Preserving Privacy Inside the Beltway: Responding to Congressional Demands for Sensitive Financial and Medical Information
By Steven R. Ross, Raphael A. Prober and Tom Moyer, Akin Gump Strauss Hauer & Feld LLP
The 111th and 112th Congresses have been defined by the groundbreaking deployment of Congress’s investigatory powers. Beginning in the aftermath of the global financial crisis and carrying forward through the passage of comprehensive financial reform and the national health care initiative, to name a few, congressional investigations have been a critical component of the national political and policy dialogue. In particular, recent congressional investigations of the financial services and health care industries have underscored emerging legal hazards and potential pitfalls for private counsel and those ensnared in congressional inquiries, as Congress’s demands for information operate outside of laws and rules that ordinarily govern discovery in civil and criminal litigation.
Counsel in the financial services and health care industries are, no doubt, accustomed to fielding requests for sensitive information—whether in the form of consumer financial data or private health records. Disclosure of these materials is ordinarily governed by procedures codified in statutes and federal regulations. Yet, when a congressional committee requests this type of information, the ordinary “rules of the road” do not necessarily apply, and counsel may find themselves thrust into a process where procedure is defined neither by statute nor by judicial ruling. Especially in this unsettled area of the law, it is essential, consistent with investigative realities, to attempt to protect a client’s privacy interests and to protect that client—be it an individual or a corporation—to the greatest extent possible from potential liability to its own customers.
This article provides legal and practical advice for clients facing congressional requests for private financial or health-related information, two areas in which Congress’s legal right to access private information remains largely unsettled. Federal statutes, including the Right to Financial Privacy Act (RFPA) and the Health Insurance Portability and Accountability Act (HIPAA), prescribe procedures for other federal law enforcement, regulatory, and investigatory authorities to access such information, yet these statutes do not clearly address congressional requests for such information from private parties. Although courts have historically afforded congressional committees broad authority to request private sector information—including trade secrets and confidential materials1—courts have not directly addressed the privacy implications and any relevant protections related to congressional demands for private information in the health and financial services sectors.
Congressional committees are typically willing to work with counsel to preserve the privacy rights inherent in the material requested, provided that the committee ultimately obtains the material it seeks, as necessary to complete its mission. An understanding of this unique area of the law and the assistance of counsel specializing in congressional investigations can aid to limit and manage sensitive, but required, disclosures to Congress, thereby allowing clients to navigate even the most substantial congressional requests for private information.
Laws Protecting Private Financial and Health-Related Information Offer Little Procedural Guidance for Dealing With Congressional Document and Information Requests
When responding to a congressional committee document request, preserving the sanctity of private customer, patient, or personal information is of paramount concern—it not only protects personal privacy, but can also have important implications as it relates to potential civil liability and exposure to customers. However, it remains unclear whether Congress must comply with federal privacy laws in gaining access to these materials, and the extent to which congressional committees may publicly disseminate any such information they do obtain is unsettled at best.
General Legal Standards Governing Congressional Use of Private Information
Counsel faced with congressional committee requests for private health or financial information should first be mindful of broader and comparatively well-defined legal standards governing congressional access to other classes of traditionally confidential information. For example, courts considering challenges to congressional requests for information containing proprietary trade secrets have traditionally trusted that committees will act “responsibly and with due regard for the rights of affected parties.”2 Even in the event of an unforeseen public disclosure, Congress is immune from liability in such cases so long as it acted with an arguably valid legislative purpose.3 These permissive rules afford broad authority to congressional committees, while posing serious concerns for private individuals and corporations.
Although these expansive legal standards do not apply specifically to congressional requests for private financial or health-related information, they nonetheless suggest that counsel should exercise extreme diligence and caution in responding on behalf of a client who receives a congressional request for information raising such privacy concerns.
Private Financial Records
The RFPA generally prohibits “government authorities” from accessing or obtaining copies of “information contained in the financial records of any customer from a financial institution.”4 However, to facilitate federal inquiries requiring access to such information, the RFPA articulates five circumstances under which disclosure of sensitive financial information to government authorities is permissible. These circumstances include disclosures made pursuant to: (1) customer authorization, (2) administrative subpoenas, (3) judicial subpoenas, (4) valid warrants, or (5) in response to formal written requests by government authorities.5 The latter circumstance, though broadly worded, only applies in situations where the requesting government authority—unlike a typical congressional committee—lacks subpoena power.6 In general, once a government authority or supervisory agency has obtained sensitive financial information from a financial institution, it may not transfer the information to another federal agency or department absent certification that the records are “relevant to a legitimate law enforcement inquiry … within the jurisdiction of the receiving agency or department,” and notification must be transmitted to impacted customers.7
It remains unclear whether Congress must comply with federal privacy laws in gaining access to these materials, and the extent to which congressional committees may publicly disseminate any such information they do obtain is unsettled at best.
