Opinion
DOCKET NO. A-1231-21
04-18-2023
ESTATE OF Richard M. LASIW BY his Executrix, Michele LASIW, and Michele Lasiw, individually, Plaintiffs-Respondents, v. Pedro M. PEREIRA M.D., Lopa Maharaja, M.D., Diane Lo Presti, R.N., Valdehl Patel, R.N., Netye Eustache, R.N., Min Jung Kim, R.N., Kayla Zimmerman, R.N., Stashauma Kelly, R.N., Diane Richard, R.N., Laurie Sandoval, R.N., Carol Parlapiano, R.N., Karen Dunchus, R.N., Maria Pernia, R.n., Bronwyn O'Connor, R.N., Brianna Luskin, R.N., Linda Wymbs, R.N., Debra McNally, R.n., Katla Sama, R.N., Hackensackumc, Hackensack University Medical Group, Valley Medical Group, Valley Health System, and Infectious Disease Associates of Northern New Jersey, Defendants, and Hackensack University Medical Center and Hackensack Meridian Health, Defendants-Appellants.
Peter J. Pizzi argued the cause for appellants (Walsh Pizzi O'Reilly Falanga, LLP, attorneys; Peter J. Pizzi, Marc D. Haefner, and Kristin Spallanzani, Florham Park, on the briefs). Paul M. da Costa argued the cause for respondents (Snyder Sarno D'Aniello Maceri da Costa, LLC, attorneys; Paul M. da Costa, Roseland, Sherry L. Foley, and Timothy J. Foley, Saddle River, of counsel and on the briefs). Nicole DeMuro argued the cause for amicus curiae New Jersey Hospital Association (O'Toole Scrivo, LLC, attorneys; James DiGiulio and Nicole DeMuro, Trenton, of counsel and on the brief; Jia Zhang, on the brief). Jonathan H. Lomurro argued the cause for amicus curiae New Jersey Association for Justice (Lomurro, Munson, Comer, Brown & Schottland, LLC, attorneys; Jonathan H. Lomurro and Christina Vassiliou Harvey, Freehold, of counsel and on the brief).
Peter J. Pizzi argued the cause for appellants (Walsh Pizzi O'Reilly Falanga, LLP, attorneys; Peter J. Pizzi, Marc D. Haefner, and Kristin Spallanzani, Florham Park, on the briefs).
Paul M. da Costa argued the cause for respondents (Snyder Sarno D'Aniello Maceri da Costa, LLC, attorneys; Paul M. da Costa, Roseland, Sherry L. Foley, and Timothy J. Foley, Saddle River, of counsel and on the briefs).
Nicole DeMuro argued the cause for amicus curiae New Jersey Hospital Association (O'Toole Scrivo, LLC, attorneys; James DiGiulio and Nicole DeMuro, Trenton, of counsel and on the brief; Jia Zhang, on the brief).
Jonathan H. Lomurro argued the cause for amicus curiae New Jersey Association for Justice (Lomurro, Munson, Comer, Brown & Schottland, LLC, attorneys; Jonathan H. Lomurro and Christina Vassiliou Harvey, Freehold, of counsel and on the brief).
Before Judges Messano, Gilson and Gummer.
The opinion of the court was delivered by
MESSANO, C.J.A.D.
"We liberally construe our discovery rules ‘because we adhere to the belief that justice is more likely to be achieved when there has been full disclosure and all parties are conversant with all available facts.’ " Brugaletta v. Garcia, 234 N.J. 225, 249, 190 A.3d 419 (2018) (quoting In re Liquidation of Integrity Ins. Co., 165 N.J. 75, 82, 754 A.2d 1177 (2000) ). "Although relevance creates a presumption of discoverability, confidentiality may be maintained if an evidentiary privilege exists[,]" Integrity Ins. Co., 165 N.J. at 83, 754 A.2d 1177 (citing Payton v. N.J. Tpk. Auth., 148 N.J. 524, 539, 691 A.2d 321 (1997) ), and discovery "otherwise permitted may be limited by the court if it determines that the discovery sought is unreasonably cumulative or duplicative, or the burden or expense of the proposed discovery outweighs its likely benefit." Horizon Blue Cross Blue Shield of N.J. v. State, 425 N.J. Super. 1, 29, 39 A.3d 228 (App. Div. 2012) (citing R. 4:10-2(g) ).
These principles are at the crux of this appeal and reflect the inherent tension judges face in "pretrial discovery matters" as they "strive to avoid placing undue burdens upon litigants or imposing unfair conditions upon access to relevant information or potential witnesses." In re Pelvic Mesh/Gynecare Litig., 426 N.J. Super. 167, 196, 43 A.3d 1211 (App. Div. 2012) (Sabatino, J., concurring) (citing R. 4:10-2(g) ). We have granted defendants Hackensack University Medical Center (HUMC) and Hackensack Meridian Health (HMH) leave to appeal from the Law Division's discovery orders for a second time in this medical malpractice litigation. In May 2021, the motion judge permitted an expert retained by plaintiff Michele Lasiw, individually and as executrix of the estate of her late husband, Richard M. Lasiw (decedent), to inspect decedent's electronic medical records (EMR) at HUMC. After the judge denied their motion for reconsideration, defendants sought leave to appeal.
HMH utilizes an EMR platform licensed from EPIC Systems Corporation (EPIC). Although Michele Lasiw has asserted personal claims, and also claims on behalf of her late husband's estate, for ease of reference we use the singular "plaintiff" throughout this opinion.
