Workplace Privacy, Data Management & Security Report : Privacy Lawyers & Attorneys : Jackson Lewis Law Firm : Data Security, HIPAA & Confidentiality Issues

Indiana recently enacted a new law which grants authority to the Indiana Office of the Attorney General's Identity Theft Unit to obtain and secure abandoned records with personally identifying information, including health records, and either destroy them or return them to their owners. Additionally, the new law sets fines and other legal ramifications for violations of the law by health care providers or licensed professionals who leave such records unsecured in violation of state law. In fact, the Attorney General has already utilized this authority to obtain personal records from four entities. 

This additional grant of authority to the Indiana Attorney General, is in addition to the authority previously granted by the Health Information Technology for Economic and Clinical Health (HITECH) Act to enforce the privacy and security protections of HIPAA for protected health information. As we have previously discussed, the Connecticut Attorney General has filed a civil action against Health Net, as well as instituted an investigation against Griffin Hospital for violations of HIPAA. 

The Indiana statute, as with the authority granted to Attorney Generals under HITECH, highlight the need for companies to develop and implement comprehensive data security polices to secure their records. 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The Supreme Court today issued its decision in City of Ontario, California v. Quon.  In a unanimous decision, the Court held that the search of Quon's text messages, sent or received on his department issued pager, was reasonable and did not violate Quon's Fourth Amendment rights. 

As set forth in the opinion, the Court did not resolve the parties disagreement over Quon's privacy expectations, and instead disposed the case on the narrower grounds of the reasonableness of the search.  While the Court chose not to utilize the facts of this case to establish far-reaching premises that define the existence, and extent, of privacy expectations of employees using employer-provided communication devices, the Court did note that 

Employer policies concerning communications will of course shape the reasonable expectations of their employees, especially to the extent that such policies are clearly communicated.

Click here for a more in depth analysis of the decision. See our previous posts on Quon, here and here. 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Keystroke logging (or “keylogging”) is the noting (or logging) of the keys struck on a computer keyboard. Typically, this is done secretly, so  the keyboard user is unaware his activities are being monitored.

Several cases throughout the country have examined an employer’s use of keylogging.  Recently, the Criminal Court of the City of New York held in New York v. Klapper  that an employer who installed keylogging software on office computers and subsequently monitored an employee's e-mail activity did not, absent some showing of contrary e-mail protections or acceptable use policies, access a computer “without authorization” in violation of New York law. 

In some of the strongest language against the premise of e-mail privacy to date, the Court stated in its April 28, 2010 opinion:

[t]he concept of internet privacy is a fallacy upon which no one should rely. It is today’s reality that a reasonable expectation of internet privacy is lost, upon your affirmative keystroke. 

The Court found that e-mails are more akin to a postcard than a letter, as they are less secure and can easily be viewed by a passerby. An employee who sends an e-mail from a work computer sends a communication that will travel through the employer's central computer and will be commonly stored on the employer's server even after it is received and read. Once stored on the server, the employer can easily scan or read all stored e-mails or data. The same holds true once the e-mail reaches its destination, as it travels through the Internet via an Internet service provider. Accordingly, this process diminishes an individual's expectation of privacy in e-mail communications.

In contrast to the strong language from New York, the U.S. District Court for the Northern District of California ruled in Brahmana v. Lembo that a plaintiff could proceed to trial in his case alleging his employer committed an impermissible “interception” under the Electronic Communications Privacy Act (ECPA) by using keylogging to discover the password to his personal e-mail account, and using the logged password, accessed his personal e-mail.  However, another California District Court found in United States v. Ropp that because the keylogger recorded the keystroke information in transit between the keyboard and the CPU, the system transmitting the information did not affect interstate commerce as the required by the ECPA.  Further complicating the issue, a federal court in Ohio questioned Ropp, suggesting in Porter v. Havlicek that it read the statute too narrowly by requiring the communication to be traveling in interstate commerce as opposed to merely “affecting interstate commerce.”

