Michael E. Zidek

Dale Dobuler (Partner-Orlando, FL) and Nick Freeman (Partner-Orlando, FL) secured final summary judgment in an insurance coverage action in federal court seeking a declaration of non-coverage for an underlying wrongful death claim involving a commercial auto policy issued to a Florida-based business.  Prior to the coverage action,  plaintiff’s counsel issued a presuit demand of $1 million to the insured and its commercial auto carrier. Dale and Nick argued that coverage for the plaintiff’s claim was precluded by certain policy exclusions for injuries involving the insured's employees. They filed a declaratory action in US District Court. After establishing that the injury arose from or was directly connected to the deceased’s employment with the insured, the Court granted the carrier’s motion for summary judgment against the insured on two independent grounds. First, the insured failed to timely respond to the motion, despite being advised that failure to do so would render the motion unopposed under the applicable local rules. The Court therefore granted the motion as unopposed. Second, the Court granted the motion on the merits, adopting the reasoning set forth in the carrier’s motion and finding that the undisputed record established that the accident fell outside the policy’s coverage. Specifically, the Court determined that the insured was not entitled to coverage as a matter of law because the policy clearly excluded coverage for the accident under three separate exclusions. The order therefore fully resolved the declaratory coverage issue against the insured and established a lack of coverage for the claim.

Kimberly Silas (Of Counsel-New Orleans, LA), who had previously served for two years as Secretary of the New Orleans Bar Foundation, was unanimously elected to serve as the organization’s President for the upcoming year. She will be installed, along with fellow Board members, at the New Orleans Bar Association’s Annual Dinner on November 19, 2026. In her new leadership role, Kimberly looks forward to expanding her efforts to give back to the local legal profession and the greater New Orleans community.

Dean A. Rocco (Partner-Los Angeles, CA) will present the Wilson Elser Forum webinar “California at Work: Key Employment Law Developments in 2026” on November 5, 2026. This program reviews the new laws and legislative enactments from the recently closed 2026 legislative session, as well as key employment law decisions issued during the year. Attendees will learn how the law impacts California employers, where new liabilities may arise due to changes to the law, and strategies for complying with the law to avoid employee claims. 

In Snyder v. Virginia Mason Medical Center, No. 104136-5 (Wash. Oct. 1, 2026), the Washington Supreme Court held that corporate defense counsel, risk managers, and claims adjusters may not communicate ex parte with a hospital’s former employee health care providers about patient care. The Court reaffirmed Loudon v. Mhyre, 110 Wn.2d 675, 756 P.2d 138 (1988) prohibiting ex parte communication by defense counsel with a plaintiff’s treating physicians, held that prejudice is presumed when Loudon is violated, and ruled that a quality improvement (QI) committee member’s involvement in defense strategy waives the committee’s statutory privilege under Wash. Rev. Code § 70.41.200. As a result, informal contact with former employee providers should stop, and factual inquiries should proceed through formal discovery under Wash. Super. Ct. Civ. R. 30 or 31. This article explains how Snyder fits within Washington’s patient confidentiality and corporate privilege framework, how it applies to different categories of providers, and what hospitals and their counsel should do now. Patient Confidentiality vs. Corporate Privilege To navigate the procedural boundaries governing medical malpractice defense in Washington, practitioners must understand the fundamental statutory tension between a patient’s right to health care confidentiality and an institution's right to confer with corporate counsel. Under Washington's Uniform Health Care Information Act, health care providers and their agents are strictly prohibited from disclosing health information without explicit written authorization, except as otherwise provided by law. Wash. Rev. Code § 70.02.020; State v. Scherf, 192 Wn.2d 350, 387, 431 P.3d 976, 995 (2018); King v. Riveland, 125 Wn.2d 500, 509, 886 P.2d 160, 165 (1994). This privacy right is reinforced by Washington's statutory physician-patient privilege, which protects treating physicians from being compelled to testify regarding medical information acquired while attending a patient. Wash. Rev. Code § 5.60.060(4). While a patient automatically waives this statutory privilege upon filing a personal injury or medical malpractice lawsuit under Wash. Rev. Code § 5.60.060(4)(b), the Washington Supreme Court has consistently held that this waiver is not absolute. In Loudon v. Mhyre, 110 Wn.2d 675, 678, 756 P.2d 138, 140 (1988), the Court established a bright-line prohibition against defense counsel engaging in private, ex parte communications with a plaintiff’s treating physicians. The Loudon rule safeguards the fiduciary doctor-patient relationship, prevents inadvertent disclosure of irrelevant medical records, and eliminates the risk of turning defense attorneys into potential trial witnesses. Loudon, 110 Wn.2d at 682, 756 P.2d at 142; Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d 659, 666, 244 P.3d 939, 942–43 (2010). On the corporate side, health care facilities rely on corporate attorney-client privilege to conduct internal risk investigations. Wash. Rev. Code § 5.60.060(2)(a); Upjohn Co. v. United States, 449 U.S. 383, 389, 101 S. Ct. 677, 682, 66 L. Ed. 2d 584 (1981). However, in Newman v. Highland School District No. 203, 186 Wn.2d 769, 381 P.3d 1188 (2016), the Washington Supreme Court established a strict temporal boundary on corporate privilege, holding that privilege does not extend to post-employment communications with former employees: “The underlying purpose of the corporate attorney-client privilege is to foster full and frank communications between counsel and the client (i.e., the corporation), not its former employees... This purpose is preserved by limiting the scope of the privilege to the duration of the employer-employee relationship.” Newman, 186 Wn.2d at 781, 381 P.3d at 1193 (quoting Restatement (Third) of the Law Governing Lawyers § 73 cmt. e (Am. L. Inst. 2000)). Evolution of Provider Contact Rules: Current vs. Former Personnel How does one reconcile corporate attorney-client privilege with the Loudon doctrine? The Supreme Court addressed this conflict in Youngs v. PeaceHealth, 179 Wn.2d 645, 664, 316 P.3d 1035, 1045 (2014), carving out a narrow exception allowing corporate defense counsel to conduct confidential ex parte interviews with a nonparty treating physician who is a current employee of the hospital, provided those communications are limited strictly to the facts surrounding the alleged negligent incident. In Hermanson v. MultiCare Health System, Inc., 196 Wn.2d 578, 581, 475 P.3d 484, 487 (2020), the Court extended this principle to current non-physician staff and current independent contractors who are the functional equivalents of employees. However, when a treating provider leaves the facility's employ, the legal landscape shifts dramatically across four distinct provider categories: Current Employee Providers: Fully covered under the Youngs exception. Corporate defense counsel may conduct privileged, ex parte interviews with active employee physicians, nurses, and staff, provided the conversation is confined to the facts of the alleged negligent incident and does not delve into general medical history. Youngs v. PeaceHealth, 179 Wn.2d at 671. Current Independent Contractors: Covered under Hermanson where an agency or functional equivalent relationship exists. If an independent contractor doctor acts as an agent of the facility, corporate counsel may confer ex parte under the same strict factual constraints of Youngs. Hermanson v. MultiCare Health Sys., Inc., 196 Wn.2d at 589–90. Former Employee Providers (Including C-Suite Officers & Owners): Governed strictly by Newman and Snyder. The moment a provider separates from employment, it instantly extinguishes corporate attorney-client privilege over ongoing trial preparation. Because former employees no longer owe agency duties, defense counsel cannot conduct ex parte interviews with former staff regarding patient care under any circumstances. Snyder v. Virginia Mason Med. Ctr., slip op. at 28–29. Quality Improvement (QI) Committee Members: Subject to statutory peer-review immunity under Wash. Rev. Code § 70.41.200(3). While records prepared for QI committees are immune from discovery, committee members must be strictly screened from litigation defense teams. If a QI member participates in active trial strategy or ex parte witness preparation, statutory peer-review privilege is completely forfeited. Snyder, slip op. at 38–39. The Snyder Decision: Presumed Harm, Privilege Logs, and QI Waiver In Snyder v. Virginia Mason Medical Center, No. 104136-5, slip op. (Wash. Oct. 1, 2026) (En Banc), the Washington Supreme Court resolved lingering uncertainties by establishing three definitive holdings that fundamentally reshape medical malpractice litigation. 1. Rejection of Defense Exceptions and Affirmance of Loudon The Supreme Court affirmed that Loudon applies strictly to former employee health care providers, regardless of whether their care forms the primary basis of the hospital's alleged vicarious liability. In doing so, the Court explicitly rejected a series of defense theories: Representation Agreements & Indemnity Contracts: Private employment contracts requiring former doctors to cooperate in litigation defense cannot override statutory patient privacy rights under Wash. Rev. Code § 70.02.020 or physician-patient privilege under Wash. Rev. Code § 5.60.060(4). Hermanson, 196 Wn.2d at 590 n.1; Snyder, slip op. at 25–26. Common Interest / Joint Defense Theories: Shared legal exposure does not authorize defense counsel to conduct ex parte trial strategy sessions with former employee providers or their separate attorneys. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Inapplicability of Youngs: The Court confirmed that the fiduciary doctor-patient relationship survives employment termination, placing former employee providers strictly beyond the reach of the Youngs current-employee exception. Snyder, slip op. at 28–29. 2. Magaña and the Presumption of Prejudice Crucially, the Supreme Court disavowed its prior decision in Magaña v. Hyundai Motor America, 167 Wn.2d 570, 220 P.3d 191 (2009), which required plaintiffs to prove substantial litigation prejudice to obtain discovery sanctions. Holding that ex parte contacts inherently damage the fiduciary doctor-patient relationship, the Court established that prejudice is presumed upon demonstrating a Loudon violation. Snyder, slip op. at 33–34. To evaluate appropriate sanctions—ranging from monetary fines to entering a default judgment on liability—the Supreme Court extended Cedell v. Farmers Insurance Co. of Washington, 176 Wn.2d 686, 295 P.3d 239 (2013), ordering the trial court to conduct an in-camera inspection of all withheld defense privilege log entries generated during unauthorized ex parte contacts. Snyder, slip op. at 35–36. 3. Subject-Matter Waiver of Quality Improvement Immunity Under Wash. Rev. Code § 70.41.200(3), hospital Quality Improvement committee proceedings are confidential. However, in Snyder, the Chief Medical Officer sat on the hospital’s statutory QI committee while simultaneously receiving litigation talking points from defense counsel, coordinating witness outreach, and traveling ex parte to meet with a former resident physician. The Supreme Court held that failing to ethically screen a QI committee member from active litigation strategy taints the committee's inner workings, effecting a complete subject-matter waiver of statutory peer-review privilege. Snyder, slip op. at 38–39. Real-World Realities: Memory Decay, Pre-Litigation Holds, and Sophistication At the end of the day, modern institutional health care delivery renders determining the exact composition of a patient's treatment team—and whether defense counsel is legally permitted to speak with any given provider—an exercise in pure guesswork. It has long been complicated for patients and health systems to figure out who their doctor is in a complex clinical environment involving rotating resident physicians, attending specialists, hospitalists, and independent contractors. Yet, now no one seems to know who the doctor might not be and whether defense counsel should be speaking to them behind closed doors. By establishing an unyielding temporal boundary that severs corporate attorney-client privilege the exact moment an employee separates from service, Newman, 186 Wn.2d at 781, and Snyder, slip op. at 20, 28–29, creates an unworkable practical fiction. In effect, this rigid rule generates an absurd practical presumption: that no health care practitioner can ever retire, relocate, or transition employment if any remote possibility of future litigation may ensue. This jurisprudence fundamentally neglects two operational realities of medical malpractice defense: the necessity of pre-litigation risk investigations and the natural fading of human memory. When an adverse clinical outcome occurs, risk management must investigate immediately to evaluate institutional exposure. While an institution can readily issue electronic litigation holds to preserve health records, paper charts, and audit trails, it is impossible to ask a human witness to hold onto their unrefreshed memories. While interviewing a witness when a facility first learns of a potential claim is straightforward, months or even years frequently elapse between the medical event, the formal filing of a lawsuit, and the procedural opportunity for defense counsel to deploy formal discovery rules under Wash. Super. Ct. Civ. R. 30 or CR 31. Expecting a treating physician to maintain vivid, detailed recollections of a single procedure performed years earlier—without the benefit of informal factual debriefs with risk management—defies human memory and litigation reality. Finally, this line of authority improperly presumes a uniform, strict sophistication across all health care facilities. Snyder presumes that every community hospital, rural health clinic, and small practice group maintains the extensive legal infrastructure, ethical screening walls, and specialized claims teams of a major academic medical center. By imposing strict liability sanctions and an automatic presumption of prejudice for ex parte contacts regardless of actual litigation harm (Snyder, slip op. at 33–34), the Court penalizes health care entities for standard risk management inquiries while ignoring the operational realities of modern medical practice. Specific Application Cases: C-Suite, Mid-Suit Separation, and Dual Roles A. Former C-Suite Executives, Board Members, and Physician-Owners A frequent point of defense confusion is whether a physician’s former status as a C-suite executive (e.g., Chief Medical Officer), board member, or equity owner exempts them from Loudon. Under Washington law, the extent of corporate privilege coverage depends entirely upon temporal status and the subject matter of the communication. This includes: Pre-Separation Corporate Governance Communications (COVERED): Confidential communications made during active executive, board, or ownership tenure regarding hospital administration, risk management, or general business operations remain protected by the entity's attorney-client privilege under Upjohn Co. v. United States, 449 U.S. 383, 391 (1981) and Wash. Rev. Code § 5.60.060(2)(a). Post-Separation Patient Care Communications (NOT COVERED): Once employment, board tenure, or equity ownership severs, corporate attorney-client privilege terminates. Newman, 186 Wn.2d at 781. Reaffirming Newman, the Supreme Court in Snyder, slip op. at 20, 28–29 held that former executive or ownership status creates no exception to Loudon. Because former C-suite physicians and owners no longer possess agency authority or ongoing duties of loyalty to the entity, defense counsel cannot engage in post-separation ex parte trial preparation regarding patient care provided by that physician. B. Mid-Litigation Employment Termination If a treating physician’s employment terminates during active medical malpractice litigation, corporate attorney-client privilege over ongoing trial preparation instantly evaporates at the moment of separation. Under Newman and Snyder, corporate defense counsel is strictly barred from conducting further ex parte strategy sessions with the departing physician, practically necessitating separate independent counsel for the physician to prevent per se Loudon violations and concurrent conflicts under Rule of Professional Conduct 1.7. C. Dual-Roled Physicians and Corporate PMK Designees Quality Improvement (QI) committee members represent one of the most perilous legal landmines for health care facilities under Snyder, slip op. at 38–39. Health care facilities face an inherent dilemma: the individuals best situated to serve as key corporate contacts or Person Most Knowledgeable (PMK) designees under Wash. Super. Ct. Civ. R. 30(b)(6)—such as CMOs or Medical Directors—are almost universally the exact same clinical leaders who sit on statutory QI committees. When a lawsuit emerges, institutions routinely rely on senior officers to investigate the incident and coordinate witness outreach. However, under Snyder, combining statutory peer-review functions with litigation defense strategy destroys the statutory privilege protecting the facility's Quality Improvement proceedings. To protect peer-review immunity, institutions ought to consider implementing proactive, pre-litigation organizational role separation: structurally dividing clinical governance so that high-level physicians on QI committees are permanently barred from acting as litigation claims liaisons or CR 30(b)(6) designees. Practical Compliance  To navigate the strict mandates of Snyder and protect case integrity, corporate defense counsel and health care risk managers must adopt three mandatory practice protocols: Conduct Factual Discovery Exclusively Through Formal Court Rules. Defense counsel must refrain from informal telephone calls, debriefs, or “support visits” with former employee providers. All factual inquiries must occur through formal oral depositions under Wash. Super. Ct. Civ. R. 30 or written depositions under Wash. Super. Ct. Civ. R. 31 upon formal notice to plaintiff's counsel. Strictly Prohibit Using Separate Counsel as a Conduit. If an insurer assigns separate independent counsel to represent a former employee provider under continuing indemnification duties, primary corporate counsel cannot pass trial briefs, expert reports, or strategy talking points ex parte to separate counsel. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Establish Proactive Pre-Litigation QI Ethical Walls. Health care facilities must structurally divide clinical governance so that high-level physicians who serve on statutory Quality Improvement peer-review committees are permanently barred from acting as corporate claims liaisons, risk defense managers, or corporate Person Most Knowledgeable (PMK) designees under CR 30(b)(6). Proactive ethical screening is essential to prevent subject-matter waiver of statutory peer-review immunity under Wash. Rev. Code § 70.41.200.