Our July 29, 2021 order granted defendants' motion for leave to appeal, vacated the Law Division's orders and remanded the matter. At that time, it was undisputed that plaintiff had not sought to meet and confer with defendants about her discovery demand before filing a motion to compel discovery. We concluded plaintiff had failed to comply with Rule 4:10-2(f), which expressly permits discovery of "metadata[ ] in electronic documents" but requires the parties first "consult and seek agreement regarding the scope of the request and the format of electronic documents to be produced." R. 4:10-2(f)(1). A motion to compel discovery of metadata in electronic documents or a motion seeking a protective order is appropriate only "[a]bsent an agreement between the parties." Ibid.
As defined by the Official Comment to the Court's August 1, 2016 adoption of Rule 4:10-2(f)(1),
"Metadata" is embedded information in electronic documents that is generally hidden from view in a printed copy of a document. It is generated when documents are created or revised on a computer.
Metadata may reflect such information as the author of a document, the date or dates on which the document was revised, tracked revisions to the document, and comments inserted in the margins. It may also reflect information necessary to access, understand, search, and display the contents of documents created in spreadsheet, database, and similar applications.
[Pressler & Verniero, Current N.J. Court Rules, (2023).]
On remand, plaintiff and defendants conferred but could not agree; plaintiff again moved to compel discovery. The same judge granted the motion and ordered HUMC to "allow [p]laintiff's expert to conduct an inspection of [d]ecedent's ... electronically stored information as requested in [plaintiff's] Notice to Inspect and within the parameters discussed during the meet and confer and detailed in [p]laintiff's September 22, 2021[ ] letter." The judge also ordered defendants to "provide a full audit trail" for the period from March 16, 2018, the date of decedent's discharge from HUMC, through February 28, 2019. We again granted defendants leave to appeal.
An audit trail is
a document that shows the sequence of events related to the use of and access to an individual patient's [EMR]. For instance, the audit trail will reveal who accessed a particular patient's records, when, and where the health care provider accessed the record. ... Each time a patient's [EMR] is opened, regardless of the reason, the audit trail documents this detail. The audit trail cannot be erased and all events related to the access of a patient's [EMR] are permanently documented in the audit trail. Providers cannot hide anything they do with the medical record. No one can escape the audit trail.
[Gilbert v. Highland Hosp., 52 Misc.3d 555, 31 N.Y.S.3d 397, 399 (Sup. Ct. 2016) (quoting Alice G. Gosfield, Health Law Handbook § 10:9 (2011)).]
The record does not reveal when Richard M. Lasiw died, although we were advised during oral argument that it was shortly after his discharge from HUMC.
I.
To properly resolve the issues presented, we add some necessary procedural details.
The First Appeal
Within days of filing the complaint in January 2021, plaintiff served defendants with a notice requesting that HUMC "allow the inspection of any and all electronically stored information/[EMR] for [d]ecedent ... including all audit trail data via on-site/remote inspection pursuant to Rule 4:18-1 including, but not limited, to the EPIC EMR and the PACS system of [HUMC]." HUMC refused, explaining that the "EMR program [wa]s proprietary," contained protected personal health information (PHI), and the present EMR format was "not the format which was in place at the time of [decedent's] admission." HUMC asserted that because "the format [wa]s ever evolving, the current format [wa]s irrelevant and the presentation of the current format would be unduly burdensome." HUMC also advised that if a court were to allow the inspection, plaintiff's "counsel would need to have in place cyber- and criminal-acts insurance, in an amount not less than $5,000,000, given the potential for a ransomware attack." Plaintiff quickly moved to compel discovery as requested in the notice to inspect.
The "PACS system" is not identified in the record.
In opposition, defendants provided a certification from Gail Keyser, Co-Interim Chief Information Officer and Chief of Health Applications for HMH. Keyser certified that the EPIC health records system was regularly upgraded and, therefore, "the way [the] system operate[d] at the time of a specific patient encounter is not the same when viewed months or years later, making a live inspection of the current ... system unlikely to produce [relevant] information." Keyser identified risks posed by "[a]llowing a third-party direct access to a live EMR system like EPIC, outside the control of HMH" and noted widespread information security breaches and ransomware attacks in the healthcare industry. Keyser also stated that the COVID-19 pandemic had "imposed extreme stress on almost every area of HMH's internal and external healthcare system." She contended that
[w]ithout any showing that access to the live EMR would provide information that could not be delivered in a less burdensome fashion through written reports and document productions prepared in response to appropriately drafted discovery requests, HMH cannot be expected to allocate personnel to analyze, create, and employ mitigation strategies to allow representatives of litigation adversaries in standard medical negligence cases who want to ‘inspect and examine’ the ... system. The burden of access is too great and not proportional to the needs of the medical malpractice litigation.
In response to defendants' opposition, plaintiff provided a letter from Michele Gonsman, an expert who would perform the proposed inspection. Gonsman stated that because she would be viewing only decedent's EMR, there would be no privacy concerns regarding other patients' information, nor was she seeking any proprietary information regarding EPIC's system. She recognized that although the format of the records may have changed, "the data within the record should not have changed"; as an expert in clinical forensic documentation analysis, she was "able to put these things into context." Perhaps most importantly, Gonsman clarified that plaintiff was asking only to inspect the EMR onscreen, with HUMC staff present, "controlling the log in [to the system] and the mouse," and guiding Gonsman's inquiries. Gonsman also stated that she would not "use any outside devices such as thumb drives or discs," and she estimated the inspection could "easily be done in a few hours."
