The Fundamentals of E-Discoverycampus.ahima.org/audio/2008/RB061008.pdfE-Discovery Operational...

© Copyright 2008 American Health Information Management Association. All rights reserved.

The Fundamentals of E-Discovery

Webinar June 10, 2008

Practical Tools for Seminar Learning

Disclaimer

AHIMA 2008 HIM Webinar Series i

The American Health Information Management Association makes no representation or guarantee with respect to the contents herein and specifically disclaims any implied guarantee of suitability for any specific purpose. AHIMA has no liability or responsibility to any person or entity with respect to any loss or damage caused by the use of this audio seminar, including but not limited to any loss of revenue, interruption of service, loss of business, or indirect damages resulting from the use of this program. AHIMA makes no guarantee that the use of this program will prevent differences of opinion or disputes with Medicare or other third party payers as to the amount that will be paid to providers of service. As a provider of continuing education the American Health Information Management Association (AHIMA) must assure balance, independence, objectivity and scientific rigor in all of its endeavors. AHIMA is solely responsible for control of program objectives and content and the selection of presenters. All speakers and planning committee members are expected to disclose to the audience: (1) any significant financial interest or other relationships with the manufacturer(s) or provider(s) of any commercial product(s) or services(s) discussed in an educational presentation; (2) any significant financial interest or other relationship with any companies providing commercial support for the activity; and (3) if the presentation will include discussion of investigational or unlabeled uses of a product. The intent of this requirement is not to prevent a speaker with commercial affiliations from presenting, but rather to provide the participants with information from which they may make their own judgments. This seminar's faculty have made no such disclosures.

Faculty

AHIMA 2008 HIM Webinar Series ii

Kim Baldwin-Stried Reich, MBA, MJ, RHIA, CHC, CPHQ

Kim Baldwin-Stried Reich is an independent healthcare consultant in Highland Park, IL, specializing in business assurance and regulatory compliance.

Sandra Nunn, MA, RHIA, CHP

Sandra Nunn is the Enterprise Content & Information Manager with Presbyterian Healthcare Services in Albuquerque, NM.

Table of Contents

AHIMA 2008 HIM Webinar Series

Disclaimer ..................................................................................................................... i Faculty .........................................................................................................................ii Agenda ........................................................................................................................ 1 Objectives ..................................................................................................................... 1 Defining e-Discovery ...................................................................................................... 2 eHIM – An Emerging Definition/Concept........................................................................... 2 The Federal Rules of Civil Procedure ................................................................................ 3 FRCP Are Changing Processes Within the HIM, IT and Legal Professions ............................. 3 The FRCP ...................................................................................................................... 4 Relevant FRCP Amendment Rules ................................................................................. 4-5 Highlights – Amendments to Federal Rules of Civil Procedure.......................................... 5-7 Legal Holds.................................................................................................................... 7 General E-Discovery Process Flow.................................................................................... 8 Migrating from a Paper to e-HIM Environment .................................................................. 8 E-Discovery Operational Process Flow .............................................................................. 9 Admissibility of the EHR..............................................................................................9-10 Authentication of e-HIM.................................................................................................10 The E-Discovery Process Synopsis of Differences Between Paper and e-HIM ......................11 The Event.....................................................................................................................11 The Allegation...............................................................................................................12 The Request for Production.......................................................................................12-13 Implications of the Duty to Preserve and Produce ............................................................14 What is a successful Electronic Discovery Response Plan ..................................................15 Electronic Discovery Response Plan ...........................................................................15-17 Challenge: Record Production with New Legal Requirements.............................................18 The Federal Rules of Civil Procedure: Security Implications ..........................................18-20 The Management of Unconventional Records...................................................................20 Electronic records retention............................................................................................21 Records .......................................................................................................................21 USA PATRIOT Act .........................................................................................................22 Policy, procedures and practices.....................................................................................22 One Organization’s Response .........................................................................................23 Our Project Plan............................................................................................................23 Enterprise Records and Retention Management Committee Structure ................................24 Enterprise Records Management Committee...............................................................24-26 ERMC Legal Subcommittee – the de facto E-Discovery Team .......................................26-27 Data Loss Definitions................................................................................................27-28 ERMC Policy Subcommittee .......................................................................................28-29 ERMC Electronic Record Subcommittee ...........................................................................29 ERMC Communications Subcommittee ............................................................................30 Enterprise Content Management Initiative .......................................................................30 Master Taxonomy .........................................................................................................31

(CONTINUED)

Table of Contents

AHIMA 2008 HIM Webinar Series

Content Management Taxonomy ...............................................................................31-32 Content Types ..............................................................................................................32 Information Technology Infrastructure Library .................................................................33 HIPAA Security Expansion..............................................................................................34 HIPAA Security Expansion: Incident Response .................................................................34 LEHR Defined: The Model ..............................................................................................35 Controlling the Cost of Electronic Discovery .....................................................................35 The Management of e-HIM ............................................................................................36 A bigger picture ............................................................................................................36 Collaboration will be the key to success...........................................................................37 Contact Information ......................................................................................................37 Audience Questions.......................................................................................................38 Resource/Reference List ...........................................................................................38-39 Audio Seminar Discussion and Audio Seminar Information Online.................................39-40 Upcoming Audio Seminars ............................................................................................40 Thank You/Evaluation Form and CE Certificate (Web Address) ..........................................41 Appendix ..................................................................................................................42 FRCP Amendments CE Certificate Instructions


AHIMA 2008 HIM Webinar Series 1

Notes/Comments/Questions

Agenda

1. Welcome & Introduction

2. Session Objectives

3. Rules and Process Overview

4. Hypothetical Scenario

5. Questions and Answers

6. Appendix of Resources 1

Objectives

At the conclusion of this session participants will:

• Better understand the Federal Rules of Civil Procedure (FRCP) Amendments and the e-discovery process as they relate to the admissibility of the legal health record into a court of law

• Be prepared to work in collaboration with legal counsel and IT in establishing policies and procedures for e-discovery within their organizations

2




Defining e-Discovery

It is more than rephrasing requests for electronic records & data and printing out documents –legal process differs from paper discovery

e-Discovery: Access, use & preservation of information, data & records

created or maintainedin electronic media.

