As many workplaces have shifted to remote work arrangements, human resources personnel, in-house lawyers, and other workplace investigators are conducting more remote workplace investigations. Remote investigations may involve investigators working remotely, interviewing remote witnesses, or both. These investigations present numerous challenges for investigators and require maintaining a delicate balance between conducting a thorough investigation, protecting employee privacy rights, and ensuring the confidentiality and security of information shared and received by investigators.
Some of the biggest remote investigation challenges are addressed below, including the top 10 practical steps investigators can take to address them.
Challenges Faced By Remote Investigations
Investigators conducting remote investigations face a number of legal requirements, practical considerations, and challenges in ensuring the privacy of employee personal information and the confidentiality of information gathered or shared during an investigation.
Statutory Privacy Considerations
As an initial matter, employers have legal obligations to keep certain employee information private. For example, the Americans with Disabilities Act (ADA), the Health Insurance Portability and Accountability Act (HIPAA), and the Genetic Information Nondiscrimination Act (GINA) all contain requirements to keep certain employee medical information private.
Employers also have legal obligations to protect against the unauthorized release of employees’ Personally Identifiable Information (PII). Courts have recognized an employer’s duty to protect employees’ PII and imposed liability where that duty is breached. Investigators therefore must be careful to protect PII in the course of their investigations.
At the same time, for legal and practical reasons, remote investigators must keep investigative records confidential. First, limiting access to investigative documents minimizes claim and litigation risk. Second, maintaining confidential investigative records and communications is important for preserving attorney-client privilege and work product when counsel is consulted, or the investigation is directed by counsel. Third, investigators must maintain the confidentiality of certain business information pursuant to company confidential information policies. Finally, maintaining the confidentiality of information shared during an investigation to the extent possible encourages employees and other witnesses to be forthcoming and honest.
WFH Leads To A New Slate Of Challenges
Maintaining employee privacy and data confidentiality during a remote investigation, however, is particularly challenging. An investigator working from home may not have a separate, confidential space in which to work. The investigator could inadvertently discuss sensitive or personal matters in the presence of others in the household. Printing and disposing of documents containing personal employee information in the household trash, saving sensitive information to a personal device, emailing it to a personal email account for remote use, or simply leaving confidential documents lying around in the house may also result in inadvertent disclosure of private or confidential information.
Investigators who conduct interviews in public spaces, such as on Zoom or telephone calls made at a coffee shop, also risk exposing private or confidential information. Others in the shop may overhear the investigator’s discussion with a witness. Using the coffee shop’s public wifi system could also allow others to access that information.
Remote Witnesses Present Yet Another Hurdle
Interviewing remote witnesses also poses challenges. Other individuals who are unconnected to the investigation may be in the room but unseen by the investigator. Those individuals might overhear the investigative interview or see sensitive documents shared during the investigation. They could also document or record the interview for a variety of reasons, including use in future litigation or to share information from the interview with others.
Digital-Age Video Concerns
Finally, use of videoconference technology also raises potential issues. Open windows on computers during a videoconference call could inadvertently expose private or confidential information. Videoconference technology also creates the potential that personal or confidential information is mistakenly shared on a screen.
Top 10 Recommendations
How can an investigator best protect private and confidential information during a remote investigation? Consider these 10 recommended guidelines:
Recording Remote Interviews
The proliferation of teleconferencing tools such as Zoom, Microsoft Teams, and others has made conducting remote workplace investigations much easier. These technologies offer options for easily recording interviews, but should an investigator do so?
Recording remote interviews can be risky, particularly without obtaining the consent of the interviewee. Most states only require the consent of a single party to a recording. However, fifteen states require both (or all) parties to a conversation to consent to recording it. Those states include California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, Vermont, and Washington. In these states, investigators should obtain an interviewee’s express consent before recording a call or videoconference session. Notably, penalties for violating state statutes can include civil penalties as well as criminal liability.
Even assuming the witness consents to recording, investigators should consider whether it’s a good idea to record interviews. A key consideration is whether the recording would be discoverable in any litigation or other proceeding, or perhaps would be subject to production to government investigators such as the Equal Employment Opportunity Commission, Department of Labor, and others. There can be benefits and drawbacks to producing the recordings. Investigators should carefully consider whether recording interviews is the best approach in each case and with each witness. Particularly when a matter is more likely to wind up in litigation, investigators should consult with counsel about the pros and cons of recording remote interviews.
How can investigators ensure that remote interviews are properly and lawfully recorded?
Data security is a big issue in workplaces generally and an important consideration in remote workplace investigations. As an initial matter, investigators should ensure that they are conducting remote investigations using secure technology. If using Zoom, for example, review the security settings and be sure to use the most secure methods possible (including password-protecting meetings, enabling the “private meeting” setting, and disabling screen sharing for participants and private chat).
Additionally, avoid using consumer shared drives to share sensitive documents and information. It’s best to use a secure data sharing platform, which should include end-to-end encryption to prevent third parties from accessing shared data.
Securely sharing company documents for a remote interview also presents confidentiality challenges. Potential options include sharing documents on the screen during a videoconference, sending hard copies of the documents just before the interview, or using a secure file sharing system such as a virtual data room. None of these options is foolproof. Whatever method an investigator chooses, investigators should require witnesses to sign a non-disclosure agreement prior to the interview, which should include provisions prohibiting reproduction of documents, use of data or documents for any purpose other than the interview, and requiring return of all hard copy documents, if applicable.
Smart speakers are another hot button issue in remote investigations. Investigators may have smart speakers such as Alexa and Siri in their homes or on their phones. These smart speakers record verbal communications, which are analyzed by the companies who sell them to improve their artificial intelligence capabilities. Investigators therefore need to be particularly careful about ensuring that they are not within earshot of smart speakers when conducting remote investigations.
Finally, investigators should be aware of and follow appropriate data preservation and storage protocols. Conducting remote investigations creates new challenges in the data security realm, as investigators need to ensure that sensitive and confidential data collected is properly managed. Employers should update data storage and retention policies to ensure that remote investigators have proper guidance on data storage.
What are some best practices for ensuring information security in remote investigations?
Remote investigations are convenient, efficient, and likely are here to stay. They present numerous privacy, confidentiality and data security challenges, but with proper planning, a remote investigator can ensure compliance with applicable laws and business needs.