Ongoing monitoring and auditing is essential to a safety program. The good news is that such reviews enable you to identify problems and/or opportunities to improve your current safety measures. The bad news is that in identifying the flaws and shortcomings in your program—or having an outside auditor do it for you—you’re creating a record that OSHA can use as evidence against you.
The key to protecting against this danger is not to refrain from self-assessment but to ensure that internal audit results can be shielded from OSHA’s prying eyes. The way to accomplish this is to use a legal doctrine called the attorney-client privilege to keep communications confidential. Here’s how.
Click here for a Model Memo illustrating how to establish the privilege when auditing your safety measures.
The Privilege and Its Limits
The reason privileges exist is because society has an interest in keeping certain communications confidential. For example, patients should be allowed to tell their doctors private and sensitive information about their health without fearing that it’ll be revealed to others. So there’s a doctor-patient privilege. Similarly, attorneys and clients need to be able to communicate freely with each other. The attorney-client privilege ensures that they can.
But the privilege isn’t automatic. There are certain hoops you need to jump through. To take advantage of the attorney-client privilege to shield internal documents like audit results you must involve your attorney in preparing those documents. But be careful. The common misconception is that you can protect the results of a safety self-audit just by having your general counsel conduct or oversee it. But if the audit was conducted as part of your regular business operations — for example, because your company has a policy for conducting audits every six months — the results of the audit won’t be protected.
Moreover, the privilege doesn’t protect facts revealed during an audit, such as the fact that a machine guard was not attached to a piece of equipment at the point of operation. “The privilege only protects legal advice based on the facts, not the facts themselves,” explains a Washington, DC, OSHA attorney.
Finally, the privilege can also be inadvertently waived, or lost, if you’re not careful. The lawyer-client privilege is a lot like fine china, says the attorney. “It’s difficult to make and easy to break.”
5 Tips on How to Use the Privilege
Here are 5 tips to help you and others who deal with legal and confidential safety matters protect confidential communications with your attorney.
1. Involve Attorney from Outset
Get the attorney involved at an early stage. For example, talk to your attorney before conducting a special audit to determine your organization’s compliance with OSHA recordkeeping requirements. Running the audit reports through your attorney will make them easier to protect.
Take the same measures when handling the reports of any outside consultants you may use. Ask your attorney for legal advice on the issue being audited. If possible, position things so the attorney hires the consultant to aid in the legal work. The consultant should also report back to the attorney rather than to your organization. This gives you a better chance of using the privilege to shield the results of the consultant’s report.
2. Put the Request for Legal Advice in Writing
To invoke the privilege, an attorney must be giving advice to a client in the capacity of an attorney as opposed to, say, an officer of the corporation. So make a request for legal advice and put it in writing. This is especially important for corporations where the in-house attorney is also a compliance director, corporate secretary or other officer. The writing should make it clear that you’re seeking advice from the person as an attorney, not as an officer.
3. Separate Legal from Business Duties
To avoid blurring the lines between persons who act as both corporate attorneys and officers, consider separating the functions. If the attorney sticks to legal functions, you won’t have to explicitly state that you want legal advice each time you consult him or her. “You’ll get better use of the privilege if you don’t let the attorney wear two hats to begin with,” says the Washington, DC, attorney.
4. Mark Information as Confidential
To keep sensitive information like internal safety audit results confidential mark them with the words “attorney- client privilege.” Many attorneys do this as a matter of course. But clients often don’t realize they should or forget to do this. Marking something as privileged will alert whoever handles it to take special steps to protect it and guard against accidental disclosures.
Compliance Pointer: Simply marking information “privileged” won’t automatically protect it. The privilege only protects legal advice, not business advice. So, for example, you probably can’t protect the results of a standard safety audit or accident investigation just by marking them “privileged and confidential.”
5. Don’t Disclose Privileged Information to Third Parties
A privilege can be waived if you disclose privileged information to third parties. So keep privileged memos and other documents away from people who don’t need to see them. If a third party does need to access to review privileged materials, reveal only the information necessary to carry out the purpose of the review and make sure they know that the documents are confidential.
For example, if you hire a remediation consultant to advise on potential OSHA violations you identified during a special self-audit, don’t share the full results of the audit with him. Instead, prepare a new report that tells him what issues you want him to consider. Tell him that all documents he reviews are confidential and must be returned as soon as possible after accessed.
Compliance Pointer: One good way to keep privileged documents confidential is to place them in a locked filing cabinet marked “Protected by Attorney-Client Privilege.” This will let investigators know that the materials are privileged and protected from any search warrant they may have.