Nancy Wright (Partner-New York, NY) and Aaron Bengart (Associate-New York, NY) secured a “no probable cause” finding and dismissal of a discrimination and retaliation complaint before the New York State Division of Human Rights (DHR) on behalf of Wilson Elser’s private school client. A former part-time assistant girls’ basketball coach alleged discrimination based on age, disability, familial status, marital status, and sex, as well as retaliation, after the school declined to renew her contract. Nancy and Aaron demonstrated that complainant had proffered no factual allegations supporting an inference of discrimination based on any protected category, that the school had legitimate, non-discriminatory business reasons for not renewing the complainant’s contract ‒ including tardiness and performance issues ‒ and that she could not show pretext. They also established that the retaliation claim failed because the complainant had not engaged in any protected activity, and her allegations concerned workers’ compensation issues outside the DHR’s jurisdiction. In its Determination and Order After Investigation, the DHR agreed with the school’s arguments and dismissed the complaint for lack of probable cause to support discrimination and retaliation.

On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923 (Chapter 482, Statutes of 2026), known as the Expanding Privacy Rights Act. The law amends two provisions of the California Consumer Privacy Act (CCPA): (1) the right to delete (Civil Code § 1798.105); and (2) the methods for submitting consumer requests (Civil Code § 1798.130). The legislation was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency (also known as CalPrivacy). This amendment takes effect January 1, 2027. A deletion request will now reach personal information that a business bought or received from others, not only what the consumer provided. Online-only businesses must also offer a web form or portal for privacy requests. For most companies, this is an operational change rather than a new program, but it reaches data stores that many request workflows never touch. Reasons Behind the Amendment Under the prior CCPA text, consumers could request deletion only of information a business collected “from the consumer.” The California Legislature found that the existing right “allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties. This creates a gap in protection.” S.B. 923, 2025–2026 Leg., Reg. Sess. § 1(b) (Cal. 2026) (enacted as 2026 Cal. Stat. ch. 482). CalPrivacy, the legislation’s sponsor, noted that “businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete.” CalPrivacy, California Expands Privacy Protections by Strengthening Deletion Rights (Sept. 27, 2026). With respect to the means for the submission of the requests, the current CCPA regulations require a webform only from businesses that are not exclusively online, and only if they have a website. See 11 CCR § 7020(b) (requests "shall be through its website, such as through a webform."). Online-only businesses with a direct consumer relationship still need only an email address under § 7020(a). As Senator Becker, the author of this bill, explained in his statement, “while most businesses must provide two or more methods to submit privacy requests, online-only businesses that have a direct relationship with the consumer are only required to provide an email address for consumers to submit most privacy requests under the CCPA. This single-method requirement for certain businesses creates barriers for consumers because it offers minimal support or guidance.” Assemb. Comm. on Privacy & Consumer Prot., Analysis of S.B. 923, 2025–2026 Leg., Reg. Sess., at 5 (Cal. June 23, 2026) (as amended June 11, 2026) (quoting author's statement). CalPrivacy, which sponsored the bill, says it aligns California with deletion rights in Delaware, Indiana, Maryland, and New Jersey, and stresses that the CCPA’s existing exemptions, including fraud prevention and legal compliance, remain available. What the Statute Now Says Broader Deletion Right Amended Section 1798.105(a) provides: “A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.” Suppression Records for Third-Party Data For data obtained from other sources, the law gives businesses a defined way to comply: “A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal information remains deleted from the business’s records and is not being used for any other purpose.” Expanded Downstream Obligations The existing duties still apply: the business must “notify any service providers or contractors to delete the consumer’s personal information from their records and notify all third parties to whom the business has sold or shared the personal information,” unless “this proves impossible or involves disproportionate effort.” Service providers and contractors “shall cooperate with the business in responding to a verifiable consumer request.” Because the deletion right is broader, these flow-down duties now reach a larger set of records. Preserved Exceptions  Businesses may still retain information when reasonably necessary to, among other things, “[h]elp to ensure security and integrity” or “[c]omply with a legal obligation.” New Online Request Requirement Amended Section 1798.130(a)(1)(A) provides that a business that “operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address and make an online method, such as a web form or online portal, available” for requests to know, delete, or correct. An email inbox alone will no longer suffice. What Is Required, From Whom, and When Beginning January 1, 2027, every business subject to the CCPA must honor deletion requests for personal information it holds about a consumer, whether it collected that data from the consumer or got it from a broker, vendor, or other third party. For data collected from other sources, a business complies with the new requirements by keeping a record of the request and only the minimum data needed to make sure the consumer's information stays deleted. Service providers and contractors must assist the business in their responses to the consumer rights requests. At the business's direction, they must delete the data and notify their own downstream service providers and contractors to do the same.  Starting from January 1, 2027, a business that operates exclusively online and has a direct relationship with consumers must now offer an online method, such as a web form or portal, in addition to an email address, for submission of consumer requests. Businesses with brick-and-mortar presence keep their current obligation to offer at least two methods for consumer requests, including a toll-free telephone number. Practical Steps to Take Before January 1, 2027 Compliance with contemporary data privacy laws must involve technical solutions along with legal and compliance ones. Online-only businesses seeking to implement the webform or portal for the first time must be mindful of the privacy laws-related requirements, including the need for verification, the regulatory response timelines, and the recordkeeping requirements related to the fulfilled requests. All businesses subject to CCPA should also take the time to map where personal information sourced from third parties resides in their systems, extend deletion workflows to those systems, and build or check their suppression records workflow. This is also a good time to review the mandatory service provider and contractor agreements to confirm compliance with California’s requirements, including support for deletion rights cooperation and flow-down provisions.  Wilson Elser’s Data Use and AI Governance team can help businesses assess how SB 923 affects their deletion workflows, third-party data sources, vendor agreements, and consumer request intake, and can advise on CCPA compliance and other privacy law questions as they arise.