Includes discovery of e-HIM®

Computer Forensics

Searching, gathering,reviewing, analyzing

large amounts of data

Focused search ofElectronically stored

relevant data – e-mailtext messages,

etc.

3

eHIM® - An Emerging Definition/Concept

Health Information

HIPAA Definition

Payers Manufacturers

Consumers Providers

“Any information in any form or medium created or received by a health provider, health plan, public health authority, employer,

life insurer, school or university, or health care clearinghouse”

Involves the health or condition or payment for provisionof an individual’s healthcare

Claims Data

ClinicalData

AdministrativeData

Financial Data

©Kim Baldwin-Stried 4




Who Issued?

Applies To?What Are They?

Why Important?

The Federal Rules of Civil Procedure (FRCP)

5

FRCP Are Changing Processes Within the HIM, IT and Legal Professions

InformationTechnology

Health Information Management

Effective E-Discovery Involves An Integrated & Collaborative Approach To The Management of E-HIM®

Legal Risk Management

EDiscovery

EDiscovery





The FRCP• Rules Governing Legal Procedure for Civil Litigation in District

(Federal) Courts

• The 2006 FRCP Amendments Address Unique Aspects of ESI

• Developed by the Civil Rules Advisory Committee

• Standing Committee of Judicial Conference

• Who Issued the FRCP?

• Supreme Court With Approval of Congress

• Most Healthcare Civil Litigation Occurs in the State & Local courts – Why are the FRCP Amendments Relevant? • Establish a Standard for State and Local Courts • The Uniform Rules for Discovery of Electronically Stored

Information are similar to FRCP amendments• Some State and Local Courts have established or are

developing e-discovery rules based on the FRCP amendments

7

Relevant FRCP Amendment Rules

General Provisions Governing Discovery; Duty of Disclosure; Discovery Scope and Limits; Claims of

Privilege or Protection of Trial-Preparation Materials; Information Produced

26(b)(5)(B)

General Provisions Governing Discovery; Duty of Disclosure; Discovery Scope and Limits; Limitations

26(b)(2)(B)

General Provisions Governing Discovery; Duty of Disclosure; Required Disclosures; Methods to

Discover Additional Matter

26(a)

Pretrial Conference; Scheduling Management16(b)(5) & (6)

Description Rule

8




Relevant FRCP Amendment Rules

Subpoena; Form; Issuance 45

Failure to Make Disclosures or Cooperate in Discovery; Sanctions; Electronically Stored

Information

37(f)

Report of Parties’ Planning Meeting – Discovery Plan

Form 35

Production of Documents, Electronically Stored Information, and Things and Entry Upon Land for

Inspection and Other Purposes

34(a)&(b)

Interrogatories to Parties; Option to Produce Business Records

33(d)

General Provisions Governing Discovery; Duty of Disclosure; Conference of Parties; Planning for

Discovery

26(f)(3)&(4)

Description Rule

9

Highlights- Amendments to Federal Rules of Civil ProcedurePretrial conferences & early attention to e-discovery issues

• Emphasis on meet and confer and pretrial conferences

• Requires knowledge of what information is available & the format

• Parties must discuss preserving discoverable information & form of production

• Parties must discuss cost & delays of document production

• Assertion of privilege

• Judges have more active role

Duty to disclose & relevance of information

• Legal obligation to maintain & disclose relevant records

• Prior to parties meeting – Legal, HIM & IT should meet.

• Limits scope to information relevant to the claim or defense. 10




Highlights – Amendments to Federal Rules of Civil ProcedureInformation not reasonably accessible; balancing cost & benefit; two tiered discovery

• Provides that a party need not provide electronically stored information that is inaccessible because of undue burden of cost

• Party must quantify the burden & show court that sources are not reasonable accessible

• Court may still order discovery for good cause – judge to balance cost vs. benefit

Claims of privilege after inadvertent production

• A process to present to the court that information was inadvertently produced (info not requested or relevant to the request)

• Establish organizational policies outlining examples of privileged and protected work product

11

Production of documents & discovery

Highlights – Amendments to Federal Rules of Civil ProcedureInterrogatories to parties

• Provides a process to answer interrogatories

• Provides an option of answering interrogatories by providing electronically stored information

• HIM & IT may be required to attest authenticity of records/information & answer questions

• The opposing party must have opportunity to examine, audit or inspect the information

• Provides for discovery of electronically stored information including native file formats & metadata

• Provides that electronically stored information is equally as discoverable as paper

• Recognizes need to perform testing of documents & electronically stored information

12




Highlights – Amendments to Federal Rules of Civil ProcedureSanctions failure to disclose; Spoliation

• Establishes process to apply sanctions if agreed-upon documents/information are not produced (or cannot be produced) or are altered

Safe harbor provisions for loss of electronically stored info

• Provides that sanctions may not be imposed for failure to provide electronically stored information lost as a result of routine “good faith” operations

• Legal, HIM & IT collaboration on policies and procedures for retention and destruction of electronically stored information

• Legal hold & preservation obligations must be communicated

• Efficacy of HIM systems will be scrutinized –better HIM systems = better protection

