12.2 Attorney-Client Privilege, Work Product, and Discoverability

Why This Matters on the Exam

Domain 5 of the CPHRM blueprint contains an explicit task: manage and maintain all information related to a potential or actual legal case under attorney/client privilege and protected from discoverability. Items built on this task are among the most reliably tested in Claims and Litigation, and they are almost always written so that the wrong answers blur protections that are legally distinct. A risk manager who reasons "it went to a committee, so it is privileged" has already missed the item. Your job is to know which protection you are invoking, what it actually covers, what defeats it, and that no protection converts an unprotected fact into a protected one.

Start from the principle that unifies the whole topic: privileges protect communications and analysis, not facts and not care. Plaintiff's counsel can always ask a nurse what she saw. Plaintiff's counsel can always obtain the medical record. What privilege can shelter is the confidential legal conversation about the event and the mental work done to prepare a defense.

The Three Distinct Protections

1. Attorney-Client Privilege

Attorney-client privilege protects confidential communications between a client and legal counsel made for the purpose of seeking or providing legal advice. It is the oldest of the common-law privileges, it belongs to the client (only the client can waive it), and it is essentially absolute when it applies.

In a hospital, the client is the organization, not any individual employee. Under Upjohn Co. v. United States (U.S. Supreme Court, 1981), corporate privilege is not limited to a narrow "control group" of senior executives: it extends to communications with employees at any level when the communications are made at the direction of corporate superiors or counsel, concern matters within the employee's job duties, and are made so counsel can render legal advice to the organization. That is the legal foundation for counsel-directed interviews of the staff nurse, the resident, and the pump technician after an adverse event.

Three limits recur in exam items:

• The privilege protects the communication, not the underlying facts. Telling counsel "the pump was running at ten times the ordered rate" does not make the pump rate privileged. Every witness who knows that fact can still be deposed about it.
• The medical record is never privileged. It is a business record created to document care and is produced in every malpractice case. No marking, routing, or committee referral changes that.
• A request for business or operational advice is not privileged merely because a lawyer received it. Courts examine whether legal advice was the primary purpose of the communication.

2. Attorney Work Product

The work product doctrine (Hickman v. Taylor, 1947; codified for federal cases at Federal Rule of Civil Procedure 26(b)(3), with state analogs) protects documents and tangible things prepared in anticipation of litigation by or for a party or its representative. "Representative" is broad: it includes insurers, consultants, investigators, and the risk manager acting at counsel's direction.

Work product comes in two strengths, and the exam expects you to distinguish them:

• Fact (ordinary) work product — witness statements, investigative summaries, chronologies, photographs. Protection is qualified: an opposing party can obtain the material by showing substantial need for it and that it cannot obtain the substantial equivalent without undue hardship (for example, the only contemporaneous statement from a witness who has since died).
• Opinion work product — counsel's mental impressions, conclusions, opinions, and legal theories. Protection is near-absolute; courts must guard against its disclosure even when ordering fact work product produced.

The hinge of the entire doctrine is the phrase in anticipation of litigation. A document generated in the ordinary course of business — because policy requires one for every event, every time — is not work product, no matter what is stamped on it. This is exactly why the routine incident report is vulnerable. If the organization generates one for all events as a standing quality operation, a court can readily conclude it was not prepared in anticipation of litigation and order it produced.

3. Peer Review / Quality Improvement Privilege

Peer review privilege (also called quality assurance or quality improvement privilege) is a creature of state statute. There is no general federal common-law peer review privilege; federal courts hearing federal-question cases such as civil rights, antitrust, and False Claims Act matters have repeatedly declined to recognize one. The Health Care Quality Improvement Act (HCQIA) of 1986 is not a substitute: it confers immunity from damages for good-faith professional review actions, not protection from discovery.

Scope varies enormously by state. The typical pattern protects the deliberations, minutes, analyses, and recommendations of a properly constituted committee, but does not protect source documents, facts, or records that exist independently of the committee. Placing an otherwise discoverable document into a committee folder does not immunize it. Because variation is the rule, an exam answer that states a single national scope for peer review protection is wrong; the correct posture is to verify the state statute, the committee's charter and composition, and its reporting relationship.

The Federal Overlay: PSQIA, PSOs, and Patient Safety Work Product

The Patient Safety and Quality Improvement Act (PSQIA) of 2005, implemented by the Patient Safety Rule at 42 C.F.R. Part 3 (effective January 19, 2009), created the only broadly applicable federal privilege for patient safety analysis. It exists precisely because state peer review statutes are inconsistent, frequently do not travel across state lines, and are often unavailable in federal court.

Keep three terms straight:

• Patient Safety Organization (PSO) — an entity listed by the Agency for Healthcare Research and Quality (AHRQ) to receive and analyze patient safety data from providers.
• Patient Safety Evaluation System (PSES) — the provider's defined system for the collection, management, or analysis of information for reporting to a PSO. It is a documented process with defined inputs, custodians, and boundaries — not a room, a folder, or a label.
• Patient Safety Work Product (PSWP) — the data, reports, analyses, and deliberations assembled within the PSES and reported to a PSO, plus material developed by the PSO. PSWP is both privileged (generally not discoverable or admissible in civil, criminal, and administrative proceedings) and confidential (disclosure limited to permitted categories, with civil money penalties for knowing or reckless impermissible disclosure).