Q: Are employees entitled by law to access their personnel files?   A: There is no federal law that gives private-sector employees the right to view their personnel files. Access is regulated entirely by state-specific laws. There are currently 19 states that legally require employers to permit employees (and sometimes former employees) to view and/or obtain a copy of their personnel file. As of November 8, 2026, that number will increase to 20, when New York’s recently enacted Personnel Records Access Law goes into effect. The majority of states have no law requiring access to personnel files and there is no federal law that confers on current or former employees a statutory right to access their personnel files.  As of October of 2026, the following states provide right of access to current employees: Alaska, California, Colorado, Connecticut, Delaware, Illinois, Iowa, Maine, Massachusetts, Michigan, Minnesota, Nevada, New Hampshire, Oregon, Pennsylvania, Rhode Island, Virgina, Washington, and Wisconsin.  Some states, including New York (as of November 8, 2026), also allow former employees to view their personnel files. Each state has its own caveats to access. For example, Washington allows for a former employee to retain the right of rebuttal or correction for up to two years following their separation from employment.  New York’s new law, Senate Bill 2025-S3460, was signed by Governor Kathy Hochul on September 9, 2026, adding Section 210-b to the New York Labor Law. The law covers public and private sector employers, including individuals, corporations, partnerships, labor organizations, unincorporated associations, other legal businesses and employer agents.  Employers operating in New York should familiarize themselves with the requirements of Section 210-b now, before it goes into effect, and update their document-management and onboarding practices accordingly, as non-compliance may expose them to claims under the New York Labor Law.  What Will New York Law Require? The law in New York will require employers to provide current and former employees with a copy of their personnel records within five (5) business days of a written request, up to twice per calendar year, at no cost to the employee. Employers also must notify employees within ten business (10) days after placing information in a personnel record that is, has been, or may be used to negatively affect the employee’s qualifications for employment, promotion, transfer, additional compensation, or the possibility of disciplinary action. If there is a disagreement with any information within the personnel record, removal or correction of the information may be mutually agreed upon by the employer and the employee. If the employee doesn’t agree with the information the employer places in the file, the employee can submit a written statement explaining the employee’s position, which must become a part of the employee’s personnel record and must accompany the disputed information when it is transmitted to a third party, so long as the original information remains in the file. Employers are not required to permit an employee to review their personnel record more than twice per calendar year, but a notification and review resulting from the placement of negative information in the record does not count toward that limit. Under the new law, to the extent employers create personnel records, without deletions or expungement of information, they are required to maintain them from the date of employment through three years after termination of the employee’s employment. What Types of Documents Are Covered Under New York’s Personnel Records Law? The New York law expressly defines “personnel records” to include the following written information and documents prepared by an employer regarding an employee, for inclusion in the employee’s personnel record: Name, address, date of birth, job title and description  Rate of pay and any other compensation paid to the employee Starting date of employment  The job application of the employee  Resumes or other forms of employment inquiry submitted by the employee to the employer in response to the employer's advertisement  All employee performance evaluations, including but not limited to employee evaluation documents  Written warnings of substandard performance  Lists of probationary periods  Waivers signed by the employee Copies of dated termination notices  Any documents relating to disciplinary action regarding the employee The law applies broadly and is not limited to the above-listed documentation. Examples of documents also likely covered include: 1. Employment agreements and offer letters signed at the start of the employment relationship 2. Handbook and policy acknowledgment forms, such as sign-offs on anti-harassment policies, code of conduct agreements, or confidentiality acknowledgments 3. Performance improvement plans that the employee is asked to sign to confirm receipt 4. Separation-related documents, such as resignation acknowledgments or exit interview forms, to the extent they are placed in the personnel file Note that the law expressly excludes, “information of a personal nature about a person other than the employee if disclosure of the information would constitute a clearly unwarranted invasion of such other person’s privacy.” The law prohibits employers and other persons from discharging, threatening, penalizing, discriminating, or retaliating against employees who exercise their statutory rights.  Practical Tips for New York Employers New York employers should keep several practical points in mind as they prepare to comply with Section 210-b of the Labor Law: 1. Review current practices and protocols. Before November 8, 2026, New York employers should review their personnel record practices and retention procedures. Employers should establish a protocol for tracking and responding to an employee’s request for the employee’s personnel file. Determine whether your organization already provides employees with copies of all signed personnel documents. Employers also should evaluate whether covered personnel records maintained by third-party providers can be produced within five business days.  2. Update onboarding and HR workflows. Ensure that standard operating procedures require HR personnel and managers to provide a copy of every signed document to the employee at the time of signing. Consider building this step into electronic onboarding platforms and document management systems so that copy delivery is automatic rather than dependent on individual compliance to ensure timely compliance with the notification requirements. 3. Leverage electronic signature and document management tools. Employers using e-signature platforms can configure them to send a completed copy of each signed document to the employee automatically, which streamlines compliance and creates a reliable audit trail. 4. Train HR staff and supervisors. Managers and HR professionals who handle personnel paperwork should be informed of the new requirement and understand that every signed document placed in a personnel file must be accompanied by delivery of a copy to the employee. Employers should train HR personnel and managers on the law’s access, notice, retention, and anti-retaliation requirements. 5. Document delivery of copies. Maintain a record confirming that each signed document was provided to the employee. Whether through an electronic system's automatic confirmation, an email transmittal, or a signed acknowledgment of receipt, this documentation can be important if compliance is later questioned. What Are the Risks of Non-Compliance? For companies that violate the law, New York’s Attorney General would be empowered to seek penalties ranging from $500 to $2,500 per violation, and workers who face discrimination or retaliation for asserting their rights would have a private right of action. Broader Considerations New York's enactment of Section 210-b is part of a broader trend of states strengthening employee access to workplace records. For instance, California employers must allow current and former employees to inspect and receive copies of personnel records relating to the employee’s performance or any grievance concerning the employee. In addition, California employers must also provide education and training records upon the employee’s authorized request within a 30-day window. In contrast, employers in the state of Texas are not required to turn over personnel files to current or former employees. Employers operating in multiple jurisdictions should be aware that personnel-file access laws vary significantly from state to state. 

Adam R. Bialek (Partner-New York, NY) and Taylor F. Bialek (Associate-New York, NY) will present the Wilson Elser Forum webinar “Web Accessibility Under the ADA and State Laws: Best Practices and Compliance” on November 3, 2026. This session provides a practical overview of the legal landscape governing web accessibility, including obligations under federal and state laws, and compliance best practices. The session covers the WCAG 2.1 technical standards, upcoming compliance deadlines, the current litigation environment, and actionable steps organizations can take to reduce exposure and build accessibility into their website operations. Designed for claims professionals, in-house counsel, risk managers, and insurance professionals, the presentation includes a general compliance checklist and a discussion of defense strategies and common pitfalls, including the limitations of third-party overlay tools.

Wilson Elser has been named to BTI Consulting Group’s “Intimidating Opponents for 2027” list, published in its September 23, 2026, report, Clients Single Out the Most Feared Law Firms in Litigation. The recognition highlights the law firms that corporate counsel least want to face on the opposing side of a dispute. In high-stakes litigation, the experience, reputation, and strategic capabilities of opposing counsel can influence how parties assess litigation risks, costs, and potential outcomes ‒ even before a case gets underway. BTI Consulting Group conducts independent research examining how clients acquire, manage, and evaluate professional services providers. For this recognition, BTI surveyed corporate counsel to identify the law firms they consider the most formidable litigation opponents. A total of 92 firms were named to the 2027 list.

Michelle Gallagher (Partner-Boston, MA) and Taylor F. Bialek (Associate-New York, NY) will present the Wilson Elser Forum webinar “Trademark Law and Brand Building: Protection and Enforcement Strategies” on November 10, 2026. This presentation delivers an engaging and practical overview of trademark law. Michelle and Taylor examine the lifecycle of a brand – from initial brand selection and clearance to the development and implementation of effective filing strategies – highlighting the importance of building a strong, protectable brand identity from the outset. Expanding beyond the basics, the session also explores global brand protection and enforcement strategies, offering insight into how companies safeguard their trademark portfolios across jurisdictions and develop proactive strategies to deter potential infringement. These topics are relevant to entrepreneurs, corporate executives, and independent business owners, providing a cohesive framework for understanding how legal strategy can support and sustain brand value in a competitive, international marketplace.

Dean A. Rocco (Partner-Los Angeles, CA) will present the Wilson Elser Forum webinar “California at Work: Key Employment Law Developments in 2026” on November 5, 2026. This program reviews the new laws and legislative enactments from the recently closed 2026 legislative session, as well as key employment law decisions issued during the year. Attendees will learn how the law impacts California employers, where new liabilities may arise due to changes to the law, and strategies for complying with the law to avoid employee claims. 

Kimberly Silas (Of Counsel-New Orleans, LA), who had previously served for two years as Secretary of the New Orleans Bar Foundation, was unanimously elected to serve as the organization’s President for the upcoming year. She will be installed, along with fellow Board members, at the New Orleans Bar Association’s Annual Dinner on November 19, 2026. In her new leadership role, Kimberly looks forward to expanding her efforts to give back to the local legal profession and the greater New Orleans community.