13

Legal Holds

• Legal Hold – Generally issued by the court

• Should be initiated when a duty to preserve is clear

• Suspends the normal disposition, processing or paper and electronic records

• Organizational policy should dictate legal hold policies and procedures

• After implemented legal holds should be regularly monitored

• Failure to initiate a legal hold can lead to adverse inference instructions to jury and sanctions and penalties

14




General E-DiscoveryProcess Flow Legal HoldLegal Hold

Suspend Files

Search For Potentially

Relevant Data

Collect Preserve

LegalReview

Cull Process

Production

Collect & Preserve

• High Volume of Record Collection

• Time Sensitive Phase• Focus on Identification

of Relevant Data • Testing/Sampling

Could OccurLegal Review

• High Cost Phase • Time Consuming

• Focus on Productionof Relevant Data

• Sound Records MgmtProgram Will

Yield Better Results


Migrating from a Paper to e-HIM® Environment


Health Information Management

E-HIM® is e-evidence which must be authenticated and reviewed prior to submission into a court of law. Hence, the

legal process and the roles of Legal Counsel, HIM IT Professionals are changing.

Legal Risk Management

Compliance

©Kim Baldwin-Stried

Legal EHRDefined

For Disclosure

16




Review

E-Discovery Operational Process FlowIdentification

Or Trigger

CommunicateApproach

Legal HoldEstablished?

Communicate HoldAccording To

Organizational Policy

Identify FormsFormat Locations Of Relevant Data

EstablishLegal Hold

Advise Legal/Risk

Management

End Process.

Await LegalReview

Production

End LegalOversight

LegalPresentation

InternalOr ExternalE-Discovery

Vendor?

Collection

Preservation

Legal NoticeReceived?

No

Yes Processing

Analysis

©Kim Baldwin-Stried

Legal/Risk OversightProcess Begins

17

Admissibility of the EHR

• EHRs, like paper based medical records are considered to be hearsay in a court of law.

• Hearsay is generally inadmissible. Three (3) tests for admission of hearsay evidence into a court of law.

• Evidence is relevant to prove or disprove material facts of case

• Evidence is material if it is important to the issue(s) of the case

• Evidence is competent if it is fit and appropriate proof

18




Admissibility of the EHRExceptions to Admissibility of Hearsay

1. “Business Records Rule Exception”• Federal and state rules allowing for admission of records made in the

regular course of business, recorded at or near the time of an event, under circumstances presumed to accurately reflect the event.

2. “Declarations”• Dying Declarations• Spontaneous exclamations• Admissions by a party• Declarations against interest

3. “Other Exceptions”• Public Records • Workman’s Compensation Records• Official Records

19

Authentication of e-HIM®

• Lorraine v. Markel American Ins. Co., 241 F.R.D. 534 (D. Md. 2007)Case involving lightning damage to a yacht

$14,000 above water damages $38,000 including damages to hull

• Judge Grimm

“We believe that e-mail messages and similar forms of electronic

communications can be properly authenticated within the existing

framework of the state rules of evidence.”

20




The E-Discovery Process Synopsis of Differences Between Paper and e-HIM®

© Kim Baldwin-Stried

Difference Description1. Volume & Reproducibility Issues

• e-HIM® Exists in Substantially Greater Volumes • Automated Replication of Electronic Information • Paper Does Not Need Device Such as Computer to be Read• e-HIM® HIPAA Standards for Transmission of PHI

2.Dynamic Content & Nature of Data

• e-HIM® Easier To Change Than Paper• Content of Electronic Information Can Change Without Human

Intervention• Transmission and Transfer of e-HIM® Not Fixed in Final Form

3. Metadata • e-HIM® Contains Metadata -- Paper Does Not • System, Application and/or User Metadata Not Readily Apparent• Metadata Adds New Set of Retention & Preservation Obligations

4. Lifespan/Persistence of Electronic Data

• e-HIM® Much Harder to Dispose of –- Paper Can be Shredded• Electronic Data Not Easily Deleted

5. e-HIM® Environment • e-HIM® May Be Incomprehensible When Separated From its Environment

• Legacy Systems and Migration of e-HIM® -- Differs Significantly From Imaging

6. Search and Retrieval of Electronic Data

• e-HIM® May Reside in Numerous Locations • Paper Documents Consolidated and Maintained in Single File Folder• e-HIM® Environment May Obscure Origin, Completeness or Accuracy of

Information

The Differences Between Paper Discovery and E-Discovery Process Require That HIM and IT Professionals Work with Legal Counsel Early in Litigation. 21

The Event

• Event Date: August 1, 2004• Discovery Date: April 1, 2007• Event: Patient received brain

damage from a respiratory event• Patient was on a Med-Surg unit• Patient had pain medications• Patient was a minor

22




The Allegation

• Your nurses were undertrained• Your MedSurg unit was understaffed• You did not follow your own policies

and protocols• You failed to notice a patient on pain

medications in a deteriorating condition

23

The Request for Production

• All training records for the nurses• All staffing records for the week before and

after the incident• All protocols for giving and monitoring pain

medications• All medical records for this patient• All e-mails of nurses, risk management,

quality management, treating doctors, concerning this patient and/or the use of pain medications

24





• All documents generated by any root cause analysis committee or sentinel event committee (privilege may be claimed here)

• All billing records for the event and any subsequent care

• All credentialing files for the doctors involved in the care

• All employment files for the nurses and staff involved

25


• All pharmacy records for this patient• All incident reports for this event• All protocols for reporting medication

errors or adverse reactions• All adverse reaction reports or medication

error reports or reports to the FDA for the medications utilized in similar manner as with this patient

• All records from any other cases similar to this case

26




Implications of the Duty to Preserve and Produce

• The duty applies to both hard copy and electronically stored information (ESI)

• There must be people who are knowledgeable about –• Retention requirements• Back ups, system authenticity, record

tracking, application of legal holds• Preservation Notice documentation

management

27

Implications of the Duty to Preserve and Produce

• What information is “reasonably accessible” and what is not and the cost implications of electronic record production

• The ability to produce information in the same form as it existed at the time the ESI was created

• The development and documentation of “good faith” practices including data aberrations or losses documentation

28




What is a successful Electronic Discovery Response Plan?