Committee staff may contend, consistent with judicial rulings regarding trade secrets, that the RFPA was not intended to apply to Congress. Staff likely would point to the statute’s definition of a requesting “government authority” as “any agency or department of the United States,” without specific mention of the legislative branch.8 With respect to transfers of private information already held by federal agencies, the RFPA also provides that no section of the statute “shall authorize the withholding of information by any officer or employee of a supervisory agency from a duly authorized committee or subcommittee of Congress.”9 Accordingly, it could be argued that Congress is not bound by the RFPA’s safeguards and, further, that federal authorities need not notify institutional customers in connection with a congressional request for private financial information, as is otherwise required for inter-governmental transfers.10 However, this conclusion and the attendant confusion run counter to the clear intent of the law—to protect the private financial records of private individuals and to provide clear notice in situations where a valid governmental need for such information exists.
Private Health Records
Privacy regulations promulgated under HIPAA offer similarly scant procedural guidance in the event of a congressional request for private health-related information. In many respects, HIPAA affords little statutory protection to private health records in the face of a congressional request for documents, defining many broad categories of acceptable disclosure including to the individual, for treatment or payment purposes, and for public interest-related purposes.11
Pursuant to HIPAA’s public interest disclosure exception, custodians of private health care information may disclose such sensitive information for law enforcement purposes, including pursuant to an administrative subpoena.12 Unlike the RFPA, however, HIPAA privacy regulations make absolutely no reference to congressional disclosure, yielding even greater uncertainty as to the law’s applicability to congressional committees, with potentially unrestrained congressional access to health records ostensibly frustrating HIPAA’s clear purpose—to keep such records private.
Protecting Privacy and Related Interests When Fielding Congressional Requests for Sensitive Information
When faced with a congressional inquiry calling for sensitive financial, health, or other information, clients can best protect privacy and related legal interests by working with a practitioner skilled in the specialized field of congressional investigations.
The following suggestions are contemplated to guide counsel through the procedural and practical hurdles inherent in congressional inquiries implicating private financial or health-related information. Such approaches are commonly employed by congressional investigations counsel in responding to committee requests, and are consistent with the manner in which Congress typically exercises its oversight authority. It is critical to underscore that Congress’s own Oversight Manual addresses the gray area covered in this article head-on, and recommends opening a robust and ongoing dialogue with counsel, noting:
[A]rguments are likely to be advanced with respect to statutes expressly prohibiting the disclosure of information to the public or limiting disclosure to all but specific entities or government agencies, but are silent with respect to disclosures to Congress. … Potential solutions are negotiations with the target, accommodations in the form of accepted redactions or other means of providing the information, or a so-called “friendly subpoena ,” … .13
1. The Type of Sensitive Information Requested and the Identity of the Requesting Committee Both Matter
Committee jurisdiction can play a substantial role in defining the appropriate scope of a congressional inquiry. Committees derive their legislative and investigatory jurisdiction and authority from the rules of the chamber in which they sit, and their own rules further govern investigations and any use of compulsory process. Congress has also enacted additional statutory limitations, of which counsel should be cognizant, on access to certain classes of sensitive information—notably access to personal tax returns.14
2. Open a Dialogue With the Committee Staff and Attempt to Negotiate the Terms of the Document Request to Minimize or Manage Disclosure of Sensitive Information
In the world of congressional investigations, clients often do not end up playing the hand they were dealt. Congressional committees are often willing to discuss and modify the scope of an active document request when engaged by counsel. By engaging committee staff, counsel can first determine what information the committee assigns highest priority, can give the committee a realistic impression of the availability of requested information and the anticipated time frame to locate and assemble such information, can raise and address any privacy concerns, and can often establish a rolling production schedule to comply with the committee’s request.