Gonsman also asserted the inspection would "provide[ ] data simply not visible or able to be produced in the printed record," and that she had performed "multiple on-site/remote inspections" of EMR resulting in the discovery of "very relevant and substantive documents that were not previously produced." Gonsman contended that only by inspecting EMR can one determine if entries made to the records were contemporaneous with the time and date of service or were made at some later time, noting the timing of the entries "could be of great importance to the case." Lastly, addressing defendants' COVID-19 concerns, Gonsman indicated she could conduct the inspection by Zoom or on-site, socially distanced in a conference room, with defendants' employee displaying decedent's EMR on a large screen.
After oral argument, the judge ordered HUMC to allow plaintiff's expert to conduct the inspection as requested in the notice to inspect. The judge denied defendants' motion for reconsideration, which led to our first grant of leave to appeal. In vacating the orders and remanding for the parties to meet and confer, in our July 2021 order, we "acknowledge[d] that such efforts may prove fruitless, given the broad objections lodged by defendants" but concluded the procedural prerequisites required by our Court Rules could "not be ignored." We noted that if plaintiff complied with the Rules, she could again "seek the same relief, if necessary," which is precisely what occurred. The Present Appeal
In August 2021, plaintiff's counsel requested dates for the parties to meet and confer regarding the EMR inspection; he reasserted his request for the audit trail, noting that defendants had represented in prior motion practice before us that they possessed a 2000-page audit trail. In response, defense counsel agreed to produce the "access audit trail" and requested that after its review, plaintiff's counsel "provide a specifically detailed and itemized request for the production of information ... [ ]not ... found or identified in either the certified medical record or in the access audit trail." Defense counsel stated that "[i]n the event ... there is a request directed to a particular provider or ... a particular note, ... that information, if available, will be produced."
In response, plaintiff's counsel acknowledged receiving an audit trail for the period February 19, 2018, through February 28, 2018, but asserted it was incomplete because decedent had not been discharged until March 16, 2018, and preliminary review of the 2,255 pages of medical records that had been produced showed entries were made after decedent's discharge. Counsel requested a complete audit trail for the period from February 19, 2018, through February 28, 2019.
The parties met and conferred on September 13, 2021. The following day, defense counsel sent an email to plaintiff's counsel "[c]onfirming next steps." Specifically, defendants would search for metadata associated with a post-discharge April 22, 2018 doctor's note identified by plaintiff and would get back to plaintiff regarding the time period for the audit trail. Defense counsel also stated that plaintiff would "provide a list of items in the medical records and documents already produced about which [p]laintiff[ ] seek[s] additional metadata," and defendants would then determine whether "additional metadata can be provided regarding each item." The same day plaintiff's counsel sent a letter "setting forth what we are looking for." Counsel repeated his request for the "access ... audit trail" for February 19, 2018, through February 28, 2019.
By letter dated September 22, 2021, plaintiff's counsel proposed the following:
We request inspection of the data and metadata regarding the [e]ncounters with [decedent] within the 2/19/8 [sic] admission. This is to include, but is not exclusive of, all notes (nursing and/or progress) and the data behind the notes and other entries (note revision histories), nurse flowsheets, diagnostics, and
documents. Essentially all data contained in the EMR for each [e]ncounter.
Defense counsel responded by stating the request was "overbroad," and the September 22 letter "appear[ed] to end the meet-and-confer as ordered by the Appellate Division without a resolution of the inspection demand." Defendants provided the access audit trail through decedent's discharge date, March 16, 2018, and metadata for the April 22, 2018 doctor's note.
On October 6, 2021, plaintiff filed a motion once again seeking to compel inspection of decedent's EMR as requested in the notice to inspect, and "to provide a complete version of the audit trail." Defendants opposed the motion, including with counsel's certification the entire audit trail for decedent's admission and the metadata for the post-discharge April 22, 2018 doctor's note. In further support, defendants provided the certification of co-counsel, who was present during the September 13, 2021 "meet and confer." He stated that "plaintiff's counsel represented, in no uncertain terms, that plaintiff would provide a list of all specific entries in the medical record, and in the access audit trail, for which ... plaintiff was seeking additional information, metadata and the like."
The judge heard argument on the motion, which plaintiff's counsel characterized as involving "two different issues." The first was the requested audit trail from March 16, 2018 — decedent's discharge date — to February 28, 2019, with counsel acknowledging having received the audit trail for the entirety of decedent's hospitalization. Second, counsel reasserted his demand to conduct an "on-site inspection" of the metadata in decedent's EMR. Defense counsel argued "[a]n inspection [wa]s something of a last resort," available "only when a plaintiff has shown conventional document productions, which are not risky, which do not needlessly consume tons of staff, [and] which are not jeopardizing the security of the system" are insufficient. He noted that plaintiff's counsel previously had agreed to provide specific entries for which he sought metadata, and the metadata for those entries could "be replicated in discovery and ... used in the case."
Trying to clarify the issue further, the judge wisely asked if the April 22, 2018 entry was the only post-discharge entry in the EMR and, if so, why defendants could not certify there were no other post-discharge entries. Defense counsel agreed defendants could submit a certification regarding whether any other post-discharge entries existed, and, in the colloquy that followed, plaintiff's counsel agreed, expressing only reservations that defendants might assert privilege. The judge dismissed the privilege issue, implying that it was not before her at the time.
Returning to the on-site inspection issue, plaintiff's counsel contended it would short-circuit the need for defendant to produce in documentary form "10,000 entries" of metadata, which would be "burdensome." Defense counsel reiterated that plaintiff needed to identify specific entries for which the metadata should be produced, replicated and used in further proceedings. The judge reserved decision.