• It is built on the same foundation as a traditional discovery response• The same: analysis of the request,

gathering and processing the data, attorney review, and eventual production to the requesting party

• The difference: the technical expertise required to manage electronic discovery efficiently and effectively

• The need for a collaborative relationship on both legal and technical fronts

29

Electronic Discovery Response Plan

• The Scope of Electronic Discovery (Stage 1)• Who are the document/record owners and

likely key witnesses?• Who is knowledgeable about how and

where their electronic records are created, stored and destroyed?

• First Response: • Development of an organizational chart or

grid of all the people who may have created, received, or shared potentially relevant information on their computers

30





• The duty to interview, investigate and disclose potentially responsive electronic information

• The duty to act to preserve electronic information that may be subject to production• An analysis must be conducted to disclose to

opposing parties information including a description by category and location of documents and data compilations, i.e. a search must be conducted of electronic systems for relevant information (McPeek v. Ashcroft)

31


• The Gathering of Potentially Responsive Data (Stage 2)• The legal and technical teams must work

together to prepare a plan for efficient data gathering• When you know the “Who” in terms of data

ownership, you can use your technical team to map out the physical location of potentially responsive electronic documents

32





• When you know the data owners and the kind of data at issue, you will need to know:• Where does the data reside for what dates?

• Where is backup data stored? Where are documents saved on the network?

• Where are e-mail messages kept?• Is archive on local drives, removable media?• Must deleted files be recovered and

produced?• In what form must the data be produced?• Can existing IT staff handle the workload?

33


• Attorney review (Stage 3)• Enormous volume of data• How will it be sorted? Numbered?• What is privileged?• Is there an established review protocol

for electronic discovery?• How can we be certain nothing is

omitted or overlooked?• What will be the cost of production?

34




Challenge: Record Production with New Legal Requirements

• Subpoenas, search warrants, summons

• Class action suits that cross multiple organizational lines

• Requests for the content behind records: metadata, policies and procedures, process documentation

35

The Federal Rules of Civil Procedure: Security Implications

• Mapping of all known Data Sources for the Enterprise- “Where does all organizational content live?”

• Lifecycle record management - tying all content to a mandated organizational retention schedule

• Identification and affidavits regarding security & mapping of systems

36





• Software acquisition requirements• Decommissioning of systems -

“system retirement”• Where does the content live now?• On what media? Who manages it?

• Ability to apply “legal holds” on individual electronic records or groups of electronic records

37


• Record Production• The ability to supply the metadata for

records when record production is required• The ability to demonstrate “best practices”

in terms of data management and integrity• The ability to determine when electronic

records were destroyed compliant with a retention schedule

• If a failure to produce records is encountered, the organization must prove cost was prohibitive

38





• The ability to supply “good faith” process documentation -• Consistent measurements, practices and

expectations• How will the organization demonstrate that

the evidence from our computers has been properly preserved, authenticated and retrieved?

• How will the organization demonstrate that measures are taken to preserve documents/records when there is a duty to preserve? (Business Continuity, Disaster Preparedness)

39

The Management of Unconventional Records

• E-Mail• Categorization• Retention• Destruction• Documentation

• Capacity Management• Voice Management

40




Electronic records retention

• How long should e-mail be kept? What about e-mail server logs? Web server logs? Surveillance tapes? Voicemail messages? Etc. etc. etc.

• Consider how to keep data only as long as it is needed, and no longer, lest it become a liability

• How does this conflict with retention of electronic healthcare records for the life of the patient?

41

Records

• Electronic records must be seen in the context of all records (not just retention)• But records such as server logs often

flummox the traditional framework• Electronic records cannot be considered

independently as a paper chart was considered; they will be considered with all the processes and systems that participate in producing them

42




USA PATRIOT Act

• Amends more than fifteen statutes (including FERPA)

• Was intended in part to update wiretap and surveillance laws for the Internet era

43

Policy, procedures and practices

Do you know what to do if an FBIagent shows up with a search warrant

for a computer?

Does the HIM evening receptionist sitting at the front desk of the HIM department at 8PM on a Monday

evening know?

44




One Organization’s Response

45

Our Project Plan

• Leverage Existing Initiatives (Step 1):• Enterprise Records Management Structure

• Enterprise Content Management Initiative

• Information Technology Infrastructure Library Initiative (ITIL)

• Policy Standards Committee Work

• HIPAA Security Work

• Legal Electronic Health Record Work

• Capacity Management Work

46




Legal SubcommitteeStrategies for Management of Electronic/Other Media Records

(Example: Litigation Hold on Records)

Policy SubcommitteePolicy Development for

Compliant RecordsManagement

(Example: Policy andProcedures for Litigation

Holds on Records)

Electronic RecordSubcommittee

Technical Solutions Developmentfor Electronic Records

Management and Retention(Example: Development of

Technical Support for LitigationHolds on Electronic Records)

CommunicationsSubcommittee

Dissemination of RecordsManagement Policy and

Procedures to the Organization(Example: Communication of

PHS Position, Policies andProcedures for Compliance

with a Litigation Hold)

Enterprise Records and RetentionManagement Committee Structure

Enterprise FormsCommittee

Strategies for Standardized FormsManagement

Clinical FormsManagement

Business FormsManagement

Electronic Health RecordPosition and Policy

Oversight Committee

EMPI PolicyDevelopment

StandardsDocumentation

Master DataManagement

Enterprise Data ModelCreation andManagement

FunctionalRedesign

Structured DataManagement

47

Enterprise Records Management Committee

• All records of any type on any media from anywhere in the organization• Establishment of enterprise records policy• Development of a comprehensive retention

schedule• Four subcommittees – Legal, Policy

Development and Management, Electronic (technical) Records, Communications

• Recent consideration of Enterprise Forms Management as reporting through this structure

48





• Developing into a structure for electronic discovery and for policy development

• Changing the retention schedule to allow for links to data concerning the application, source, server, history, data ownership, etc.