Because of the numerous issues arising from the use of electronic communications, and the varying court opinions on these questions, employers would do well to reexamine their use of keystroke monitoring or logging technology on a regular basis.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

We are honored that the National Association of Professional Employer Organizations (NAPEO), the largest national trade association for professional employer organizations (PEOs), recently published our article in its May 2010 edition of its PEO Insider publication, an important resource for any PEO.  

PEOs no doubt provide valuable services for businesses across the country. However, in doing so, they generally have access to and maintain vast amounts of personal information. Our article, "Key Data Privacy and Security Issues for PEOs," summarizes emerging data privacy and security laws and their effects on PEOs.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

As highlighted by many news sources, including CNN.com and MSNBC.com, the United States Supreme Court listened to oral argument (pdf) today in the case of City of Ontario v. Quon today. This is the case involving a police officer who claimed his employer violated his privacy when it read the personal text messages (which happened to be sexually explicit in nature) which he sent and received using his department issued pager.  For further information concerning this case, see our prior analysis, as well as the discussion at Inc.com. Stay tuned for an update following the Supreme Court's decision. 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Co-author: Joseph J. Lazzarotti

The New Jersey’s highest Court has concluded that an employee, Marina Stengart, could reasonably expect that e-mail communication with her lawyer through her personal, password-protected, web-based e-mail account would remain private, and that sending and receiving them using a company laptop did not eliminate the attorney-client privilege that protected them. The Court went on to say that her employer’s counsel had violated the rules of professional conduct by reading her e-mails. The Supreme Court decided Stengart v. Loving Care on March 30, 2010 upholding the June 2009 decision of the state Appellate Division. 

This case makes two important points for employers: 

1) The Court stated that even a more clearly written and unambiguous policy regarding employer monitoring of emails would not be enforceable. That is, a clear policy stating that the employer could retrieve and read an employee’s attorney-client communication, accessed through a personal, password-protected e-mail account using the company’s computer system will not overcome an employee’s expectation of privacy and the privilege would remain. 

2) The Court's opinion seems to suggest that employers cannot discipline employees for simply spending some time at work receiving personal, confidential legal advice from a private lawyer, although the Court noted that an employee who “spends long stretches of the workday” doing so may be disciplined. 

Loving Care's employee handbook’s “Electronic Communication” policy governed employees’ use of company computers. The policy stated, among other things, “internet use and communication … are considered part of the company’s business” and “such communication are not to be considered private or personal to any individual employee.” However, the policy also provided, “[o]ccasional personal use is permitted.”

The Court found the Policy does not give express notice to employees that messages exchanged on a personal, password-protected, web-based e-mail account are subject to monitoring if company equipment is used. Although the Policy states that the company may review matters on “the company’s media systems and services,” those terms are not defined. The prohibition of certain uses of “the e-mail system” appears to refer to a company e-mail account, not personal accounts. Similarly, the Policy does not warn that the contents of personal, web-based e-mails are stored on a hard drive and can be forensically retrieved and read. The Court also found the Policy creates ambiguity by declaring that e-mails “are not to be considered private or personal,” while also permitting “occasional personal use” of e-mail.

The Court determined that an employee’s reasonable expectation of privacy in a particular work setting must be addressed on a case-by-case basis, but stated that by using a personal e-mail account and not saving the password, Stengart had a subjectively reasonable expectation of privacy in the e-mails exchanged with her attorney on her personal, password-protected, web-based e-mail account, which was accessed on a company laptop. This subjective expectation of privacy was objectively reasonable in light of the ambiguous language of the Policy and the attorney-client nature of the communication.

This decision, and others highlighted previously in this blog, present numerous issues for employers.  While it may not be enforceable in New Jersey, we recommend, in light of the reasoning in this decision, that employers consider modifying their existing electronic communication policies to include:

• Clear notice that personal, web-based emails accessed using company networks and stored on company networks or company computers can be monitored and reviewed by the company (of course, care should be taken here to avoid concerns under the Electronic Communications Privacy Act and the Stored Communications Act);
• Definitions of the specific technologies and devices to which the policies apply;
• Warnings that web-based, personal e-mail can be stored on the hard-drive of a computer and forensically accessed;
• No ambiguities about personal use. 