On December 6, 2021, the judge granted plaintiffs' motion and ordered HUMC to "allow [p]laintiff's expert to conduct an inspection of [d]ecedent's ... electronically stored information as requested in [plaintiff's] Notice to Inspect and within the parameters discussed during the meet and confer and detailed in [p]laintiff's September 22, 2021[ ] letter." The court also ordered HUMC to "provide a full audit trail" for the period from March 16, 2018, through February 28, 2019. In a written rider to her order, the judge explained Keyser's certification "failed to adequately set forth the undue burden that would be placed upon HUMC for the parties to view the data on screen." The judge reasoned that such a review likely would require less personnel time than if defendants had to produce a "PDF version of all the medical record with all the requested metadata." The judge wrote that plaintiff's expert would "merely view the file" accessed by HUMC staff and would not have access to "proprietary information regarding software or system applications." She concluded the "calamities" feared by defendants were "simply not present," and, in addition, the judge found no merit in defendants' argument that PHI of other patients could be exposed by any inspection. The judge entered the order under review.
Defendants contend the motion judge "abused [her] discretion in ordering the uncontrolled in-person inspection" of their "EPIC EMR system and a lengthy post-discharge audit trail." They argue plaintiff has presented "no extraordinary facts" justifying "the most intrusive form of discovery permitted by our rules of court," and no authority supports plaintiff's demand that they produce an "access audit trail" for a full year after decedent's discharge. Plaintiff conversely argues that the motion judge properly exercised her discretion, because the decedent's medical records are clearly relevant, and defendants failed to demonstrate the discovery sought, including an in-person inspection of decedent's EMR, was unduly burdensome.
We granted New Jersey Association for Justice (NJAJ) and the New Jersey Hospital Association (NJHA) leave to participate as amici. The NJAJ urges us to affirm, asserting that federal law and state regulations permit inspection and access to one's PHI and on-site inspections of EMR are not unusual. The NJHA emphasizes that on-site inspections are burdensome, raise significant privacy and cyber security issues, and are particularly inappropriate during the sustained COVID-19 pandemic. NJHA also urges a referral to the Supreme Court's Civil Practice Committee for consideration of "the unique challenges presented by in-person metadata inspections."
We have considered the arguments in light of the record and applicable legal standards. We affirm as modified. II.
We begin by recognizing that appellate courts generally "defer to a trial judge's discovery rulings absent an abuse of discretion or a judge's misunderstanding or misapplication of the law." Cap. Health Sys., Inc. v. Horizon Healthcare Servs., Inc., 230 N.J. 73, 79–80, 165 A.3d 729 (2017) (citing Pomerantz Paper Corp. v. New Cmty. Corp., 207 N.J. 344, 371, 25 A.3d 221 (2011) ). Our "discovery rules ‘are to be construed liberally in favor of broad pretrial discovery.’ " Id. at 80, 165 A.3d 729 (quoting Payton, 148 N.J. at 535, 691 A.2d 321 ). "Consequently, to overcome the presumption in favor of discoverability, a party must show ‘good cause’ for withholding relevant discovery ...." Ibid.
Rule 4:10-2(a) addresses the wide scope of permissible discovery and provides that, unless otherwise limited by court order, "[p]arties may obtain discovery regarding any matter, not privileged, which is relevant to the subject matter involved in the pending action, ... including the existence, description, nature, custody, condition and location of any... electronically stored information ...." (Emphasis added). The Court first addressed discovery of electronically stored information (ESI) in 2006 by adding that term to subsection (a) and adopting subsection (f) of Rule 4:10-2.
The 2006 Report of the Supreme Court Committee on Civil Practice (Committee Report) had recommended adoption of rules to address discovery of ESI that paralleled proposed changes to the Federal Rules of Civil Procedure (FRCP) and recognized "ESI [wa]s dynamic ... [and could] be changed, deleted or corrupted in the process of retrieving it." Committee Report, "Report of the Discovery Subcommittee on Proposed Rule Changes Regarding Electronically Stored Information," (Nov. 2005) at 1. The Committee also recognized that "ESI is voluminous and expensive to review." Id. at 3.
The Committee described the FRCP's "Two[-]Tiered Discovery Based on Accessibility" procedure, which "allow[ed] a responding party to withhold ESI from sources ... not reasonably accessible because of undue burden or expense." Id. at 5. The Committee gave "[e]xamples of inaccessible ESI," such as "deleted information capable of restoration through forensics; backup tape systems intended for disaster recovery; [and] legacy data contained within systems no longer in use." Ibid. The Committee recommended that any rule "should be used to discourage costly, speculative, duplicative, or unduly burdensome discovery of computer data and systems." Id. at 6. The Court ultimately enacted this two-tiered procedure by adopting subsection (f) in 2006.
As adopted, the Rule provided that "[a] party need not provide discovery of [ESI] from sources that the party identifies as not reasonably accessible because of undue burden or cost." R. 4:10-2(f) (2006). The responding party bore the burden of demonstrating "the information [wa]s not reasonably accessible because of undue burden or cost," and, even if that burden was carried, "the court [could] nevertheless ... order discovery from such sources if the requesting party establishe[d] good cause, considering the limitations of Rule 4:10-2(g)." Ibid.