3. Protect Institutional and Privacy Interests Through Use of Document Redaction, Friendly Subpoenas, and In Camera Review
Sidestepping the question of whether or not they apply, compliance with relevant privacy statutes in conjunction with congressional requests for information or documents may be achieved through appropriate redactions of sensitive information. As contemplated by Congress’s Oversight Manual, redactions should be negotiated with congressional committees on a case-by-case basis.15 Properly executed redactions of consumer financial records may ensure compliance with the RFPA, as the act does not prohibit “the disclosure of any financial records or information which is not identified with … a particular customer.”16 Similarly, HIPAA does not regulate “de-identified” health information, which includes private medical information with personally identifiable information redacted.17
Under normal circumstances, based on public relations, legal, and other considerations, targets of congressional investigations very often seek to avoid the issuance of a subpoena. However, in the context of a request for otherwise protected private information, requesting a “friendly” committee subpoena—and the accompanying compulsory process—may afford a target institution or individual the legal cover necessary to comply with an inquiry. Although voluntary disclosure of private information might expose the client to potential legal liability, the client’s participation ceases to be voluntary following the issuance of a subpoena.
For their part, committees accept and often anticipate that a friendly subpoena may be necessary to ensure compliance with a request for sensitive information. As House Oversight and Government Reform Committee Chairman Darrell Issa (R-Calif.) has noted:
[E]very chairman faces a subpoena now and then. Some of them are because individuals say I can’t speak unless you give me the immunity that a subpoena effectively gives me so that I can’t be sued for coming and speaking about matters that others may find somehow private or not to be disclosed.18
“In Camera” Review
When clients face a pressing need to define the terms of access to congressionally requested materials due to privacy concerns, an in camera review may be a viable option. Through this process, counsel may make private information available for review by committee staff, subject to specific parameters, under supervision, or for a limited time period, while not providing the committee with actual possession of the materials. Needless to say, this approach differs substantially from a typical in camera review in litigation—it does not involve reliance on an independent fact-finder but rather on the review of committee staff, itself.
It is critical that counsel be entirely forthright and professional in portraying to committee staff any privacy interest implicated by the relevant materials. If counsel loses credibility because of overly aggressive or misleading characterizations of private information, the negative impact on the working relationship with committee staff can complicate and negatively impact the investigation and the client going forward.
The in camera review process can afford substantial protections against unforeseen and undesirable public disclosures or leaks of private information during or after a congressional review of such information. Although an in camera review would afford the committee the substantive information it seeks from the documents in question, it would not provide the committee with the opportunity to use the documents as visual aids at a hearing, to transmit them to federal law enforcement or regulatory officials, or to provide them to plaintiffs’ attorneys.
* * *
It cannot be stressed strongly enough that congressional investigations are both legal and political exercises. The political and policy-based circumstances surrounding any given congressional investigation may dictate varying needs for private financial or medical information, as well as varying levels of committee tolerance for the protection of individual or institutional privacy rights. Especially given the unsettled nature of the law surrounding congressional access to private financial and medical information, Congress, its committees and staff, as well as counsel and the private clients they represent, would all benefit from a regularization of the process. Even in the absence of a clearly codified procedure governing Congress’s access to private financial or medical information, counsel that is well versed in the legal intricacies and unique procedural dynamics inherent in congressional investigations can be an immeasurable asset to corporations and individuals faced with a congressional inquiry.
Steven R. Ross is a partner at Akin Gump Strauss Hauer & Feld LLP, concentrating on congressional investigations, governmental ethics, federal election law, white-collar criminal defense, and constitutional issues. He served from 1983 to 1993 as the General Counsel of the U.S. House of Representatives. Raphael A. Prober is a counsel at Akin Gump Strauss Hauer & Feld LLP, focusing on congressional investigations, internal investigations, and white collar criminal defense. Tom Moyer has worked for several years as a public policy specialist in the congressional investigations practice at Akin Gump Strauss Hauer & Feld LLP, where he is now an associate.
This document and any discussions set forth herein are for informational purposes only, and should not be construed as legal advice, which has to be addressed to particular facts and circumstances involved in any given situation. Review or use of the document and any discussions does not create an attorney-client relationship with the author or publisher. To the extent that this document may contain suggested provisions, they will require modification to suit a particular transaction, jurisdiction or situation. Please consult with an attorney with the appropriate level of experience if you have any questions. Any tax information contained in the document or discussions is not intended to be used, and cannot be used, for purposes of avoiding penalties imposed under the United States Internal Revenue Code. Any opinions expressed are those of the author. Bloomberg Finance L.P. and its affiliated entities do not take responsibility for the content in this document or discussions and do not make any representation or warranty as to their completeness or accuracy.
© 2012 Bloomberg Finance L.P. All rights reserved. Bloomberg Law Reports ® is a registered trademark and service mark of Bloomberg Finance L.P.