See our sample electronic communication policy outline for more information. However, even with such a policy in place, employers and their lawyers must be aware of the potential liability they face for improperly accessing information on the employers' systems which may later be deemed “private” or subject to a privilege.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Co-authored by Jason Gavejian

Employees’ increasing sensitivity to data privacy and security, and widely accepted public policy to protect personal data maintained by businesses, require employers to respond meaningfully to employee data privacy and security complaints or risk whistle blower claims of retaliation.

The U.S. District Court for the District of New Jersey recently held that an employee who voiced concerns regarding his employer’s handling of data security before he was fired may proceed to trial under the New Jersey Conscientious Employee Protection Act (“CEPA”) on the ground that he was engaged in protected whistle blowing activity under CEPA. This is one of the first decisions linking a NJ CEPA or similar claim and data security concerns, and is in line with increased efforts by both the federal and state governments to protect employee data. 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

New mobile phone technology may allow employers to track very precise movements and activities of employees, such as walking, climbing stairs or even cleaning. As reported by Michael Fitzpatrick of BBC News, the technology developed by KDDI Corporation, a Japanese company, “works by analyzing the movement of accelerometers, found in many handsets.” This enhanced level of monitoring likely will raise serious concerns for courts seeking to balance an employer’s legitimate need to monitor employees with an employee’s expectation of privacy.

To get a sense of how sensitive this technology is, Mr. Fitzpatrick notes that a KDDI mobile phone

strapped to a cleaning worker's waist can tell the difference between actions performed such as scrubbing, sweeping, walking and even emptying a rubbish bin.

Employers should proceed with caution. There certainly are legitimate business reasons for gathering and analyzing this kind of data:

• Improving customer service
• Enhancing employee productivity
• Identifying safety concerns and rectifying them
• Ensuring employees are performing only assigned tasks
• Confirming employees are working when they say that they are

At the same time, significant concerns about the technology and how it is implemented, together with the potential for unintended consequences, should motivate employers to think carefully before using this equipment:

• Does the technology really work as advertised?
• Can employees manipulate the “accelerometers,” creating false positives for employers?
• When should/must employers turn the monitoring off?
• Will effects will data capable of showing the time, date and duration of certain activities have in the areas of wage and hour law, collective bargaining, classification of workers as employees versus independent contractors, workers’ compensation, administration of leaves of absence, and so on?
• Will data collected constitute personal information to be safeguarded and retained?
• Will employers be required to produce information collected through these mobile phones in unrelated litigation, such as where an employee’s spouse seeking to prove claims of adultery in a divorce action seeks “phone” records to show the location and activity of the employee-spouse?
• Some states already have laws dealing with electronic monitoring, but it is unclear how those laws will apply to this new technology. For example, a Connecticut statute prohibits employers from recording or monitoring the activities of employees in areas designed for the health or personal comfort of the employees or for safeguarding of their possessions, such as rest rooms, locker rooms or lounges operating.  When Connecticut employers perform permissible electronic monitoring on their premises, they must provide employees with prior written notice. 

However, if these phones work as intended, the level of intrusiveness likely will spur opposition by privacy advocates and additional legislation. It also is possible that the U.S. Supreme Court’s decision in City of Ontario, Ontario Police Department, and Lloyd Scharf v. Jeff Quon, et al., currently before the Court, will provide guidance for employers and lower courts as they consider the effects new technologies have on workplace privacy issues. In that case, one issue the Court is considering is whether a California police department violated the privacy of one of its officers when it read the personal text messages on his department issued pager.