Dale Dobuler (Partner-Orlando, FL) and Nick Freeman (Partner-Orlando, FL) secured final summary judgment in an insurance coverage action in federal court seeking a declaration of non-coverage for an underlying wrongful death claim involving a commercial auto policy issued to a Florida-based business.  Prior to the coverage action,  plaintiff’s counsel issued a presuit demand of $1 million to the insured and its commercial auto carrier. Dale and Nick argued that coverage for the plaintiff’s claim was precluded by certain policy exclusions for injuries involving the insured's employees. They filed a declaratory action in US District Court. After establishing that the injury arose from or was directly connected to the deceased’s employment with the insured, the Court granted the carrier’s motion for summary judgment against the insured on two independent grounds. First, the insured failed to timely respond to the motion, despite being advised that failure to do so would render the motion unopposed under the applicable local rules. The Court therefore granted the motion as unopposed. Second, the Court granted the motion on the merits, adopting the reasoning set forth in the carrier’s motion and finding that the undisputed record established that the accident fell outside the policy’s coverage. Specifically, the Court determined that the insured was not entitled to coverage as a matter of law because the policy clearly excluded coverage for the accident under three separate exclusions. The order therefore fully resolved the declaratory coverage issue against the insured and established a lack of coverage for the claim.

In Snyder v. Virginia Mason Medical Center, No. 104136-5 (Wash. Oct. 1, 2026), the Washington Supreme Court held that corporate defense counsel, risk managers, and claims adjusters may not communicate ex parte with a hospital’s former employee health care providers about patient care. The Court reaffirmed Loudon v. Mhyre, 110 Wn.2d 675, 756 P.2d 138 (1988) prohibiting ex parte communication by defense counsel with a plaintiff’s treating physicians, held that prejudice is presumed when Loudon is violated, and ruled that a quality improvement (QI) committee member’s involvement in defense strategy waives the committee’s statutory privilege under Wash. Rev. Code § 70.41.200. As a result, informal contact with former employee providers should stop, and factual inquiries should proceed through formal discovery under Wash. Super. Ct. Civ. R. 30 or 31. This article explains how Snyder fits within Washington’s patient confidentiality and corporate privilege framework, how it applies to different categories of providers, and what hospitals and their counsel should do now. Patient Confidentiality vs. Corporate Privilege To navigate the procedural boundaries governing medical malpractice defense in Washington, practitioners must understand the fundamental statutory tension between a patient’s right to health care confidentiality and an institution's right to confer with corporate counsel. Under Washington's Uniform Health Care Information Act, health care providers and their agents are strictly prohibited from disclosing health information without explicit written authorization, except as otherwise provided by law. Wash. Rev. Code § 70.02.020; State v. Scherf, 192 Wn.2d 350, 387, 431 P.3d 976, 995 (2018); King v. Riveland, 125 Wn.2d 500, 509, 886 P.2d 160, 165 (1994). This privacy right is reinforced by Washington's statutory physician-patient privilege, which protects treating physicians from being compelled to testify regarding medical information acquired while attending a patient. Wash. Rev. Code § 5.60.060(4). While a patient automatically waives this statutory privilege upon filing a personal injury or medical malpractice lawsuit under Wash. Rev. Code § 5.60.060(4)(b), the Washington Supreme Court has consistently held that this waiver is not absolute. In Loudon v. Mhyre, 110 Wn.2d 675, 678, 756 P.2d 138, 140 (1988), the Court established a bright-line prohibition against defense counsel engaging in private, ex parte communications with a plaintiff’s treating physicians. The Loudon rule safeguards the fiduciary doctor-patient relationship, prevents inadvertent disclosure of irrelevant medical records, and eliminates the risk of turning defense attorneys into potential trial witnesses. Loudon, 110 Wn.2d at 682, 756 P.2d at 142; Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d 659, 666, 244 P.3d 939, 942–43 (2010). On the corporate side, health care facilities rely on corporate attorney-client privilege to conduct internal risk investigations. Wash. Rev. Code § 5.60.060(2)(a); Upjohn Co. v. United States, 449 U.S. 383, 389, 101 S. Ct. 677, 682, 66 L. Ed. 2d 584 (1981). However, in Newman v. Highland School District No. 203, 186 Wn.2d 769, 381 P.3d 1188 (2016), the Washington Supreme Court established a strict temporal boundary on corporate privilege, holding that privilege does not extend to post-employment communications with former employees: “The underlying purpose of the corporate attorney-client privilege is to foster full and frank communications between counsel and the client (i.e., the corporation), not its former employees... This purpose is preserved by limiting the scope of the privilege to the duration of the employer-employee relationship.” Newman, 186 Wn.2d at 781, 381 P.3d at 1193 (quoting Restatement (Third) of the Law Governing Lawyers § 73 cmt. e (Am. L. Inst. 2000)). Evolution of Provider Contact Rules: Current vs. Former Personnel How does one reconcile corporate attorney-client privilege with the Loudon doctrine? The Supreme Court addressed this conflict in Youngs v. PeaceHealth, 179 Wn.2d 645, 664, 316 P.3d 1035, 1045 (2014), carving out a narrow exception allowing corporate defense counsel to conduct confidential ex parte interviews with a nonparty treating physician who is a current employee of the hospital, provided those communications are limited strictly to the facts surrounding the alleged negligent incident. In Hermanson v. MultiCare Health System, Inc., 196 Wn.2d 578, 581, 475 P.3d 484, 487 (2020), the Court extended this principle to current non-physician staff and current independent contractors who are the functional equivalents of employees. However, when a treating provider leaves the facility's employ, the legal landscape shifts dramatically across four distinct provider categories: Current Employee Providers: Fully covered under the Youngs exception. Corporate defense counsel may conduct privileged, ex parte interviews with active employee physicians, nurses, and staff, provided the conversation is confined to the facts of the alleged negligent incident and does not delve into general medical history. Youngs v. PeaceHealth, 179 Wn.2d at 671. Current Independent Contractors: Covered under Hermanson where an agency or functional equivalent relationship exists. If an independent contractor doctor acts as an agent of the facility, corporate counsel may confer ex parte under the same strict factual constraints of Youngs. Hermanson v. MultiCare Health Sys., Inc., 196 Wn.2d at 589–90. Former Employee Providers (Including C-Suite Officers & Owners): Governed strictly by Newman and Snyder. The moment a provider separates from employment, it instantly extinguishes corporate attorney-client privilege over ongoing trial preparation. Because former employees no longer owe agency duties, defense counsel cannot conduct ex parte interviews with former staff regarding patient care under any circumstances. Snyder v. Virginia Mason Med. Ctr., slip op. at 28–29. Quality Improvement (QI) Committee Members: Subject to statutory peer-review immunity under Wash. Rev. Code § 70.41.200(3). While records prepared for QI committees are immune from discovery, committee members must be strictly screened from litigation defense teams. If a QI member participates in active trial strategy or ex parte witness preparation, statutory peer-review privilege is completely forfeited. Snyder, slip op. at 38–39. The Snyder Decision: Presumed Harm, Privilege Logs, and QI Waiver In Snyder v. Virginia Mason Medical Center, No. 104136-5, slip op. (Wash. Oct. 1, 2026) (En Banc), the Washington Supreme Court resolved lingering uncertainties by establishing three definitive holdings that fundamentally reshape medical malpractice litigation. 1. Rejection of Defense Exceptions and Affirmance of Loudon The Supreme Court affirmed that Loudon applies strictly to former employee health care providers, regardless of whether their care forms the primary basis of the hospital's alleged vicarious liability. In doing so, the Court explicitly rejected a series of defense theories: Representation Agreements & Indemnity Contracts: Private employment contracts requiring former doctors to cooperate in litigation defense cannot override statutory patient privacy rights under Wash. Rev. Code § 70.02.020 or physician-patient privilege under Wash. Rev. Code § 5.60.060(4). Hermanson, 196 Wn.2d at 590 n.1; Snyder, slip op. at 25–26. Common Interest / Joint Defense Theories: Shared legal exposure does not authorize defense counsel to conduct ex parte trial strategy sessions with former employee providers or their separate attorneys. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Inapplicability of Youngs: The Court confirmed that the fiduciary doctor-patient relationship survives employment termination, placing former employee providers strictly beyond the reach of the Youngs current-employee exception. Snyder, slip op. at 28–29. 2. Magaña and the Presumption of Prejudice Crucially, the Supreme Court disavowed its prior decision in Magaña v. Hyundai Motor America, 167 Wn.2d 570, 220 P.3d 191 (2009), which required plaintiffs to prove substantial litigation prejudice to obtain discovery sanctions. Holding that ex parte contacts inherently damage the fiduciary doctor-patient relationship, the Court established that prejudice is presumed upon demonstrating a Loudon violation. Snyder, slip op. at 33–34. To evaluate appropriate sanctions—ranging from monetary fines to entering a default judgment on liability—the Supreme Court extended Cedell v. Farmers Insurance Co. of Washington, 176 Wn.2d 686, 295 P.3d 239 (2013), ordering the trial court to conduct an in-camera inspection of all withheld defense privilege log entries generated during unauthorized ex parte contacts. Snyder, slip op. at 35–36. 3. Subject-Matter Waiver of Quality Improvement Immunity Under Wash. Rev. Code § 70.41.200(3), hospital Quality Improvement committee proceedings are confidential. However, in Snyder, the Chief Medical Officer sat on the hospital’s statutory QI committee while simultaneously receiving litigation talking points from defense counsel, coordinating witness outreach, and traveling ex parte to meet with a former resident physician. The Supreme Court held that failing to ethically screen a QI committee member from active litigation strategy taints the committee's inner workings, effecting a complete subject-matter waiver of statutory peer-review privilege. Snyder, slip op. at 38–39. Real-World Realities: Memory Decay, Pre-Litigation Holds, and Sophistication At the end of the day, modern institutional health care delivery renders determining the exact composition of a patient's treatment team—and whether defense counsel is legally permitted to speak with any given provider—an exercise in pure guesswork. It has long been complicated for patients and health systems to figure out who their doctor is in a complex clinical environment involving rotating resident physicians, attending specialists, hospitalists, and independent contractors. Yet, now no one seems to know who the doctor might not be and whether defense counsel should be speaking to them behind closed doors. By establishing an unyielding temporal boundary that severs corporate attorney-client privilege the exact moment an employee separates from service, Newman, 186 Wn.2d at 781, and Snyder, slip op. at 20, 28–29, creates an unworkable practical fiction. In effect, this rigid rule generates an absurd practical presumption: that no health care practitioner can ever retire, relocate, or transition employment if any remote possibility of future litigation may ensue. This jurisprudence fundamentally neglects two operational realities of medical malpractice defense: the necessity of pre-litigation risk investigations and the natural fading of human memory. When an adverse clinical outcome occurs, risk management must investigate immediately to evaluate institutional exposure. While an institution can readily issue electronic litigation holds to preserve health records, paper charts, and audit trails, it is impossible to ask a human witness to hold onto their unrefreshed memories. While interviewing a witness when a facility first learns of a potential claim is straightforward, months or even years frequently elapse between the medical event, the formal filing of a lawsuit, and the procedural opportunity for defense counsel to deploy formal discovery rules under Wash. Super. Ct. Civ. R. 30 or CR 31. Expecting a treating physician to maintain vivid, detailed recollections of a single procedure performed years earlier—without the benefit of informal factual debriefs with risk management—defies human memory and litigation reality. Finally, this line of authority improperly presumes a uniform, strict sophistication across all health care facilities. Snyder presumes that every community hospital, rural health clinic, and small practice group maintains the extensive legal infrastructure, ethical screening walls, and specialized claims teams of a major academic medical center. By imposing strict liability sanctions and an automatic presumption of prejudice for ex parte contacts regardless of actual litigation harm (Snyder, slip op. at 33–34), the Court penalizes health care entities for standard risk management inquiries while ignoring the operational realities of modern medical practice. Specific Application Cases: C-Suite, Mid-Suit Separation, and Dual Roles A. Former C-Suite Executives, Board Members, and Physician-Owners A frequent point of defense confusion is whether a physician’s former status as a C-suite executive (e.g., Chief Medical Officer), board member, or equity owner exempts them from Loudon. Under Washington law, the extent of corporate privilege coverage depends entirely upon temporal status and the subject matter of the communication. This includes: Pre-Separation Corporate Governance Communications (COVERED): Confidential communications made during active executive, board, or ownership tenure regarding hospital administration, risk management, or general business operations remain protected by the entity's attorney-client privilege under Upjohn Co. v. United States, 449 U.S. 383, 391 (1981) and Wash. Rev. Code § 5.60.060(2)(a). Post-Separation Patient Care Communications (NOT COVERED): Once employment, board tenure, or equity ownership severs, corporate attorney-client privilege terminates. Newman, 186 Wn.2d at 781. Reaffirming Newman, the Supreme Court in Snyder, slip op. at 20, 28–29 held that former executive or ownership status creates no exception to Loudon. Because former C-suite physicians and owners no longer possess agency authority or ongoing duties of loyalty to the entity, defense counsel cannot engage in post-separation ex parte trial preparation regarding patient care provided by that physician. B. Mid-Litigation Employment Termination If a treating physician’s employment terminates during active medical malpractice litigation, corporate attorney-client privilege over ongoing trial preparation instantly evaporates at the moment of separation. Under Newman and Snyder, corporate defense counsel is strictly barred from conducting further ex parte strategy sessions with the departing physician, practically necessitating separate independent counsel for the physician to prevent per se Loudon violations and concurrent conflicts under Rule of Professional Conduct 1.7. C. Dual-Roled Physicians and Corporate PMK Designees Quality Improvement (QI) committee members represent one of the most perilous legal landmines for health care facilities under Snyder, slip op. at 38–39. Health care facilities face an inherent dilemma: the individuals best situated to serve as key corporate contacts or Person Most Knowledgeable (PMK) designees under Wash. Super. Ct. Civ. R. 30(b)(6)—such as CMOs or Medical Directors—are almost universally the exact same clinical leaders who sit on statutory QI committees. When a lawsuit emerges, institutions routinely rely on senior officers to investigate the incident and coordinate witness outreach. However, under Snyder, combining statutory peer-review functions with litigation defense strategy destroys the statutory privilege protecting the facility's Quality Improvement proceedings. To protect peer-review immunity, institutions ought to consider implementing proactive, pre-litigation organizational role separation: structurally dividing clinical governance so that high-level physicians on QI committees are permanently barred from acting as litigation claims liaisons or CR 30(b)(6) designees. Practical Compliance  To navigate the strict mandates of Snyder and protect case integrity, corporate defense counsel and health care risk managers must adopt three mandatory practice protocols: Conduct Factual Discovery Exclusively Through Formal Court Rules. Defense counsel must refrain from informal telephone calls, debriefs, or “support visits” with former employee providers. All factual inquiries must occur through formal oral depositions under Wash. Super. Ct. Civ. R. 30 or written depositions under Wash. Super. Ct. Civ. R. 31 upon formal notice to plaintiff's counsel. Strictly Prohibit Using Separate Counsel as a Conduit. If an insurer assigns separate independent counsel to represent a former employee provider under continuing indemnification duties, primary corporate counsel cannot pass trial briefs, expert reports, or strategy talking points ex parte to separate counsel. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Establish Proactive Pre-Litigation QI Ethical Walls. Health care facilities must structurally divide clinical governance so that high-level physicians who serve on statutory Quality Improvement peer-review committees are permanently barred from acting as corporate claims liaisons, risk defense managers, or corporate Person Most Knowledgeable (PMK) designees under CR 30(b)(6). Proactive ethical screening is essential to prevent subject-matter waiver of statutory peer-review immunity under Wash. Rev. Code § 70.41.200.