Subsection (g), also first adopted in 2006 and unchanged since, gave "the court the express authority to limit discovery in the circumstances enumerated by the rule in an effort to curb the proliferating discovery abuses attending modern litigation practice." Pressler & Verniero, Current N.J. Court Rules, cmt. 8 on R. 4:10-2 (2007). Subsection (g) provides:
Limitation on Frequency of Discovery. The frequency or extent of use of the discovery methods otherwise permitted under these rules shall be limited by the court if it determines that: (1) the discovery sought is unreasonably cumulative or duplicative, or is obtainable from some other source that is more convenient, less burdensome, or less expensive; (2) the party seeking discovery has had ample opportunity by discovery in the action to obtain the information sought; or (3) the burden or expense of the proposed discovery outweighs its likely benefit, taking into account the needs of the case, the amount in controversy, the parties’ resources, the importance of the issues at stake in the litigation, and the importance of the proposed discovery in resolving the issues. The court may act pursuant to a motion or on its own initiative after reasonable notice to the parties.
[ R. 4:10-2(g).]
In 2016, in a series of amendments particularly addressing metadata in electronic documents, the Court added a new subparagraph to Rule 4:10-2(f), stating:
A party may request metadata in electronic documents. When parties request metadata in discovery, they should consult and seek agreement regarding the scope of the request and the format
of electronic documents to be produced. Absent an agreement between the parties, on a motion to compel discovery or for a protective order, the party from whom discovery is sought shall demonstrate that the request presents undue burden or costs. Judges should consider the limitations of Rule 4:10-2(g) when reviewing such motions.
[ R. 4:10-2(f)(1) (emphasis added).]
Subparagraph (f) as enacted in 2006 became subparagraph (f)(2).
Rule 4:18-1(a), routinely used to request the production, inspection or sampling of documents in possession of another party, was also amended in 2006 to include ESI. See ibid. (including within the term "designated documents," "electronically stored information, and any other data or data compilations stored in any medium from which information can be obtained and translated, if necessary, by the respondent into reasonably usable form"). Subsection (b)(1) provides that any "request shall specify a reasonable time, place, and manner of making the inspection and performing the related acts. The request may specify the form or forms in which electronically stored information is to be produced." (Emphasis added).
Absent a specifically requested format, the responding party "shall produce [it] in a form ... in which it is ordinarily maintained or in a form ... that [is] reasonably usable," and "need not produce the same electronically stored information in more than one form." R. 4:18-1(b)(2)(B) and (C). "The party upon whom the request is served may ... object to a request on specific grounds and, if on the ground of ... accessibility of electronically stored information, the objection shall be made in accordance with Rule 4:10-2 ... (f) ...." R. 4:18-1(b)(4).
The 2016 adoption of Rule 4:10-2(f)(1), as well as the 2016 Official Comments to that Rule and Rule 4:18-1, resulted from the Court's adoption of recommendations made by its appointed Working Group. See Working Group on Ethical Issues Involving Metadata in Electronic Documents, "Report and Recommendations," dated Sept. 14, 2015. The Working Group "recommend[ed] that metadata in electronic documents be highlighted in the discovery rules, thereby providing notice to litigants, lawyers, and judges that unique issues may arise in discovery disputes, and facilitating judicial review and determination of such disputes."Id. at 15. The Working Group understood that "[t]he format for production of an electronic document can be a significant decision" because it may "determine the amount of metadata included in the electronic document and is likely to affect the cost of production." Id. at 16.
Courts should be aware that the choice of format affects the costs imposed on parties, and should be evaluated in light of the scope and complexity of the underlying case. The burden on the producing party triggered by the requesting party's preference as to format of documents produced in discovery should be considered and appropriately balanced against the requesting party's need for metadata.
[Id. at 17.]
The 2016 Official Comment to Rule 4:18-1 incorporated these concerns, as well as ethical concerns over the production of unrequested metadata and the release of privileged information.
In this regard, the Working Group recommended changes to the Rules of Professional Conduct (RPC s) 1.0 and 4.4(b), which the Court subsequently adopted to "address metadata consistent with the manner in which other information is treated under [RPC ] 4.4(b)." Id. at 11–12. Specifically, the recommendations
put[ ] the burden on the receiving lawyer who detects metadata in a transmitted document to make a prompt determination as to whether the metadata was inadvertently sent, based on the nature of the document and the content of the metadata itself, and provide[ ] guidelines as to whether particular categories of metadate may or may not be reviewed.
[Id. at 12–13.]
* * * *
Although the presumption of broad discovery is ingrained in our jurisprudence, "[n]evertheless, there are limits." Lipsky v. N.J. Ass'n of Health Plans, Inc., 474 N.J. Super. 447, 464, 288 A.3d 1273 (App. Div. 2023) (citing Piniero v. N.J. Div. of State Police, 404 N.J. Super. 194, 204, 961 A.2d 1 (App. Div. 2008) ). Our discovery rules frequently cross-reference each other in recognizing that the undue burden or expense of complying with a discovery demand are valid grounds for objection.
As we recently said in Lipsky, "In addition to the privilege and relevance limitations provided under Rules 4:10-2(a) and (e), Rule 4:10-2(g) addresses matters the court should consider when limiting discovery between parties[.]" Ibid. As noted, with respect to ESI, Rule 4:10-2(f)(2) specifically provides, "the party from whom discovery is sought shall demonstrate that the information is not reasonably accessible because of undue burden or cost." (Emphasis added); see also R. 4:10-2(f)(1) (with respect to a demand for metadata, "the party from whom discovery is sought shall demonstrate that the request presents undue burden or costs" (emphasis added)). The 2016 Official Comment to Rule 4:18-1 recognized the potential significant costs depending on the "format of electronic documents" produced in discovery and "the amount of metadata to be produced." Pressler & Verniero, Current N.J. Court Rules, off. cmt. on R. 4:18-1 (2023).