• Development of Master Taxonomy • Development of an interface with

accreditation and reporting requirements• JCAHO, NCQA, FRCP, CMS, Baldrige,

HIPAA

49


RECORD RECORD SUB RECORD TITLE PHS Record Source Legal Citation Reference

Notes

CATEGORY SUB CATEGORY TYPE Retention Period in

Years

CLINICAL HEALTH INFORMATION MANAGEMENT

PRIMARY MEDICAL RECORDS

Patient Charts 10/21 Links to the following systems:

NM 14-6-2 10 for adults; 21 years for minors from the last encounter

ADMINISTRATIVE PATIENT REGISTRATION

MANAGEMENT Policies and Procedures


MANAGEMENT Employee Records Active


LETTERS Medicare 7 These are copies of Patients’ Rights letters with notes. Originals are sent to the patients chart in Health Information Services.


PROFILES Insurance Verification 1 These records are kept on-site

50





H o r iz o n C lin ic a lsa n d M e d M a n a g e r

Y e a rs : 2 0 0 5 & 2 0 0 6

S o ftM e d

Y e a rs : 2 0 0 5 - 2 0 0 6

T a m tro n P a th o lo g y

Y e a rs : 1 9 9 8 - 2 0 0 6

V e r is y s

Y e a rs : 1 9 9 9 - 2 0 0 6

M e d ip a c :

Y e a rs : 1 9 9 5 - 2 0 0 6

R e te n tio n o f th e L e g a l E le c tro n ic M e d ic a l R e c o rd :A d u lts = 1 0 y e a rsM in o rs = 2 1 y e a rs

S A M P L E

A rc h iv e = P a p e r

Y e a rs = 1 9 9 5 to2 0 0 5

A rc h iv e = O p t ic a lD is k

Y e a rs = 2 0 0 0 -2 0 0 5

A rc h iv e = C D

Y e a rs = 1 9 9 5 -1 9 9 8

A rc h iv e = T a p e

Y e a rs = 1 9 9 2 -1 9 9 9

A rc h iv e = T a p e

Y e a rs = 1 9 9 1 -1 9 9 5

A rc h iv e = M ic ro f ilm

Y e a rs = 1 9 8 5 - 1 9 9 4

51

ERMC Legal Subcommittee – the de facto E-Discovery Team

• This group comprising the Risk Management attorney, the Privacy Officer (attorney), the Compliance Analyst, the Security Manager, the Data Center Manager, the Enterprise HIM Director, a Clinical Informatics representative (development of the EHR), the health plan Policy & Procedure administrator, one of the contract administrators, the health plan Process Analyst and the Enterprise Records Manager has become the first attempt at establishment of an E-Discovery Team

52




ERMC Legal Subcommittee – the de facto E-Discovery Team

• Initiatives:• Development of a policy and template for

decommissioning legacy systems while still accounting for the migration of data

• Development of an IT contract model for commissioning future applications with e-discovery in mind

• Development of recommendations for the retirement of failing hardware

• Development of definitions, policy and procedures for the accounting of damaged, inaccessible or lost records 53

Data Loss Definitions

Lost Record/Data: A “lost” record means any record or data set that cannot be located in the expected or anticipated data source or location (written or electronic) using the usual and customary search methods currently available in the organization and without utilizing any “forensic retrieval”. Currently Inaccessible Record/Data: A “currently inaccessible” record is any record or data set that cannot be restored to a readable format that is substantially the same as the format in which the data was originally recorded or where the unique data within the record cannot be extracted in any readable format using the usual and customary methods currently available in the organization, and without utilizing any “forensic retrieval”.

54




Data Loss Definitions• Forensic Retrieval:

“Forensic retrieval” is the use of specialized resources, outside the usual and customary methods currently available, either internal or external,to retrieve or restore otherwise “lost” or “currently inaccessible”records/data for the purpose of locating, extracting or recreating a record or data to a format that is either readable or substantially similar to the format in which the record or data was originally recorded.

• Irrecoverable Record/Data:An “irrecoverable” record or data set is a record that is believed to have existed but that cannot be located or restored to a format substantially similar to the format in which the record or data set was originally collected, or any record or data set where the unique data within the record cannot be extracted or located through any means, including through the use of “forensic retrieval”.

• Data:Data are the collection of elements on a given subject; the raw facts and figures expressed in text, numbers symbols, and images; facts, ideas, or concepts that can be captured, communicated, and processed either manually or electronically. The word data is plural and is used whenever more than one data element is described. Datum appropriately describes a single data element. Records and non-records are considered to be subsets of data.

55

ERMC Policy Subcommittee

• Chaired by the Compliance Analyst who also chairs the organization’s Policy Standards Committee• Policy development required by

electronic discovery• Policy standardization system-wide

56




ERMC Policy Subcommittee

57

ERMC Electronic Record Subcommittee

• EMPI and EMMI coordination• Capacity Management

• Images• Voice Messaging• E-Mail Management

58




ERMC Communications Subcommittee

• Development of the RAT• Records Awareness Tutorial

• Management of the Enterprise Records Management Website

• Publication in the Pulse electronic newsletter of updates to retention practices, training sessions, etc.

