HIPAA – Are you ready for an audit?

HIPAA (the Health Insurance Portability and Accountability Act) is well known to all health care providers, as it governs the privacy of patient information, among other things. The basic parameters of the Privacy Rule should be known to all providers who handle protected health information.

The Office of Civil Rights for the U.S. Department of Health and Human Services (“OCR”) has launched a new audit initiative to make sure that health care providers are complying with HIPAA. Concerning its initiative, OCR says, “OCR’s audits will enhance industry awareness of compliance obligations and enable OCR to better target technical assistance regarding problems identified through the audits.” Providers would be well advised to ensure that they are ready for a HIPAA audit and are in full compliance with the Privacy Rule.

D.C. Circuit Upholds Privilege for Internal Compliance Investigations

A recent decision reaffirming that the attorney-client privilege applies to internal compliance investigations should be of interest to health care providers. In In re: Kellogg Brown & Root, Inc., No. 14-5055 (June 27, 2014), the U.S. Court of Appeals for the District of Columbia vacated a trial court order requiring a company to produce its internal investigation documents, which the company claimed were protected by the attorney-client privilege. This decision provides a timely reminder that health care clients should revisit their corporate compliance program requirements and policies to protect compliance activities covered by the attorney-client privilege.

In rejecting the lower court’s ruling that the company’s compliance investigation was not protected by the attorney-client privilege, the court’s discussion of the attorney-client privilege is of interest to any company that conducts internal investigations.

    1. An attorney’s status as in-house counsel does not dilute the attorney-client privilege. The appeals court rejected the lower court’s reasoning that outside counsel must be involved in an internal investigation before the attorney-client privilege applies. Thus, the appeals court concluded that the attorney-client privilege can apply when an internal investigation is conducted by in-house attorneys without consulting outside counsel.
    2. Investigations conducted by non-attorneys at the direction of attorneys can be protected by the attorney-client privilege. The appeals court noted that the investigation in this case was conducted at the direction of attorneys in the corporation’s legal department and that communications made by and to non-attorneys serving as agents of attorneys in internal investigations are routinely protected by the attorney-client privilege.
    3. A company is not required to use “magic words” to protect the investigation under the attorney-client privilege. The lower court ruled that the privilege did not protect the internal investigation because the employees were not informed that the purpose of the interview was to assist the company in obtaining legal advice. The appeals court rejected this reasoning, clarifying that a company is not required to use specific words to gain the benefit of the privilege. The appeals court also noted that in this case the employees knew the company’s legal department was conducting a sensitive investigation; that the information employees disclosed would be protected; and that the employees were told not to discuss their interviews without the general counsel’s advance, direct authorization.
    4. An internal investigation made in compliance with federal regulations does not mean that the investigation was for a business purpose rather than to obtain or provide legal advice.  The appeals court emphasized that the attorney-client privilege applies if obtaining or providing legal advice was one of the significant purposes of the internal investigation, even if there were other purposes for the investigation, the investigation was mandated by regulation, and the investigation did not occur at the company’s discretion.  Thus, as long as one of the significant purposes of the internal investigation was to obtain or provide legal advice, the attorney-client privilege applies even if the internal investigation was conducted pursuant to a company compliance program required by statute or regulation, or was conducted pursuant to company policy.

This decision is an important development for health care providers that have compliance programs and conduct internal investigations.  However, health care providers should review their internal investigation processes to ensure that any internal investigation will be protected by the attorney-client privilege.  Among the issues that health care providers should address include the following.

    • Review policies and procedures to make sure that they explain the process for conducting internal investigations that are covered by the attorney-client privilege, including a statement that these investigations are for the purpose of obtaining or providing legal advice.
    • Contact counsel, whether in-house or external, promptly when it becomes necessary to conduct an internal investigation.
    • Attorneys should direct the investigation.
    • Document that an attorney is involved in the investigation for the purpose of obtaining or providing legal advice.
    • While there are no “magic words” required to protect an investigation under the attorney-client privilege, all employees who are interviewed should be informed that the company is conducting an investigation to gather facts for the purpose of providing or obtaining legal advice, that the information discussed in the investigation should remain confidential, that the attorney represents the company, and that the conversation is protected by the attorney-client privilege.
    • Counsel should be included in communications, including e-mails and phone calls.
    • Documents should be marked to indicate that they are privileged attorney-client communications.