One tool available to the judge to limit the nature and scope of discovery is Rule 4:10-3, which provides that "a party ... from whom discovery is sought" may "for good cause shown" seek "any order that justice requires to protect [that] party ... from annoyance, embarrassment, oppression, or undue burden or expense." R. 4:10-3 (emphasis added). "A court may grant the person from whom discovery is sought various forms of relief, including: ‘[t]hat the discovery not be had,’ ‘the discovery ... be had only on specified terms and conditions,’ or ‘the scope of the discovery be limited to certain matters.’ " Trenton Renewable Power, LLC v. Denali Water Sols., LLC, 470 N.J. Super. 218, 227, 269 A.3d 519 (App. Div. 2022) (alteration in original) (quoting R. 4:10-3(a), (b), and (d) ).
With this framework in mind, we turn to the two facets of the order under review: the on-site inspection of decedent's EMR; and, the access audit trail spanning nearly a full year after decedent's discharge from HUMC. III.
Defendants contend that permitting plaintiff's expert to conduct an onsite inspection of decedent's EMR is unduly burdensome, both in time and expense. They also assert privileged patient information may be exposed, and there exists the risk of cyberattack. Defendants argue the burden should be placed on plaintiff to identify specific entries in the EMR for which she seeks metadata, and they will produce it subject to potential assertions of privilege. Defendants point to the following language in the 2016 Official Comment to Rule 4:18-1 for support:
The burden on the producing party caused by the selection of format of documents sought in discovery should be considered and appropriately balanced against the requesting party's need for metadata.
Judges, when reviewing a motion to compel discovery or for a protective order, should also consider the limitations of Rule 4:10-2(g).
[Pressler & Verniero, Current N.J. Court Rules, off. cmt. on R. 4:18-1 (2023) (emphasis added).]
Defendants also contend our recent opinion in Lipsky fully supports their position.
Initially, the metadata plaintiff seeks is clearly discoverable because it is undoubtedly "relevant to the subject matter involved in the pending action," Rule 4:10-2(a) ; defendants do not dispute that. Under our Court Rules, plaintiff's need for the metadata is not a basis for defendants' objection unless and until they demonstrate the requested information is privileged or otherwise is not subject to disclosure or its production in the format requested poses an undue or excessive burden. In other words, defendants wrongly contend plaintiff bears some initial burden to prove she "needs" the metadata. The historical evolution of the Court Rules on the subject does not support defendants' position, nor does any of the authority or caselaw defendants cite in their brief.
Indeed, under the New Jersey Bill of Rights for Hospital Patients, every person admitted to a hospital has the right to "access" "all records pertaining to the patient's treatment" unless the patient's doctor determines that access is "not medically advisable." N.J.S.A. 26:2H-12.8 (g). Likewise, federal regulations generally grant individuals "a right of access to inspect and obtain a copy" of their protected health information from a health care provider. 45 C.F.R. § 164.524(a) (2023). Protected health information includes information transmitted by or maintained by electronic media. 45 C.F.R. § 160.103 (2023).
Defendants reference commentary from the Sedona Principles issued by the Sedona Conference addressing FRCP 34. They state, for example, there should be no "routine right of direct access to an opposing party's electronic information system"; "[i]nspection of an opposing party's computer system ... is the exception and not the rule for discovery of [electronically stored information]"; and in general "there is no need or justification for direct inspection of the responding party's computer systems." The Sedona Conference, The Sedona Principles, Third Edition: Best Practices, Recommendations & Principles for Addressing Electronic Document Production, 19 Sedona Conf. J. 1, 127–28 (2018).
"The Sedona Conference ... ‘a nonprofit legal policy research and education organization, has a working group comprised of judges, attorneys, and electronic discovery experts dedicated to resolving electronic document production issues.’ " In re Actos Antitrust Litig., 340 F.R.D. 549, 551 n.2 (S.D.N.Y. 2022) (quoting Aguilar v. Immigr. & Customs Enf't Div. of U.S. Dep't of Homeland Sec., 255 F.R.D. 350, 355 (S.D.N.Y. 2008) ). Rule 4:18-1 "is taken from" FRCP 34. Pressler & Verniero, Current N.J. Court Rules, cmt. 1.1 on R. 4:18-1 (2023).
But plaintiff has not requested direct access to defendants' EPIC system. She has sought only to inspect decedent's EMR on a screen controlled by defendants' employees. The risks identified by the Sedona Principles — the revelation of trade secrets or confidential information, endangerment of the stability of the computer system, a data security breach, or an unreasonable disruption of ongoing business — seem unlikely to occur given the limits of plaintiff's request. Although the Sedona Principles state that inspection will unlikely be effective because those accessing the computer system are unfamiliar with it, here it would be defendants' employees, not plaintiff's expert, manipulating the EPIC system. Defendants' reliance on our recent opinion in Lipsky is also misplaced. There, we "address[ed] the novel issue of whether a party to a pending litigation may compel a non-party State agency to turn over its employees' State-issued and personal cell phones to that party's expert for forensic examination, even when the agency has already produced the relevant records from the devices." Lipsky, 474 N.J. Super. at 451, 288 A.3d 1273. Citing Court Rules we have already discussed, we said:
Rule 4:18-1 anticipates that in civil discovery the responding party will produce responsive electronic data in such a manner that the data may be inspected, copied, tested, or sampled by the requesting party. The Rule does not anticipate that the requesting party will be permitted to search through their opponents' electronic devices for responsive data, any more than it anticipates that the requesting party would be permitted to search through their opponent's filing cabinets for responsive documents.