There is no doubt technology will continue to advance and bring with it enhanced functionality and capabilities. While the law will try to keep pace, employers will be challenged to apply these technologies in ways that meet the demands of their business, while avoiding the pitfalls of law not yet clearly established.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Contributed by Lillian Chaves Moon

Based partially upon an interpretation of Florida law, in Global Policy Partners, LLC, et al. v. Yessin, 2009 U.S. Dist. LEXIS 112472 (Nov. 24, 2009), a Virginia district court has ruled that an LLC’s partner does not always have the authority to access a partner’s e-mails simply by virtue of his status in the company.

Katherine and Brent Yessin, husband and wife and business partners, were feuding as part of a messy divorce and business dissolution. Mrs. Yessin, on behalf of herself and the Florida business, brought suit against Mr. Yessin for his alleged illegal access of her personal e-mails, including those containing attorney-client communications in her divorce case, stored on the company’s server in violation of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. §1030(a), and other federal and state statutes. In a motion to dismiss his wife’s complaint, Mr. Yessin argued that under Florida law, as a manager/partner in his business, he had the authority to access all e-mails stored on the business’s computer server regardless of his reason for doing so. The court disagreed.

The court found that even assuming Florida law authorized managers to access e-mail information stored on a company’s computer system, authorization is limited to carrying out the company’s business. Likewise, under the CFAA, authorization to access a computer system may not simply be based on a person’s status within the organization, but whether the person is accessing information in accordance with the “expected norms or intended use” of the computer network. Because the scope of Mr. Yessin’s authority to access his wife’s e-mails depended upon a detailed factual inquiry into his purposes for doing so, Mr. Yessin’s motion to dismiss the CFAA counts of the complaint was denied and Mrs. Yessin was allowed to proceed in her action.

Caution for employers: This decision has implications for employers in how and why managers may access employee e-mails. While an employer generally has the right to review stored e-mails on the employer’s system, regardless of whether the e-mails are an employee’s personal or business communications, the employer or employer’s agent must have a legitimate business purpose for such review, not a nefarious reason. Note, however, that, some courts have limited an employer’s ability to review an employee’s e-mails in other situations, such as when the e-mail is subject to the attorney-client privilege. Employers’ policies and procedures for accessing employee e-mails should be periodically reviewed and revised, where necessary, to ensure that the individuals who access lawfully stored e-mails not only have the appropriate status within the company, but also are doing so for legitimate business purposes.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Contributed by Kathryn J. Russo.

A recent case emphasizes that employers must ensure they do not make improper medical inquiries related to pre-employment drug test results at the pre-offer stage. John Harrison v. Benchmark Electronics, Inc., No. 08-16656, 2010 App. LEXIS 632 (11th Cir. Jan. 11, 2010). Some valuable lessons for employers are discussed below.

The Eleventh Circuit Court of Appeals permitted an applicant who was not hired after testing positive for drugs used to control his epilepsy to proceed with his lawsuit asserting claims under the Americans with Disabilities Act because there were factual issues whether the employer made an improper medical inquiry and denied employment on that basis.

• Email This
• Print
• Comments (1)
• Trackbacks
• Share Link

The U.S. Supreme Court’s recent grant of certiorari in City of Ontario, Ontario Police Department, and Lloyd Scharf v. Jeff Quon, et al. highlights the effects new technologies continue to have on workplace privacy issues. One issue the Court will consider is whether a California police department violated the privacy of one of its officers when it read the personal text messages on his department issued pager. The U.S. Court of Appeals for the Ninth Court sided with the police officer when it ruled that users of text messaging services “have a reasonable expectation of privacy” regarding messages stored on the service provider’s network.

The underlying suit was filed by police Sgt. Jeff Quon, his wife, his girlfriend, and another police sergeant after one of Quon’s superiors audited his messages and found that many of them were sexually explicit and personal in nature.   Among the defendants were the City of Ontario, the Ontario Police Department, and Arch Wireless Operating. Co. Inc. Plaintiffs sought damages for alleged violation of their privacy rights.

