to preserve metadata, particularly creation and modification dates, during collection can limit culling options and result in substantially higher attorney review costs. 11
Manage the evidence preservation and collection process in a legally defensible manner Plan for pending discovery requests Create documented preservation and collection practices (repeatable processes) Improve communication between legal and IT Implement a managed approach to discovery Document chain of custody Determine litigation profile How much litigation do we currently face and of what type? Checklist Legal Holds Policy should provide a clear mechanism whereby some person or persons in authority can suspend the policy for a given category of information for a given period of time Need established process for how a hold will be communicated to employees and reiterated as necessary Need controls in place to protect relevant information from spoliation (intentional or negligent withholding, destruction, or alteration of something relevant to a legal proceeding that destroys its value as evidence) 12
Align IT and Legal Departments When legal calls on IT, is there an established response process? Has legal thoroughly conveyed to IT all the requirements of electronic evidence handling, and is IT comfortable dealing with the requirements? Is there at least one IT person dedicated to supporting the legal department? Who is the point person in the legal department assigned to interact with IT? Civil Rules Advisory Committee repeatedly stated they were frustrated by counsel s inability to discuss electronic discovery issues... Final Remarks Recognize the positives of ediscovery revolution: compels executives to take information management seriously promotes email system efficiency reduces storage cost (equipment & manpower to manage storage) improves enterprise system performance instills PROACTIVE records management 13
Summary Look at retention periods Volume can get you in trouble. Location and context of documentation is important Must be able to effectively search and produce. Are legal and IT talking Collaboration is necessary for ensuring effective information management. Courts tend to be more sympathetic when it is clear organizations have practiced due diligence. 14