[ Id. at 467–68, 288 A.3d 1273.]
We then cited several out-of-state and federal decisions prohibiting discovery via access to the opposing party's database. Id. at 468, 288 A.3d 1273. We concluded:
Accordingly, an order compelling forensic examination of electronic devices by the requesting party's e-discovery expert, over the responding party's objection, must be considered an extraordinary remedy, beyond what should generally be required of a party ... without less invasive methods having been exhausted, and without there having been a showing that the responding entity defaulted on its obligations to search its records and produce the requested data, as opposed to mere skepticism that they have done so.
[ Id. at 469, 288 A.3d 1273 (emphasis added) (citations omitted).]
Apart from the obvious underlying factual differences between this case and Lipsky, which involved unrestricted access to the personal cell phones of a non-party's employees, plaintiff has not requested that defendants turn over their "filing cabinets," i.e., their EPIC system, to Gonsman. More importantly, defendants have not produced the information plaintiff sought and to which she is entitled — metadata behind decedent's EMR. Instead, defendants want plaintiff to identify which metadata she wishes to see from the EMR already copied and produced in traditional format. As the motion judge noted, defendants expect plaintiff to do so without having had any access to, or ability to access, the metadata, or knowing whether metadata even exists as to a particular entry in the EMR. Our Court Rules do not require plaintiff to bear that burden.
The decisions cited in Lipsky, id. at 468, 288 A.3d 1273, are also easily distinguished because they addressed requests for direct access to a responding party's electronic data and did not involve a focused request to a single patient's EMR. For example, In re Ford Motor Co., a case that did not involve metadata, the court of appeals reversed the district court's order permitting the plaintiff "unrestricted, direct access to a respondent's database compilations." 345 F.3d 1315, 1316–17 (11th Cir. 2003) (emphasis added).
In Carlson v. Jerousek, a personal injury lawsuit resulting from a motor vehicle accident, the defendant sought all the electronically-stored information on the plaintiff's personal computer. 409 Ill.Dec. 667, 68 N.E.3d 520 (Ill. Ct. App. 2016). The defendant later sought direct access by its expert to the plaintiff's personal and work computers, including their metadata, and to "create and search a forensic image" of the computers. Id. at 534.
The court first noted that under Illinois' discovery rules, metadata and some other forms of electronically stored information were "presumptively nondiscoverable, shifting the burden to the requesting party to justify the making of an exception based on the particular circumstances of the case." Ibid. The court also rejected the request for forensic imaging of the computers, noting under traditional discovery protocol, "[t]here is no provision allowing the requesting party to conduct its own search of the responding party's files — regardless of whether those files are physical or electronic." Id. at 535 (emphasis added). See also Agio Corp. v. Coosawattee River Resort Ass'n, Inc., 328 Ga.App. 642, 760 S.E.2d 691, 695–96 (2014) (holding Georgia's civil discovery statute "does not allow a requesting party unrestricted and direct access to a responding party's untranslated data" (emphasis added)); Menke v. Broward Cnty. Sch. Bd., 916 So.2d 8, 12 (Fla. Ct. App. 2005) (holding that production of the personal computers of plaintiff's entire family for forensic examination by the defendant's expert was improper in the absence of "any destruction of evidence or thwarting discovery" by the plaintiff).
The following cases specifically cited by defendants for support of their position are equally inapposite. See John B. v. Goetz, 531 F.3d 448, 451, 458 (6th Cir. 2008) (Sixth Circuit reversed district court order that "allow[ed] plaintiffs' computer expert to make forensic copies of the hard drives of identified computers, including not only those at the work stations of the state's key custodians, but also any privately owned computers on which the custodians may have performed or received work"); Exec. Air Taxi Corp. v. City of Bismarck, 518 F.3d 562, 569 (8th Cir. 2008) (Eighth Circuit affirmed district court decision denying the plaintiff's request to have "third-party expert conduct a forensic investigation of a City-owned computer to search for relevant e-mails that might not have been produced in ... discovery"); FCA US LLC v. Bullock, 329 F.R.D. 563, 566, 569 (E.D. Mich. 2019) (district court denied motion to compel where the plaintiff sought to have its expert "inspect, copy, and create a mirror image" of the defendant's business and personal computers and cell phone); In re Methodist Primary Care Grp., 553 S.W.3d 709, 712–14 (Tex. Ct. App. 2018) (in action alleging doctors who left one practice to join another stole trade secrets and tortiously interfered with patient relationships, Court of Appeals reversed trial court's order allowing the plaintiffs' expert to search the electronic systems of the new practice and affiliated entities).
Plaintiff's request to have her expert review decedent's EMR, on screen and under defendants' supervision and control, in order to identify what metadata she wants copied and produced, strikes us as an eminently reasonable way to proceed under the circumstances. As noted, defendant produced the metadata behind the April 2018 post-discharge entry in decedent's EMR; it was five pages long. We fully appreciate, therefore, that requiring defendants to produce metadata for every entry in the 2250 pages of decedent's EMR would be particularly burdensome. But that is not what plaintiff seeks. We agree with the motion judge that defendants failed to demonstrate any of "the calamites" they asserted could result from the expert's on-site inspection would likely occur. Initially, defendants' arguments were premised on a misconception that Gonsman would have unfettered access to the EPIC system. Instead, it is clear that defendants would control all access to the metadata behind any entry in the EMR that Gonsman wished to examine.