Nancy Wright (Partner-New York, NY) and Aaron Bengart (Associate-New York, NY) secured a “no probable cause” finding and dismissal of a discrimination and retaliation complaint before the New York State Division of Human Rights (DHR) on behalf of Wilson Elser’s private school client. A former part-time assistant girls’ basketball coach alleged discrimination based on age, disability, familial status, marital status, and sex, as well as retaliation, after the school declined to renew her contract. Nancy and Aaron demonstrated that complainant had proffered no factual allegations supporting an inference of discrimination based on any protected category, that the school had legitimate, non-discriminatory business reasons for not renewing the complainant’s contract ‒ including tardiness and performance issues ‒ and that she could not show pretext. They also established that the retaliation claim failed because the complainant had not engaged in any protected activity, and her allegations concerned workers’ compensation issues outside the DHR’s jurisdiction. In its Determination and Order After Investigation, the DHR agreed with the school’s arguments and dismissed the complaint for lack of probable cause to support discrimination and retaliation.

On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923 (Chapter 482, Statutes of 2026), known as the Expanding Privacy Rights Act. The law amends two provisions of the California Consumer Privacy Act (CCPA): (1) the right to delete (Civil Code § 1798.105); and (2) the methods for submitting consumer requests (Civil Code § 1798.130). The legislation was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency (also known as CalPrivacy). This amendment takes effect January 1, 2027. A deletion request will now reach personal information that a business bought or received from others, not only what the consumer provided. Online-only businesses must also offer a web form or portal for privacy requests. For most companies, this is an operational change rather than a new program, but it reaches data stores that many request workflows never touch. Reasons Behind the Amendment Under the prior CCPA text, consumers could request deletion only of information a business collected “from the consumer.” The California Legislature found that the existing right “allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties. This creates a gap in protection.” S.B. 923, 2025–2026 Leg., Reg. Sess. § 1(b) (Cal. 2026) (enacted as 2026 Cal. Stat. ch. 482). CalPrivacy, the legislation’s sponsor, noted that “businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete.” CalPrivacy, California Expands Privacy Protections by Strengthening Deletion Rights (Sept. 27, 2026). With respect to the means for the submission of the requests, the current CCPA regulations require a webform only from businesses that are not exclusively online, and only if they have a website. See 11 CCR § 7020(b) (requests "shall be through its website, such as through a webform."). Online-only businesses with a direct consumer relationship still need only an email address under § 7020(a). As Senator Becker, the author of this bill, explained in his statement, “while most businesses must provide two or more methods to submit privacy requests, online-only businesses that have a direct relationship with the consumer are only required to provide an email address for consumers to submit most privacy requests under the CCPA. This single-method requirement for certain businesses creates barriers for consumers because it offers minimal support or guidance.” Assemb. Comm. on Privacy & Consumer Prot., Analysis of S.B. 923, 2025–2026 Leg., Reg. Sess., at 5 (Cal. June 23, 2026) (as amended June 11, 2026) (quoting author's statement). CalPrivacy, which sponsored the bill, says it aligns California with deletion rights in Delaware, Indiana, Maryland, and New Jersey, and stresses that the CCPA’s existing exemptions, including fraud prevention and legal compliance, remain available. What the Statute Now Says Broader Deletion Right Amended Section 1798.105(a) provides: “A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.” Suppression Records for Third-Party Data For data obtained from other sources, the law gives businesses a defined way to comply: “A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal information remains deleted from the business’s records and is not being used for any other purpose.” Expanded Downstream Obligations The existing duties still apply: the business must “notify any service providers or contractors to delete the consumer’s personal information from their records and notify all third parties to whom the business has sold or shared the personal information,” unless “this proves impossible or involves disproportionate effort.” Service providers and contractors “shall cooperate with the business in responding to a verifiable consumer request.” Because the deletion right is broader, these flow-down duties now reach a larger set of records. Preserved Exceptions  Businesses may still retain information when reasonably necessary to, among other things, “[h]elp to ensure security and integrity” or “[c]omply with a legal obligation.” New Online Request Requirement Amended Section 1798.130(a)(1)(A) provides that a business that “operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address and make an online method, such as a web form or online portal, available” for requests to know, delete, or correct. An email inbox alone will no longer suffice. What Is Required, From Whom, and When Beginning January 1, 2027, every business subject to the CCPA must honor deletion requests for personal information it holds about a consumer, whether it collected that data from the consumer or got it from a broker, vendor, or other third party. For data collected from other sources, a business complies with the new requirements by keeping a record of the request and only the minimum data needed to make sure the consumer's information stays deleted. Service providers and contractors must assist the business in their responses to the consumer rights requests. At the business's direction, they must delete the data and notify their own downstream service providers and contractors to do the same.  Starting from January 1, 2027, a business that operates exclusively online and has a direct relationship with consumers must now offer an online method, such as a web form or portal, in addition to an email address, for submission of consumer requests. Businesses with brick-and-mortar presence keep their current obligation to offer at least two methods for consumer requests, including a toll-free telephone number. Practical Steps to Take Before January 1, 2027 Compliance with contemporary data privacy laws must involve technical solutions along with legal and compliance ones. Online-only businesses seeking to implement the webform or portal for the first time must be mindful of the privacy laws-related requirements, including the need for verification, the regulatory response timelines, and the recordkeeping requirements related to the fulfilled requests. All businesses subject to CCPA should also take the time to map where personal information sourced from third parties resides in their systems, extend deletion workflows to those systems, and build or check their suppression records workflow. This is also a good time to review the mandatory service provider and contractor agreements to confirm compliance with California’s requirements, including support for deletion rights cooperation and flow-down provisions.  Wilson Elser’s Data Use and AI Governance team can help businesses assess how SB 923 affects their deletion workflows, third-party data sources, vendor agreements, and consumer request intake, and can advise on CCPA compliance and other privacy law questions as they arise.