While this case involves a public sector entity, its outcome is likely to affect electronic communications policies and practices across the country, whether by public or privacy employers.  

• Email This
• Print
• Comments
• Trackbacks
• Share Link

As the holidays approach, more of us will be utilizing work time, and likely work resources, to handle our holiday shopping. Some of us may even post our shopping successes or gift ideas on Facebook or email coupons to friends. Doing so not only results in a loss of employee productivity, but also creates significant risk that personal data will be breached, or employers’ software or hardware compromised. 

A recent survey conducted on behalf of the Information Systems Audit and Control Association (“ISACA”) found that over half of employees surveyed planned to shop online from a work computer this holiday season, spending nearly two full working days (14.4 hours) doing so. With convenience and boredom listed as the biggest motivators, one in 10 planned to spend at least 30 hours shopping online at work. 

The survey also found that those who shop online are more likely to engage in other high-risk behaviors, such as banking online, clicking on links from social networking sites like Facebook, and clicking e-mail links redirecting them to shopping sites. Employees engage in these high-risk behaviors with nearly universal disregard for the safety of the employer’s IT infrastructure. This is highlighted  by the fact that one in 10 Americans who use a mobile work device, such as a Blackberry or iPhone, plan to use it for holiday shopping, notwithstanding the lack of security measures on those devices.

Robert Stroud, international VP of ISACA and VP of IT service management and governance for the service management business unit at CA Inc., in connection with the survey above was quoted as saying,

[I]t’s unrealistic to think that companies can completely stop the use of work computers for online shopping…[W]hat companies can and should do is educate employees about the risks…and remind them of their company’s security policy. This is especially important this year, when the convenience of shopping online may be very appealing to employees whose workloads have doubled or tripled because of downsizing.

The Wall Street Journal recently published an article highlighting employers’ efforts to monitor employees’ usage of company time and resources for personal e-mail exchanges, and suggesting a trend that courts seem to be more protective of employee privacy rights than in years past. The WSJ article raised a number of concerns for employers, including that of our own Jane McFetridge, a Jackson Lewis partner in our Chicago office - 

Employers are right to expect their employees when they are paid for their time at work are actually working.

What ever a company's policies are concerning managing or monitoring employee communications, now is as good a time as any to revisit those policies and remind employees of their existence. With the use of technology increasing and the position of the courts appearing to shift toward employees, it is becoming more difficult for employers to manage the employee use of their electronic systems. Having and communicating a clear and comprehensive electronic communications policy is critical.

Steps an employer can take include having acceptable-use policies, reviewing those policies with employees to educate them about the risks, and familiarizing themselves with state laws governing the monitoring of employee computer usage.  

• Email This
• Print
• Comments
• Trackbacks
• Share Link

A New Jersey restaurant has been hit with a jury verdict in favor of two waiters who were fired after the restaurant’s managers accessed a private social networking site where the waiters were criticizing management.

As the social networking (e.g., MySpace and Facebook) “craze” continues to expand, employers must be more mindful of privacy concerns relating to content made available in these media by applicants and employees. Hiring and other job decisions often seem based on information obtained from employees’ or applicants’ social interactions on the Internet, at least to some degree. Generally, employment decisions are more supportable where there is a social networking policy that has been communicated to employees. 

In Brian Pietrylo, et al. v. Hillstone Restaurant Group d/b/a Houston’s, a federal court in New Jersey rejected the employer’s attempt to throw out the jury verdict that managers at a Houston's restaurant intentionally and without authorization accessed a private, invitation-only chat group on MySpace in violation of the federal Stored Communications Act (SCA). The SCA prohibits unauthorized access of stored communications such as e-mail and Internet accounts. The Court also upheld the jury’s award of compensatory and punitive damages against Hillstone. 

This case reminds employers to consider carefully any decision to monitor employees’ use of social networking sites.  Mistakes may be costly.

• Email This
• Print
• Comments
• Trackbacks
• Share Link