Defendants would be free to object to the production of any metadata, for example, based on an asserted privilege. See Pressler & Verniero, Current N.J. Rules, off. cmt. on R. 4:10-2(f)(1) (noting "information protected by privilege is not subject to discovery"). Moreover, because Gonsman would inspect only decedent's EMR, it is highly unlikely that confidential information regarding other patients would be exposed. But even were that to occur, the attorney receiving discovery must "consider his or her obligations under [RPC ] 4.4(b) before reviewing metadata." Pressler & Verniero, off. cmt. on R. 4:18-1. RPC 4.4(b) requires:
A lawyer who receives a document or electronic information and has reasonable cause to believe that the document or information was inadvertently sent shall not read the document or information or, if he or she has begun to do so, shall stop reading it. The lawyer shall (1) promptly notify the sender (2) return the document to the sender and, if in electronic form, delete it and take reasonable measures to assure that the information is inaccessible.
[(Emphasis added).]
In any event, these concerns could be adequately addressed in a confidentiality agreement entered by the parties; from the appellate record, it appears one already exists. See also, N.J.R.E. 530(c)(4) and (5) (regarding non-waiver agreements as to disclosure of discovery covered by the attorney-client and work-product privileges and the enforceability of same by the court); R. 4:10-2(e) (allowing for assertion of privilege for discovery already produced). We also agree with the motion judge that defendants failed to demonstrate Gonsman's inspection would place the EPIC system at risk of a cyberattack. The motion judge specifically concluded defendants failed to demonstrate that plaintiff's request to inspect decedent's EMR for potentially relevant metadata under limited and controlled circumstances was unduly burdensome. Absent an abuse of her discretion, or a misunderstanding of applicable law, we defer to the motion judge's decision in this regard. See Cap. Health Sys., 230 N.J. at 79–80, 165 A.3d 729 (citing Pomerantz Paper Corp., 207 N.J. at 371, 25 A.3d 221 ). An abuse of discretion occurs when "the court's order was ‘made without a rational explanation, inexplicably departed from established policies, or rested on an impermissible basis.’ " Lipsky, 474 N.J. Super. at 463–64, 288 A.3d 1273 (quoting Wear v. Selective Ins. Co., 455 N.J. Super. 440, 459, 190 A.3d 519 (App. Div. 2018) ). We conclude the judge did not mistakenly exercise her discretion or misapprehend applicable law in permitting the on-site inspection of decedent's EMR for potentially relevant metadata.
We agree with defendants, however, that the motion judge's order failed "to set forth any real guidance or protocol to govern the scope and manner of the inspection" or to set any time limits on the inspection. We affirm this aspect of the judge's order as modified by the following necessary guidance.
First and foremost, plaintiff's expert stated that she could conduct the inspection in "a few hours." We therefore limit the inspection to four hours. Plaintiff's expert may conduct the inspection of decedent's EMR, on site, with defendants' personnel in control of the EPIC system and the mouse. Plaintiff's counsel may be present and may request specific metadata be copied and produced in "reasonably usable form." R. 4:18-1(a). Defense counsel also may be present to lodge any objections to particular metadata that appears on the screen or is copied for production, but any objections shall be preserved and considered by the court at a later time. The process shall not be recorded, and plaintiff's expert and counsel shall comply with any reasonable COVID-19 protocols defendants may require. With these restrictions in place, we affirm the motion judge's order permitting the inspection of decedent's EMR by plaintiff's expert.
IV.
Defendants have already produced an access audit trail for the entirety of decedent's stay at HUMC. Defendants' primary argument regarding the motion judge's order compelling production of an access audit trail of decedent's EMR spanning nearly a full year post-discharge is that plaintiff has failed to demonstrate that the burdensome production and review of thousands of pages of documents will likely lead to any relevant evidence. Relevancy remains the touchstone of permissible discovery. See, e.g., Pfenninger v. Hunterdon Cent. Reg'l High Sch., 167 N.J. 230, 237, 770 A.2d 1126 (2001) ("[P]arties may obtain discovery regarding any non-privileged matter that is relevant to subject of pending action or is reasonably calculated to lead to discovery of admissible evidence." (citing Integrity Ins. Co., 165 N.J. at 82, 754 A.2d 1177 )).
The motion judge's written statement of reasons regarding this aspect of plaintiff's demand was less fulsome and provides scant justification for this portion of her order. Although we accept the possibility of relevant evidence being produced via a post-discharge audit trail, plaintiff already has the audit trail for the entirety of decedent's admission at HUMC. She failed to point to anything in that audit trail demonstrating why an additional audit trail spanning almost one full year post-discharge is likely to produce relevant information. The order as entered is overly broad and resulted from the judge's mistaken exercise of discretion.
Both parties agreed during argument to accept a certification from defendants that there were no post-discharge entries made to decedent's EMR except for the April 22, 2018 discharge summary. Defendants should review the record and file a certification, not from counsel but from one of defendants' designees, see Rule 4:14-2(c), confirming this assertion or otherwise listing the dates of any other post-discharge entries in decedent's EMR. Defendants shall produce the metadata for any additional entries in advance of the onsite inspection. It is reasonable to compel defendants to produce the audit trail of decedent's EMR up to and including April 22, 2018, and, if later entries were in fact made to decedent's EMR, through those dates. We affirm as modified the judge's order in this regard.
We hasten to add that we cannot predict what the inspection of decedent's EMR or the production of a limited audit trail may reveal, and, therefore, do not foreclose the parties from seeking further relief in the Law Division.
The order under review is affirmed as modified, and the matter is remanded to the Law Division for further proceedings consistent with this opinion. The stay previously entered by our order granting leave to appeal is vacated. We do not retain jurisdiction.