59

Enterprise Content Management Initiative

Structured Content

UnstructuredInformation

ECM Repository

RecordsManagement:Create, Use,

Maintain,Preserve, Destroy

RecordsProduction:

Search, Hold,Preserve

e-MailManageme

nt:Intercept,Classify,

Store,Retrieve

Business ProcessManagement:

Imaging, eForms,Workflow

Content Management:Unstructured Web &

Document Management

Performance Monitoring:Risk & Controls Monitoring

EnterpriseReport

Management:Classify, Store

& Retrieve

DigitalRightsMgmt:Digital

Signature& Access

Rights

StorageManagement:

SingleInstance Store,Non-erasable

Media

Collaboration:Work Group and

KnowledgeSharing

Adapted from a slide presented by KPMG for a Stellent Records Management audio seminar 60




Master Taxonomy

• Naming convention• Retention Schedule• Enterprise Content

• Creation of the Electronic Library for unstructured content

• Development of the ability to version• Development of workflows to manage

things like versions of Order Sets• Introduction of mass scanning projects

whose content will be auto indexed

61

Content Management Taxonomy

62




Content Management Taxonomy

63

Content types

64




Information Technology Infrastructure Library

65

Information Technology Infrastructure Library

• Development of a permanent Systems Inventory database • Application List completed – 447• Next steps

• Documentation of the records in each application, the server(s) on which the applications reside

• Documentation of retired applications and systems and the media on which they reside

• Documentation of the data/record business owner• Documentation of the application IT support • Documentation filed in the Content Management

system66




HIPAA Security Expansion

• Extension of the Security Incident Response Team’s role• Documentation of data incidents and losses• Audit trail management• Development of the ability to “hold” data in

each system in the Systems Inventory database (Configuration Management system)

• Management of the decommissioning of systems

67

HIPAA Security Expansion: Incident Response

• “When computer security problems occur, it is critical for the affected organization to have a fast and effective means of responding.”• “incident analysis and response, vulnerability

handling, intrusion detection, risk assessments, security consulting, and penetration testing.”

• Organizational Models for Computer Security Incident Response Teamswww.sei.cmu.edu/publications/documents/03.reports/03hb001.html

68




LEHR Defined: The Model

• Hybrid record definition • Definition of each source system• Definition of all the metadata in the

systems• Definition of the native formats of all

data/records in the LEHR• Disclosure Data Set – Clinical• Grid of Data Owners defined

69

Controlling the Cost of Electronic Discovery

• Implementation of Retention Management

• Develop early access/understanding of the possible scope of evidence

• Decrease storage costs through retention and capacity management

• Increase knowledge through the ability to find information more easily

70




e-HIM

Information Technology

Health InformationManagement

e-HIM

Records Management Records Management ProgramProgram

Information Management PlanInformation Management Plan

Regulatory ComplianceHIPAA

Financial JCAHO

Improves Safety & Quality

Healthcare

Reduces RecordsStorage & Management

Costs

PurchasersPayers

ConsumersPatientsFamilies

ProvidersRegulators

Improves Productivity&

Efficiency

Preserves Health and Business

Records Legal EHR Defined

Establishes Controls For Creation, Formats,

VolumeLocation of Information

InformationAccessible,

Timely & Relevant

© KimBaldwinStried

The Management of e-HIM®

71

A bigger picture

• Can’t look at this piecemeal – will overwhelm you

72




Collaboration will be the key to success

Legal

Risk Management


Health InformationManagement

Effective E-Discovery Involves An Integrated & Collaborative Approach To The Management of E-HIM®

EDiscovery

©KimBaldwin-Stried 73

Contact Information

Kim Baldwin-Stried ReichHealthcare E-Discovery & Compliance Consultant KBS Consulting3431 Buena RoadHighland Park, IL 60035847-477-5011 (Mobile)847-360-2883 (Office) [email protected]

Sandra NunnEnterprise Content & Information ManagerPresbyterian Healthcare ServicesAlbuquerque, NM505-923-5117 (Office) [email protected]@phs.org

74




Audience Questions

HIM, IT, Legal and Risk Management ProfessionalsNow Have A Unique Opportunity To Define and Shape

E-Discovery Processes Within Their States and Organizations

AHIMA ResourcesAHIMA Practice Briefs

• Defining and Disclosing the Designated Record Set and the Legal Health Record • April 2008 Practice Brief –Journal of AHIMA (www.Ahima.org)

• Litigation Response Planning and Policies for E-Discovery• February 2008 Practice Brief -Journal of AHIMA (www.Ahima.org)

• Developing a Legal Health Record Policy • October 2007 Practice Brief – Journal of AHIMA (www.Ahima.org)

• Guidelines for EHR Documentation to Prevent Fraud • January 2007 Practice Brief – Journal of AHIMA (www.Ahima.org)• The New Electronic Discovery Civil Rule

• September, 2006 Practice Brief – Journal of AHIMA (www.Ahima.org)AHIMA Publications

• How to Evaluate Electronic Health Record (EHR) Systems • The Legal Health Record • Health Information Management Compliance

• AHIMA Articles• Litigation Response Planning

• October 2007, Journal of AHIMA• E-Discovery and HIM: How Amendments to the Federal Rules of Civil

Procedure Will Affect HIM Professionals - October, 2006 – Journal of AHIMA




Other Resources• American National Standards Institute (ANSI)

• http://www.ansi.org/• Department of Health and Human Services (HHS)

Health Information Technology/Office of National Coordinator • http://www.hhs.gov/healthit/