Q: Are employees entitled by law to access their personnel files?   A: There is no federal law that gives private-sector employees the right to view their personnel files. Access is regulated entirely by state-specific laws. There are currently 19 states that legally require employers to permit employees (and sometimes former employees) to view and/or obtain a copy of their personnel file. As of November 8, 2026, that number will increase to 20, when New York’s recently enacted Personnel Records Access Law goes into effect. The majority of states have no law requiring access to personnel files and there is no federal law that confers on current or former employees a statutory right to access their personnel files.  As of October of 2026, the following states provide right of access to current employees: Alaska, California, Colorado, Connecticut, Delaware, Illinois, Iowa, Maine, Massachusetts, Michigan, Minnesota, Nevada, New Hampshire, Oregon, Pennsylvania, Rhode Island, Virgina, Washington, and Wisconsin.  Some states, including New York (as of November 8, 2026), also allow former employees to view their personnel files. Each state has its own caveats to access. For example, Washington allows for a former employee to retain the right of rebuttal or correction for up to two years following their separation from employment.  New York’s new law, Senate Bill 2025-S3460, was signed by Governor Kathy Hochul on September 9, 2026, adding Section 210-b to the New York Labor Law. The law covers public and private sector employers, including individuals, corporations, partnerships, labor organizations, unincorporated associations, other legal businesses and employer agents.  Employers operating in New York should familiarize themselves with the requirements of Section 210-b now, before it goes into effect, and update their document-management and onboarding practices accordingly, as non-compliance may expose them to claims under the New York Labor Law.  What Will New York Law Require? The law in New York will require employers to provide current and former employees with a copy of their personnel records within five (5) business days of a written request, up to twice per calendar year, at no cost to the employee. Employers also must notify employees within ten business (10) days after placing information in a personnel record that is, has been, or may be used to negatively affect the employee’s qualifications for employment, promotion, transfer, additional compensation, or the possibility of disciplinary action. If there is a disagreement with any information within the personnel record, removal or correction of the information may be mutually agreed upon by the employer and the employee. If the employee doesn’t agree with the information the employer places in the file, the employee can submit a written statement explaining the employee’s position, which must become a part of the employee’s personnel record and must accompany the disputed information when it is transmitted to a third party, so long as the original information remains in the file. Employers are not required to permit an employee to review their personnel record more than twice per calendar year, but a notification and review resulting from the placement of negative information in the record does not count toward that limit. Under the new law, to the extent employers create personnel records, without deletions or expungement of information, they are required to maintain them from the date of employment through three years after termination of the employee’s employment. What Types of Documents Are Covered Under New York’s Personnel Records Law? The New York law expressly defines “personnel records” to include the following written information and documents prepared by an employer regarding an employee, for inclusion in the employee’s personnel record: Name, address, date of birth, job title and description  Rate of pay and any other compensation paid to the employee Starting date of employment  The job application of the employee  Resumes or other forms of employment inquiry submitted by the employee to the employer in response to the employer's advertisement  All employee performance evaluations, including but not limited to employee evaluation documents  Written warnings of substandard performance  Lists of probationary periods  Waivers signed by the employee Copies of dated termination notices  Any documents relating to disciplinary action regarding the employee The law applies broadly and is not limited to the above-listed documentation. Examples of documents also likely covered include: 1. Employment agreements and offer letters signed at the start of the employment relationship 2. Handbook and policy acknowledgment forms, such as sign-offs on anti-harassment policies, code of conduct agreements, or confidentiality acknowledgments 3. Performance improvement plans that the employee is asked to sign to confirm receipt 4. Separation-related documents, such as resignation acknowledgments or exit interview forms, to the extent they are placed in the personnel file Note that the law expressly excludes, “information of a personal nature about a person other than the employee if disclosure of the information would constitute a clearly unwarranted invasion of such other person’s privacy.” The law prohibits employers and other persons from discharging, threatening, penalizing, discriminating, or retaliating against employees who exercise their statutory rights.  Practical Tips for New York Employers New York employers should keep several practical points in mind as they prepare to comply with Section 210-b of the Labor Law: 1. Review current practices and protocols. Before November 8, 2026, New York employers should review their personnel record practices and retention procedures. Employers should establish a protocol for tracking and responding to an employee’s request for the employee’s personnel file. Determine whether your organization already provides employees with copies of all signed personnel documents. Employers also should evaluate whether covered personnel records maintained by third-party providers can be produced within five business days.  2. Update onboarding and HR workflows. Ensure that standard operating procedures require HR personnel and managers to provide a copy of every signed document to the employee at the time of signing. Consider building this step into electronic onboarding platforms and document management systems so that copy delivery is automatic rather than dependent on individual compliance to ensure timely compliance with the notification requirements. 3. Leverage electronic signature and document management tools. Employers using e-signature platforms can configure them to send a completed copy of each signed document to the employee automatically, which streamlines compliance and creates a reliable audit trail. 4. Train HR staff and supervisors. Managers and HR professionals who handle personnel paperwork should be informed of the new requirement and understand that every signed document placed in a personnel file must be accompanied by delivery of a copy to the employee. Employers should train HR personnel and managers on the law’s access, notice, retention, and anti-retaliation requirements. 5. Document delivery of copies. Maintain a record confirming that each signed document was provided to the employee. Whether through an electronic system's automatic confirmation, an email transmittal, or a signed acknowledgment of receipt, this documentation can be important if compliance is later questioned. What Are the Risks of Non-Compliance? For companies that violate the law, New York’s Attorney General would be empowered to seek penalties ranging from $500 to $2,500 per violation, and workers who face discrimination or retaliation for asserting their rights would have a private right of action. Broader Considerations New York's enactment of Section 210-b is part of a broader trend of states strengthening employee access to workplace records. For instance, California employers must allow current and former employees to inspect and receive copies of personnel records relating to the employee’s performance or any grievance concerning the employee. In addition, California employers must also provide education and training records upon the employee’s authorized request within a 30-day window. In contrast, employers in the state of Texas are not required to turn over personnel files to current or former employees. Employers operating in multiple jurisdictions should be aware that personnel-file access laws vary significantly from state to state. 

Adam R. Bialek (Partner-New York, NY) and Taylor F. Bialek (Associate-New York, NY) will present the Wilson Elser Forum webinar “Web Accessibility Under the ADA and State Laws: Best Practices and Compliance” on November 3, 2026. This session provides a practical overview of the legal landscape governing web accessibility, including obligations under federal and state laws, and compliance best practices. The session covers the WCAG 2.1 technical standards, upcoming compliance deadlines, the current litigation environment, and actionable steps organizations can take to reduce exposure and build accessibility into their website operations. Designed for claims professionals, in-house counsel, risk managers, and insurance professionals, the presentation includes a general compliance checklist and a discussion of defense strategies and common pitfalls, including the limitations of third-party overlay tools.

Wilson Elser has been named to BTI Consulting Group’s “Intimidating Opponents for 2027” list, published in its September 23, 2026, report, Clients Single Out the Most Feared Law Firms in Litigation. The recognition highlights the law firms that corporate counsel least want to face on the opposing side of a dispute. In high-stakes litigation, the experience, reputation, and strategic capabilities of opposing counsel can influence how parties assess litigation risks, costs, and potential outcomes ‒ even before a case gets underway. BTI Consulting Group conducts independent research examining how clients acquire, manage, and evaluate professional services providers. For this recognition, BTI surveyed corporate counsel to identify the law firms they consider the most formidable litigation opponents. A total of 92 firms were named to the 2027 list.

Michelle Gallagher (Partner-Boston, MA) and Taylor F. Bialek (Associate-New York, NY) will present the Wilson Elser Forum webinar “Trademark Law and Brand Building: Protection and Enforcement Strategies” on November 10, 2026. This presentation delivers an engaging and practical overview of trademark law. Michelle and Taylor examine the lifecycle of a brand – from initial brand selection and clearance to the development and implementation of effective filing strategies – highlighting the importance of building a strong, protectable brand identity from the outset. Expanding beyond the basics, the session also explores global brand protection and enforcement strategies, offering insight into how companies safeguard their trademark portfolios across jurisdictions and develop proactive strategies to deter potential infringement. These topics are relevant to entrepreneurs, corporate executives, and independent business owners, providing a cohesive framework for understanding how legal strategy can support and sustain brand value in a competitive, international marketplace.

Dean A. Rocco (Partner-Los Angeles, CA) will present the Wilson Elser Forum webinar “California at Work: Key Employment Law Developments in 2026” on November 5, 2026. This program reviews the new laws and legislative enactments from the recently closed 2026 legislative session, as well as key employment law decisions issued during the year. Attendees will learn how the law impacts California employers, where new liabilities may arise due to changes to the law, and strategies for complying with the law to avoid employee claims. 

Kimberly Silas (Of Counsel-New Orleans, LA), who had previously served for two years as Secretary of the New Orleans Bar Foundation, was unanimously elected to serve as the organization’s President for the upcoming year. She will be installed, along with fellow Board members, at the New Orleans Bar Association’s Annual Dinner on November 19, 2026. In her new leadership role, Kimberly looks forward to expanding her efforts to give back to the local legal profession and the greater New Orleans community.