Two features make PSQIA valuable to risk managers: the protection is federal, so it applies uniformly across state lines and in federal court, and it squarely covers analysis and deliberation, which some state statutes cover only narrowly.

What the PSES Cannot Shelter

The exam's favorite PSQIA trap is the belief that dropping a document into the PSES protects it. It does not. HHS guidance is explicit that information a provider is required to create or maintain to satisfy an external obligation cannot be PSWP — including state adverse-event reporting, Centers for Medicare & Medicaid Services (CMS) Conditions of Participation, licensure, accreditation, and any federal, state, or local health oversight requirement. Oversight and public health agencies retain access to what the law requires providers to keep, and PSQIA does not preempt state law requiring reporting of information that is not PSWP.

Also outside PSWP:

• The original medical record, billing and claims records, and other records maintained separately from the PSES.
• Information collected and maintained separately from the PSES for business or regulatory purposes, even if a copy is later reported to a PSO.
• Facts and personal knowledge. A clinician who witnessed an event may still be deposed about what she observed and did; PSQIA protects the reported analysis, not the underlying reality.

Two practical corollaries follow. First, the PSES must be defined in policy, actually functioning, and documented — a PSES invented after a suit is filed will not withstand challenge, and litigation over PSWP has turned on whether the organization could show a real system. Second, providers may deliberately remove ("drop out") information from the PSES before it is reported to a PSO, at which point it is no longer PSWP; that dual-track design is how organizations satisfy mandatory external reporting while still protecting deliberative analysis.

Comparing the Four Protections

Practical Rules the Exam Tests

Because the blueprint task is about managing information, the items are operational. Learn these as rules.

1. Route investigation materials through counsel. Where attorney-client privilege or work product is the intended protection, counsel should request and direct the investigation, and the resulting materials should be addressed to counsel. The header "Prepared at the request of and for the use of legal counsel in anticipation of litigation" is a factual assertion — make it true before you write it.
2. Never reference the incident report in the medical record. A charted phrase such as "incident report completed" creates a documented link that plaintiff's counsel will use to argue the report is part of the record. Chart the clinical facts, the patient's condition, and the treatment provided — nothing about the internal reporting process.
3. Keep the investigation file separate from the medical record, physically and electronically, with separate storage, access controls, and retention.
4. Limit distribution to need-to-know. Every additional recipient erodes the confidentiality privilege depends on. Wide internal circulation of a "privileged" memorandum is among the most common self-inflicted waivers in healthcare.
5. Mark documents accurately, not reflexively. Stamping everything "Privileged and Confidential" is worse than useless: it signals that markings mean nothing at this organization and invites a court to review everything. Mark what qualifies, and be able to explain why.
6. Segregate the tracks deliberately. Mandatory external reports, the medical record, and business records travel one path; counsel-directed analysis and PSO-reported deliberation travel another.

Waiver: How Protection Is Lost

Privilege is fragile and is usually destroyed by the holder, not by the court:

• Voluntary disclosure to a third party — sharing a privileged analysis with a vendor, an unaffiliated consultant, a reporter, or a business partner.
• Broad internal dissemination beyond those with a genuine need to know.
• At-issue (implied) waiver — raising a defense that depends on counsel's advice puts that advice in issue and opens it to discovery.
• Subject-matter waiver — disclosing part of a privileged communication can waive protection for the remainder of the same subject.
• Inadvertent production. Federal Rule of Evidence 502 softens this: inadvertent disclosure does not waive if the holder took reasonable steps to prevent it and promptly moved to rectify the error, and a court order under Rule 502(d) can preserve protection more broadly. Treat that as a safety net, not a strategy.

PSWP confidentiality works differently from common-law privilege: PSQIA specifies permitted disclosures, and impermissible disclosure carries civil money penalties rather than a simple waiver analysis.

Scenario

A patient dies after an infusion pump programming error. The chief nursing officer emails all forty unit staff a document titled "Privileged and Confidential — Investigation Findings," including her statement that "we clearly under-staffed nights." The risk manager charts "event report filed" in the patient's record and files the investigation packet in the chart's overflow folder.

Every step damages the defense. The mass email destroys confidentiality and with it any privilege argument, and its conclusory blame statement is precisely what plaintiff's counsel wants read to a jury; the label does not save it. The chart entry documents a link between the internal report and the medical record. Storing the packet with the chart makes it part of the record produced in discovery.

The correct sequence: notify counsel immediately; have counsel direct the investigation; interview staff individually with a clear explanation that counsel represents the organization; keep the analytic file separate and access-restricted; distribute findings only to those who must act on them; route deliberative analysis into the PSES for PSO reporting; and complete any state-mandated report on a separate track.

Exam Traps

• Stating peer review protection as a national rule. It is state law and varies; correct answers qualify by state or direct verification of the statute.
• Believing the medical record can be made privileged. It cannot.
• Believing privilege hides facts. It never does — witnesses still testify to what they saw and did.
• Over-marking documents. A blanket stamp is a credibility problem, not a protection.
• Confusing HCQIA immunity with discovery protection. HCQIA shields good-faith reviewers from damages; it does not make records undiscoverable.
• Answers that exceed the risk manager's authority — unilaterally declaring a document privileged, or instructing staff to ignore a subpoena. The defensible action is to preserve the material, restrict access, and consult counsel.