• Centers for Medicare and Medicaid (CMS)HIPAA General Information • http://www.cms.hhs.gov/HIPAAGenInfo/

• International Organization for Standardization (ISO Standards) • http://www.iso.org/iso/about.htm

• HL7 – Electronic Health Record • http://www.hl7.org/ehr/HL7 – EHR-S Registry

http://xreg2.nist.gov:8080/ehrsRegistry/• Certification Commission for Healthcare Information Technology (CCHIT)

• http://www.cchit.org/ambulatory/criteria/• The Sedona Conference®

• http://www.thesedonaconference.org/

Audio Seminar Discussion

Following today’s live seminarAvailable to AHIMA members at

www.AHIMA.orgClick on Communities of Practice (CoP) – icon on top right

AHIMA Member ID number and password required – for members only

Join the e-HIM Community from your Personal Page under Community Discussions, choose the Audio Seminar Forum

You will be able to:• Discuss seminar topics • Network with other AHIMA members • Enhance your learning experience




AHIMA Audio Seminars/Webinars

Visit our Web site http://campus.AHIMA.orgfor information on the 2008 seminar schedule. While online, you can also register for seminars or order CDs and pre-recorded Webcasts of past seminars.

Upcoming Seminars/Webinars

Release of Information: The Nuts and BoltsJune 24, 2008

The Legal Health Record: The Legal Hold ProcessAugust 12, 2008

Defining TPO: Are You Stretching the Privacy Rule Limits? September 23, 2008




Thank you for joining us today!Remember − sign on to the

AHIMA Audio Seminars Web site to complete your evaluation form

and receive your CE Certificate online at:

http://campus.ahima.org/audio/2008seminars.html

Each person seeking CE credit must complete the sign-in form and evaluation in order to view and

print their CE certificate

Certificates will be awarded forAHIMA Continuing Education Credit

Appendix


FRCP Amendments ..........................................................................................43-53 CE Certificate Instructions

Rule Title Legal Process HIM & IT

16(b)(5)&(6)

Pretrial Conference; Scheduling

Management

Parties must meet and confer regarding matters related to discovery of electronically stored information (ESI) The intent of 16(b) is to alert the court to possible need to address the handling of the discovery of ESI

HIM and IT Professionals may be called upon by legal

counsel to help prepare for or attend a pre-trial meet and

confer session to advise on matters

related to the retention, storage

and location of potentially responsive and/or relevant data.

FRCP Amendments

Federal Rules of Civil Procedure – US District Courts

Rule Title Legal Process HIM & IT26(a) General

Provisions Governing

Discovery; Duty of Disclosure;

Required Disclosures; Methods to Discover

Additional Matter

ESI has same broad meaning in 26(a)(1) as in Rule 34(a).

Rule 26(a)(1)(B) was amended to parallel Rule

34(a) by recognizing that a party must disclose ESI as well as documents that it

may use to support its claims and defenses

Any/all relevant ESI is discoverable and must

be preserved and disclosed in the face of

impending or threatened litigation.

In the HIM Department Release of

Information (ROI) function a distinction

must be made between the

"disclosure" of e-HIM®

vs. the "discovery" of

e-HIM®.

FRCP Amendments



26(b)(2)

(B)

General Provisions Governing Discovery;

Duty of Disclosure; Discovery Scope and

Limits; Limitations

If a party can sufficiently demonstrate that certain electronically stored information is “not reasonably

accessible” because of undue burden or cost, that party may not be required to produce that information. Court may

order discovery from that party if, after considering the limitations of Rule

26(b)(2)(C) (the burden of production outweighs the benefit) it determines that the requesting party has shown good cause. Rule 26 also contains

provisions for cost-shifting, also that responding party must also identify with sufficient detail the sources of potentially responsive information that it is neither

searching or producing.

HIM and IT Professionals should identify the locations and sources of ESI

within the organization, including and

assessment of the forms and format in

which e-HIM® is maintained and what legacy systems are in place. An analysis of

the of the true costs to access, search and

retrieve ESI within the organization should be

undertaken.

FRCP Amendments



26(b)(5)

(B)

General Provisions Governing Discovery;

Duty of Disclosure; Discovery Scope and

Limits; Claims of

Privilege or Protection of

Trial-Preparation Materials;

Information Produced.

Protection of privileged information or protection as trial preparation material. This rule provides for

“claw back” agreements over production of ESI. If receiving party discloses the privileged information

prior to being notified of the claim, it must take reasonable steps to

retrieve it. The producing party is also required to preserve the

information until the claim is resolved. This rule works together with

amended Rule 26(f) which now directs parties to discuss privilege

issues when preparing their discovery plans. Any such agreements could be

made part of a court order via amended Rule 16(b).

HIM and IT should establish internal

procedures, controls & filters to assist legal counsel in its review and screening of information of privileged information. HIPAA privacy and security and attorney client privilege should be

discussed early on in litigation and agreements

reached between the parties should be

documented and made part of a discovery plan.


FRCP Amendments


26(f)(3)&(4)

General Provisions Governing Discovery; Duty of Disclosure; Conference of Parties; Planning for Discovery

Meet and Confer Conference Rule which provides that during pretrial conferences, parties shall discuss case-specific issues including the preservation of discoverable information and the disclosure or discovery of ESI. Discussions must include the form ESI should be produced as well as any issues relating to the claims of privilege or of protection as trial-preparation material. Rule provides for parties to enter into "quick peek" agreements to minimize risk of waiver of privilege. A requesting party may designate the specific evidence it wishes to have produced pursuant to Rule 34.

HIM and IT professionals should meet and discuss with legal counsel early in

litigation to plan for e-discovery. HIM and IT

should advise legal counsel as to the forms, formats and locations of any/all

potentially relevant and/or responsive information.