Dale Dobuler (Partner-Orlando, FL) and Nick Freeman (Partner-Orlando, FL) secured final summary judgment in an insurance coverage action in federal court seeking a declaration of non-coverage for an underlying wrongful death claim involving a commercial auto policy issued to a Florida-based business.  Prior to the coverage action,  plaintiff’s counsel issued a presuit demand of $1 million to the insured and its commercial auto carrier. Dale and Nick argued that coverage for the plaintiff’s claim was precluded by certain policy exclusions for injuries involving the insured's employees. They filed a declaratory action in US District Court. After establishing that the injury arose from or was directly connected to the deceased’s employment with the insured, the Court granted the carrier’s motion for summary judgment against the insured on two independent grounds. First, the insured failed to timely respond to the motion, despite being advised that failure to do so would render the motion unopposed under the applicable local rules. The Court therefore granted the motion as unopposed. Second, the Court granted the motion on the merits, adopting the reasoning set forth in the carrier’s motion and finding that the undisputed record established that the accident fell outside the policy’s coverage. Specifically, the Court determined that the insured was not entitled to coverage as a matter of law because the policy clearly excluded coverage for the accident under three separate exclusions. The order therefore fully resolved the declaratory coverage issue against the insured and established a lack of coverage for the claim.

In Snyder v. Virginia Mason Medical Center, No. 104136-5 (Wash. Oct. 1, 2026), the Washington Supreme Court held that corporate defense counsel, risk managers, and claims adjusters may not communicate ex parte with a hospital’s former employee health care providers about patient care. The Court reaffirmed Loudon v. Mhyre, 110 Wn.2d 675, 756 P.2d 138 (1988) prohibiting ex parte communication by defense counsel with a plaintiff’s treating physicians, held that prejudice is presumed when Loudon is violated, and ruled that a quality improvement (QI) committee member’s involvement in defense strategy waives the committee’s statutory privilege under Wash. Rev. Code § 70.41.200. As a result, informal contact with former employee providers should stop, and factual inquiries should proceed through formal discovery under Wash. Super. Ct. Civ. R. 30 or 31. This article explains how Snyder fits within Washington’s patient confidentiality and corporate privilege framework, how it applies to different categories of providers, and what hospitals and their counsel should do now. Patient Confidentiality vs. Corporate Privilege To navigate the procedural boundaries governing medical malpractice defense in Washington, practitioners must understand the fundamental statutory tension between a patient’s right to health care confidentiality and an institution's right to confer with corporate counsel. Under Washington's Uniform Health Care Information Act, health care providers and their agents are strictly prohibited from disclosing health information without explicit written authorization, except as otherwise provided by law. Wash. Rev. Code § 70.02.020; State v. Scherf, 192 Wn.2d 350, 387, 431 P.3d 976, 995 (2018); King v. Riveland, 125 Wn.2d 500, 509, 886 P.2d 160, 165 (1994). This privacy right is reinforced by Washington's statutory physician-patient privilege, which protects treating physicians from being compelled to testify regarding medical information acquired while attending a patient. Wash. Rev. Code § 5.60.060(4). While a patient automatically waives this statutory privilege upon filing a personal injury or medical malpractice lawsuit under Wash. Rev. Code § 5.60.060(4)(b), the Washington Supreme Court has consistently held that this waiver is not absolute. In Loudon v. Mhyre, 110 Wn.2d 675, 678, 756 P.2d 138, 140 (1988), the Court established a bright-line prohibition against defense counsel engaging in private, ex parte communications with a plaintiff’s treating physicians. The Loudon rule safeguards the fiduciary doctor-patient relationship, prevents inadvertent disclosure of irrelevant medical records, and eliminates the risk of turning defense attorneys into potential trial witnesses. Loudon, 110 Wn.2d at 682, 756 P.2d at 142; Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d 659, 666, 244 P.3d 939, 942–43 (2010). On the corporate side, health care facilities rely on corporate attorney-client privilege to conduct internal risk investigations. Wash. Rev. Code § 5.60.060(2)(a); Upjohn Co. v. United States, 449 U.S. 383, 389, 101 S. Ct. 677, 682, 66 L. Ed. 2d 584 (1981). However, in Newman v. Highland School District No. 203, 186 Wn.2d 769, 381 P.3d 1188 (2016), the Washington Supreme Court established a strict temporal boundary on corporate privilege, holding that privilege does not extend to post-employment communications with former employees: “The underlying purpose of the corporate attorney-client privilege is to foster full and frank communications between counsel and the client (i.e., the corporation), not its former employees... This purpose is preserved by limiting the scope of the privilege to the duration of the employer-employee relationship.” Newman, 186 Wn.2d at 781, 381 P.3d at 1193 (quoting Restatement (Third) of the Law Governing Lawyers § 73 cmt. e (Am. L. Inst. 2000)). Evolution of Provider Contact Rules: Current vs. Former Personnel How does one reconcile corporate attorney-client privilege with the Loudon doctrine? The Supreme Court addressed this conflict in Youngs v. PeaceHealth, 179 Wn.2d 645, 664, 316 P.3d 1035, 1045 (2014), carving out a narrow exception allowing corporate defense counsel to conduct confidential ex parte interviews with a nonparty treating physician who is a current employee of the hospital, provided those communications are limited strictly to the facts surrounding the alleged negligent incident. In Hermanson v. MultiCare Health System, Inc., 196 Wn.2d 578, 581, 475 P.3d 484, 487 (2020), the Court extended this principle to current non-physician staff and current independent contractors who are the functional equivalents of employees. However, when a treating provider leaves the facility's employ, the legal landscape shifts dramatically across four distinct provider categories: Current Employee Providers: Fully covered under the Youngs exception. Corporate defense counsel may conduct privileged, ex parte interviews with active employee physicians, nurses, and staff, provided the conversation is confined to the facts of the alleged negligent incident and does not delve into general medical history. Youngs v. PeaceHealth, 179 Wn.2d at 671. Current Independent Contractors: Covered under Hermanson where an agency or functional equivalent relationship exists. If an independent contractor doctor acts as an agent of the facility, corporate counsel may confer ex parte under the same strict factual constraints of Youngs. Hermanson v. MultiCare Health Sys., Inc., 196 Wn.2d at 589–90. Former Employee Providers (Including C-Suite Officers & Owners): Governed strictly by Newman and Snyder. The moment a provider separates from employment, it instantly extinguishes corporate attorney-client privilege over ongoing trial preparation. Because former employees no longer owe agency duties, defense counsel cannot conduct ex parte interviews with former staff regarding patient care under any circumstances. Snyder v. Virginia Mason Med. Ctr., slip op. at 28–29. Quality Improvement (QI) Committee Members: Subject to statutory peer-review immunity under Wash. Rev. Code § 70.41.200(3). While records prepared for QI committees are immune from discovery, committee members must be strictly screened from litigation defense teams. If a QI member participates in active trial strategy or ex parte witness preparation, statutory peer-review privilege is completely forfeited. Snyder, slip op. at 38–39. The Snyder Decision: Presumed Harm, Privilege Logs, and QI Waiver In Snyder v. Virginia Mason Medical Center, No. 104136-5, slip op. (Wash. Oct. 1, 2026) (En Banc), the Washington Supreme Court resolved lingering uncertainties by establishing three definitive holdings that fundamentally reshape medical malpractice litigation. 1. Rejection of Defense Exceptions and Affirmance of Loudon The Supreme Court affirmed that Loudon applies strictly to former employee health care providers, regardless of whether their care forms the primary basis of the hospital's alleged vicarious liability. In doing so, the Court explicitly rejected a series of defense theories: Representation Agreements & Indemnity Contracts: Private employment contracts requiring former doctors to cooperate in litigation defense cannot override statutory patient privacy rights under Wash. Rev. Code § 70.02.020 or physician-patient privilege under Wash. Rev. Code § 5.60.060(4). Hermanson, 196 Wn.2d at 590 n.1; Snyder, slip op. at 25–26. Common Interest / Joint Defense Theories: Shared legal exposure does not authorize defense counsel to conduct ex parte trial strategy sessions with former employee providers or their separate attorneys. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Inapplicability of Youngs: The Court confirmed that the fiduciary doctor-patient relationship survives employment termination, placing former employee providers strictly beyond the reach of the Youngs current-employee exception. Snyder, slip op. at 28–29. 2. Magaña and the Presumption of Prejudice Crucially, the Supreme Court disavowed its prior decision in Magaña v. Hyundai Motor America, 167 Wn.2d 570, 220 P.3d 191 (2009), which required plaintiffs to prove substantial litigation prejudice to obtain discovery sanctions. Holding that ex parte contacts inherently damage the fiduciary doctor-patient relationship, the Court established that prejudice is presumed upon demonstrating a Loudon violation. Snyder, slip op. at 33–34. To evaluate appropriate sanctions—ranging from monetary fines to entering a default judgment on liability—the Supreme Court extended Cedell v. Farmers Insurance Co. of Washington, 176 Wn.2d 686, 295 P.3d 239 (2013), ordering the trial court to conduct an in-camera inspection of all withheld defense privilege log entries generated during unauthorized ex parte contacts. Snyder, slip op. at 35–36. 3. Subject-Matter Waiver of Quality Improvement Immunity Under Wash. Rev. Code § 70.41.200(3), hospital Quality Improvement committee proceedings are confidential. However, in Snyder, the Chief Medical Officer sat on the hospital’s statutory QI committee while simultaneously receiving litigation talking points from defense counsel, coordinating witness outreach, and traveling ex parte to meet with a former resident physician. The Supreme Court held that failing to ethically screen a QI committee member from active litigation strategy taints the committee's inner workings, effecting a complete subject-matter waiver of statutory peer-review privilege. Snyder, slip op. at 38–39. Real-World Realities: Memory Decay, Pre-Litigation Holds, and Sophistication At the end of the day, modern institutional health care delivery renders determining the exact composition of a patient's treatment team—and whether defense counsel is legally permitted to speak with any given provider—an exercise in pure guesswork. It has long been complicated for patients and health systems to figure out who their doctor is in a complex clinical environment involving rotating resident physicians, attending specialists, hospitalists, and independent contractors. Yet, now no one seems to know who the doctor might not be and whether defense counsel should be speaking to them behind closed doors. By establishing an unyielding temporal boundary that severs corporate attorney-client privilege the exact moment an employee separates from service, Newman, 186 Wn.2d at 781, and Snyder, slip op. at 20, 28–29, creates an unworkable practical fiction. In effect, this rigid rule generates an absurd practical presumption: that no health care practitioner can ever retire, relocate, or transition employment if any remote possibility of future litigation may ensue. This jurisprudence fundamentally neglects two operational realities of medical malpractice defense: the necessity of pre-litigation risk investigations and the natural fading of human memory. When an adverse clinical outcome occurs, risk management must investigate immediately to evaluate institutional exposure. While an institution can readily issue electronic litigation holds to preserve health records, paper charts, and audit trails, it is impossible to ask a human witness to hold onto their unrefreshed memories. While interviewing a witness when a facility first learns of a potential claim is straightforward, months or even years frequently elapse between the medical event, the formal filing of a lawsuit, and the procedural opportunity for defense counsel to deploy formal discovery rules under Wash. Super. Ct. Civ. R. 30 or CR 31. Expecting a treating physician to maintain vivid, detailed recollections of a single procedure performed years earlier—without the benefit of informal factual debriefs with risk management—defies human memory and litigation reality. Finally, this line of authority improperly presumes a uniform, strict sophistication across all health care facilities. Snyder presumes that every community hospital, rural health clinic, and small practice group maintains the extensive legal infrastructure, ethical screening walls, and specialized claims teams of a major academic medical center. By imposing strict liability sanctions and an automatic presumption of prejudice for ex parte contacts regardless of actual litigation harm (Snyder, slip op. at 33–34), the Court penalizes health care entities for standard risk management inquiries while ignoring the operational realities of modern medical practice. Specific Application Cases: C-Suite, Mid-Suit Separation, and Dual Roles A. Former C-Suite Executives, Board Members, and Physician-Owners A frequent point of defense confusion is whether a physician’s former status as a C-suite executive (e.g., Chief Medical Officer), board member, or equity owner exempts them from Loudon. Under Washington law, the extent of corporate privilege coverage depends entirely upon temporal status and the subject matter of the communication. This includes: Pre-Separation Corporate Governance Communications (COVERED): Confidential communications made during active executive, board, or ownership tenure regarding hospital administration, risk management, or general business operations remain protected by the entity's attorney-client privilege under Upjohn Co. v. United States, 449 U.S. 383, 391 (1981) and Wash. Rev. Code § 5.60.060(2)(a). Post-Separation Patient Care Communications (NOT COVERED): Once employment, board tenure, or equity ownership severs, corporate attorney-client privilege terminates. Newman, 186 Wn.2d at 781. Reaffirming Newman, the Supreme Court in Snyder, slip op. at 20, 28–29 held that former executive or ownership status creates no exception to Loudon. Because former C-suite physicians and owners no longer possess agency authority or ongoing duties of loyalty to the entity, defense counsel cannot engage in post-separation ex parte trial preparation regarding patient care provided by that physician. B. Mid-Litigation Employment Termination If a treating physician’s employment terminates during active medical malpractice litigation, corporate attorney-client privilege over ongoing trial preparation instantly evaporates at the moment of separation. Under Newman and Snyder, corporate defense counsel is strictly barred from conducting further ex parte strategy sessions with the departing physician, practically necessitating separate independent counsel for the physician to prevent per se Loudon violations and concurrent conflicts under Rule of Professional Conduct 1.7. C. Dual-Roled Physicians and Corporate PMK Designees Quality Improvement (QI) committee members represent one of the most perilous legal landmines for health care facilities under Snyder, slip op. at 38–39. Health care facilities face an inherent dilemma: the individuals best situated to serve as key corporate contacts or Person Most Knowledgeable (PMK) designees under Wash. Super. Ct. Civ. R. 30(b)(6)—such as CMOs or Medical Directors—are almost universally the exact same clinical leaders who sit on statutory QI committees. When a lawsuit emerges, institutions routinely rely on senior officers to investigate the incident and coordinate witness outreach. However, under Snyder, combining statutory peer-review functions with litigation defense strategy destroys the statutory privilege protecting the facility's Quality Improvement proceedings. To protect peer-review immunity, institutions ought to consider implementing proactive, pre-litigation organizational role separation: structurally dividing clinical governance so that high-level physicians on QI committees are permanently barred from acting as litigation claims liaisons or CR 30(b)(6) designees. Practical Compliance  To navigate the strict mandates of Snyder and protect case integrity, corporate defense counsel and health care risk managers must adopt three mandatory practice protocols: Conduct Factual Discovery Exclusively Through Formal Court Rules. Defense counsel must refrain from informal telephone calls, debriefs, or “support visits” with former employee providers. All factual inquiries must occur through formal oral depositions under Wash. Super. Ct. Civ. R. 30 or written depositions under Wash. Super. Ct. Civ. R. 31 upon formal notice to plaintiff's counsel. Strictly Prohibit Using Separate Counsel as a Conduit. If an insurer assigns separate independent counsel to represent a former employee provider under continuing indemnification duties, primary corporate counsel cannot pass trial briefs, expert reports, or strategy talking points ex parte to separate counsel. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Establish Proactive Pre-Litigation QI Ethical Walls. Health care facilities must structurally divide clinical governance so that high-level physicians who serve on statutory Quality Improvement peer-review committees are permanently barred from acting as corporate claims liaisons, risk defense managers, or corporate Person Most Knowledgeable (PMK) designees under CR 30(b)(6). Proactive ethical screening is essential to prevent subject-matter waiver of statutory peer-review immunity under Wash. Rev. Code § 70.41.200.