HIM & IT should also seek guidance from legal about preservation obligations,

and establishing legal holds over potentially responsive

information.


FRCP Amendments

Rule Title Legal Process HIM & IT33(d) Inter-

rogatoriesto Parties; Option to Produce Business Records

This rule was amended and allows a party responding to an

interrogatory to specify the electronic records from which the

answer may be derived, if the burden of deriving the answer is substantially the same for the responding party as for the

requesting party. The responding party to an interrogatory must

also provide the requesting party with a reasonable opportunity to

examine, copy, audit, test or inspect such records.

HIM and IT professionals should seek direction from

legal as to organizational policy

and practice as to how to document and

describe in writing the answers which

specify the electronic records in which the

answer is based.


FRCP Amendments

Rule Title Legal Process HIM & IT34(a)&

(b)Production of Documents, Electronic-ally Stored Information, & Things and Entry Upon Land for Inspection and Other Purposes.

Provision permits party requesting production of documents including ESI to also inspect, copy, test or sample such information. The responding party must translate the information, if necessary, into reasonably usable form. Production requests should specify the form in which the ESI is to be produced. Producing party may object to the requested form for production if it provides the reason for the objection and the form it intends to use instead. If a request does not specify the form for ESI -- it is incumbent upon the responding party to produce the information in a form or forms which are “reasonably usable” or in which the information is “ordinarily maintained.” A party need not produce the same electronically stored information in more than one form.

ESI placed on equal footing as paper.

Rule allows for the inspection, copying,

testing and/or sampling of ESI.

Provisions should be in place for ESI to be

converted into reasonably usable form/format. ESI

does not to be produced in more than one form.

FRCP Amendments



37 (f) Failure to Make

Disclosures or Cooperate in Discovery;

Sanctions; ESI

“Safe Harbor” rule. Absent exceptional circumstances, the court is restricted from

imposing sanctions under these rules on a party for the non-culpable act of failing to provide

electronically stored information that was lost as a result of the “routine, good faith operation of an

electronic information system” -- i.e. the information system operated in the ways in which

the system was designed, programmed and implemented to meet the party’s technical and business needs. The court will examine party’s compliance with litigation holds and preservation

orders. The court will also analyze steps the party took to comply with a court order or party agreement requiring preservation. The court will

consider whether the party reasonably believed the information available on these electronic sources was likely to be discoverable and not otherwise

reasonably available.

If called upon to testify as a

30(b)(6) witness - HIM

and IT professionals,

must be able to describe the "good faith

operations" of the

organization's information systems.


FRCP Amendments


45 Subpoena; Form;

Issuance

Permits inspection, copying, testing or sampling of things such as ESI and may specify the form or forms or

production of ESI. As in Rule 26(b)(2)(B), if a party sufficiently demonstrates that certain ESI is not

reasonably accessible because of undue burden or cost, the party may not be required to produce that

information. A court may order discovery from that party if, after considering the limitations of Rule 26(b)(2)(C)

(burden of production outweighs benefit) and good cause is shown. The court may add conditions to a discovery

order. Like Rule 26(b)(5)(B), if information is produced in response to subpoena, is later subject to a claim of

privilege or protection as trial preparation material, party receiving this information must promptly return, sequester or destroy the specified information and must not use or disclose the information until the claim is resolved. As in Rule 34, if a subpoena does not specify the form or forms for producing ESI, the responding party will be required to

produce the information in a form or forms which are “reasonably usable” or in which the person “ordinarily

maintains it.” A party need not produce the same ESI in more than one form.

Objections to Rule 45 subpoenas must be

occur within 14 days of

receipt. HIM, IT and legal should establish a process to assess the true costs

and burdens to search,

retrieve, cull and produce

ESI from current and

legacy systems


FRCP Amendments

Subpoenas – Federal RulesFRCP Rule 45 – Subpoena

Every federal subpoena must:(i) State the court from which it issued; (ii) State the title of the action, the court in which it is pending, and its civil-action number; (iii) command each person to whom it is directed to do the following at a specified time and place: attend and testify; produce designated documents, electronically stored information, or tangible things in that person's possession, custody, or control; or permit the inspection of premises; and (iv) (D) Command to Produce; Included Obligations.A command in a subpoena to produce documents, electronically stored information, or tangible things requires the responding party to permit inspection, copying, testing, or sampling of the materials.Notice must be issued to non-parties too.

Rule Title Legal Process HIM & ITForm 35

Report of Parties’Planning Meeting; Discovery

Plan

A legal form to be completed post the parties pre-trial meet and confer session and includes the requirement for a brief description of the

parties' proposals on handling the disclosure or discovery of electronically stored information,

as well as the provisions of any proposed order reflecting the agreement of the parties on post-production claims or waivers of privilege or of

protection as trial-preparation material.

Legal Counsel should seek input from HIM and IT

professionals about the availability and accessibility of ESI prior to a discovery planning meeting.. The discovery plan (Form 35) should

be shared and discussed with HIM

and IT by legal counsel. The Release of

Information (ROI) within HIM is projected to

change.


FRCP Amendments

To receive your

CE Certificate

Please go to the AHIMA Web site

http://campus.ahima.org/audio/2008seminars.html click on the link to

“Sign In and Complete Online Evaluation” listed for this webinar.

You will be automatically linked to the

CE certificate for this webinar after completing the evaluation.

Each participant expecting to receive continuing education credit must complete the online evaluation and sign-in information after the webinar, in order to view

and print the CE certificate.

Date post:	02-Jul-2018
Category:	Documents
Upload:	hoangdung
View:	215 times
Download:	0 times