Nancy Wright (Partner-New York, NY) and Aaron Bengart (Associate-New York, NY) secured a “no probable cause” finding and dismissal of a discrimination and retaliation complaint before the New York State Division of Human Rights (DHR) on behalf of Wilson Elser’s private school client. A former part-time assistant girls’ basketball coach alleged discrimination based on age, disability, familial status, marital status, and sex, as well as retaliation, after the school declined to renew her contract. Nancy and Aaron demonstrated that complainant had proffered no factual allegations supporting an inference of discrimination based on any protected category, that the school had legitimate, non-discriminatory business reasons for not renewing the complainant’s contract ‒ including tardiness and performance issues ‒ and that she could not show pretext. They also established that the retaliation claim failed because the complainant had not engaged in any protected activity, and her allegations concerned workers’ compensation issues outside the DHR’s jurisdiction. In its Determination and Order After Investigation, the DHR agreed with the school’s arguments and dismissed the complaint for lack of probable cause to support discrimination and retaliation.

On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923 (Chapter 482, Statutes of 2026), known as the Expanding Privacy Rights Act. The law amends two provisions of the California Consumer Privacy Act (CCPA): (1) the right to delete (Civil Code § 1798.105); and (2) the methods for submitting consumer requests (Civil Code § 1798.130). The legislation was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency (also known as CalPrivacy). This amendment takes effect January 1, 2027. A deletion request will now reach personal information that a business bought or received from others, not only what the consumer provided. Online-only businesses must also offer a web form or portal for privacy requests. For most companies, this is an operational change rather than a new program, but it reaches data stores that many request workflows never touch. Reasons Behind the Amendment Under the prior CCPA text, consumers could request deletion only of information a business collected “from the consumer.” The California Legislature found that the existing right “allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties. This creates a gap in protection.” S.B. 923, 2025–2026 Leg., Reg. Sess. § 1(b) (Cal. 2026) (enacted as 2026 Cal. Stat. ch. 482). CalPrivacy, the legislation’s sponsor, noted that “businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete.” CalPrivacy, California Expands Privacy Protections by Strengthening Deletion Rights (Sept. 27, 2026). With respect to the means for the submission of the requests, the current CCPA regulations require a webform only from businesses that are not exclusively online, and only if they have a website. See 11 CCR § 7020(b) (requests "shall be through its website, such as through a webform."). Online-only businesses with a direct consumer relationship still need only an email address under § 7020(a). As Senator Becker, the author of this bill, explained in his statement, “while most businesses must provide two or more methods to submit privacy requests, online-only businesses that have a direct relationship with the consumer are only required to provide an email address for consumers to submit most privacy requests under the CCPA. This single-method requirement for certain businesses creates barriers for consumers because it offers minimal support or guidance.” Assemb. Comm. on Privacy & Consumer Prot., Analysis of S.B. 923, 2025–2026 Leg., Reg. Sess., at 5 (Cal. June 23, 2026) (as amended June 11, 2026) (quoting author's statement). CalPrivacy, which sponsored the bill, says it aligns California with deletion rights in Delaware, Indiana, Maryland, and New Jersey, and stresses that the CCPA’s existing exemptions, including fraud prevention and legal compliance, remain available. What the Statute Now Says Broader Deletion Right Amended Section 1798.105(a) provides: “A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.” Suppression Records for Third-Party Data For data obtained from other sources, the law gives businesses a defined way to comply: “A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal information remains deleted from the business’s records and is not being used for any other purpose.” Expanded Downstream Obligations The existing duties still apply: the business must “notify any service providers or contractors to delete the consumer’s personal information from their records and notify all third parties to whom the business has sold or shared the personal information,” unless “this proves impossible or involves disproportionate effort.” Service providers and contractors “shall cooperate with the business in responding to a verifiable consumer request.” Because the deletion right is broader, these flow-down duties now reach a larger set of records. Preserved Exceptions  Businesses may still retain information when reasonably necessary to, among other things, “[h]elp to ensure security and integrity” or “[c]omply with a legal obligation.” New Online Request Requirement Amended Section 1798.130(a)(1)(A) provides that a business that “operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address and make an online method, such as a web form or online portal, available” for requests to know, delete, or correct. An email inbox alone will no longer suffice. What Is Required, From Whom, and When Beginning January 1, 2027, every business subject to the CCPA must honor deletion requests for personal information it holds about a consumer, whether it collected that data from the consumer or got it from a broker, vendor, or other third party. For data collected from other sources, a business complies with the new requirements by keeping a record of the request and only the minimum data needed to make sure the consumer's information stays deleted. Service providers and contractors must assist the business in their responses to the consumer rights requests. At the business's direction, they must delete the data and notify their own downstream service providers and contractors to do the same.  Starting from January 1, 2027, a business that operates exclusively online and has a direct relationship with consumers must now offer an online method, such as a web form or portal, in addition to an email address, for submission of consumer requests. Businesses with brick-and-mortar presence keep their current obligation to offer at least two methods for consumer requests, including a toll-free telephone number. Practical Steps to Take Before January 1, 2027 Compliance with contemporary data privacy laws must involve technical solutions along with legal and compliance ones. Online-only businesses seeking to implement the webform or portal for the first time must be mindful of the privacy laws-related requirements, including the need for verification, the regulatory response timelines, and the recordkeeping requirements related to the fulfilled requests. All businesses subject to CCPA should also take the time to map where personal information sourced from third parties resides in their systems, extend deletion workflows to those systems, and build or check their suppression records workflow. This is also a good time to review the mandatory service provider and contractor agreements to confirm compliance with California’s requirements, including support for deletion rights cooperation and flow-down provisions.  Wilson Elser’s Data Use and AI Governance team can help businesses assess how SB 923 affects their deletion workflows, third-party data sources, vendor agreements, and consumer request intake, and can advise on CCPA compliance and other privacy law questions as they arise.