William Tolin Gay

AI State Laws Now Top 150 Around the Country New York – October 19, 2026 – National law firm Wilson Elser, in partnership with Ankura Consulting Group, LLC and Privado AI, recently held an inaugural conference on privacy, security, and AI governance. The program focused on evolving privacy laws and security best practices, with artificial intelligence front and center as organizations navigate a growing patchwork of state AI laws. “Convergence: The Intersection of Privacy, Security & AI Governance” was held September 30 at Wilson Elser’s New York offices, featuring speakers from Wilson Elser, Ankura, Privado AI, and several insurance carriers. JD Cheema, Founder of Privado AI, delivered a keynote on technology-enabled data discovery and AI governance.  “Privacy, security, and AI governance are no longer separate conversations. Agentic AI, tightening regulation, and a more active enforcement environment have brought them into the same room,” said Jana Farmer, partner and cochair of Wilson Elser’s Data Use & AI Governance Practice. “At the moment, there is no comprehensive federal standard governing AI use in the United States.”  “Instead, we’re seeing a rapidly growing patchwork of state laws and regulations,” said Farmer, noting that states including New York, California, Utah, Texas, and Colorado have passed more than 150 AI-related laws in the last year alone. “Given this landscape, businesses should plan for the possibility that some of the use cases of AI technology could become restricted after deployment, so that their AI investments hold up as the rules develop.”  The program paired practitioner-level content with built-in opportunities to connect. Convergence was attended by general counsel, privacy and security leaders, cybersecurity and risk professionals, the insurance and carrier community, and outside advisors who serve them. Conference panels included: Navigating the Privacy and AI Landscape: From New Laws to the Courtroom Panelists: Jana Slavina Farmer, AIGP, Wilson Elser; Nicole Nguyen, Senior Director, Privacy Engineering and Technology Practice, Ankura; JD Cheema, Privado; and Christina Van Wert, Senior Manager, Cyber & Professional Lines Group, Tokio Marine HCC.  Topic: Privacy and AI regulation continues to develop on several fronts, and organizations are fielding attention from legislators, regulators, and plaintiffs alike. Through an interactive session, panelists traced the newest privacy and AI legislation, current enforcement priorities, and litigation trends, giving attendees a practical compliance walkthrough they can put to immediate use. Cybersecurity and AI: Governing Agentic Systems Panelists: Dominik Cvitanovic, Wilson Elser; John Schrader, Senior Managing Director, Cyber, Privacy & AI Security Practice, Ankura; Craig Linton, Head of U.S. Underwriting Management for Cyber Risks, Beazley; and Bridget Choi, Cyber Insurance Product Lead, Gallagher. Topic: Agentic AI is reshaping how organizations operate, creating a new class of cybersecurity, contractual, and operational risk. Insurers and insureds alike are asking questions that cut across every industry deploying these systems. Using scenarios drawn from real-world deployments and cyber events, panelists gave attendees practical guidance on governing agentic AI before, during, and after an incident. Cybersecurity Pitfalls and Avoiding the Wrath of Regulators Panelists: Anjali Das, Wilson Elser; Nicole Nguyen, Senior Director, Privacy Engineering and Technology Practice, Ankura; John Schrader, Senior Managing Director, Cyber, Privacy & AI Security Practice, Ankura; and Cody Valdez (former Deputy AG, New Jersey Attorney General’s Office), now an attorney at Wilson Elser. Topic: When a cybersecurity incident hits, regulators are rarely far behind, and they increasingly arrive from several directions at once. A single event can draw parallel scrutiny from the SEC, state financial regulators, health privacy enforcers, and state attorneys general, each with its own rules, deadlines, and enforcement posture. Drawing on recent investigations and enforcement actions, this panel mapped where organizations most often stumble and gave attendees a practical playbook for staying on the right side of the agencies that matter. Implementing AI Across the Business: A Practical Guide to the Risks Panelists: Jana Slavina Farmer, AIGP, Wilson Elser; Jonathan Meer, Wilson Elser; Scott Margolis, Managing Director, Data and Information Governance Practice, Ankura; Matthew McQueeny, AAANow.ai and Earnfluencing; and Rahmila Nadi, Women Leading AI Topic: AI is changing how organizations operate, and the legal and operational risks reach well beyond any single department. No one-size-fits-all approach exists, but common themes cut across every business weighing how to adopt AI responsibly. Through scenarios drawn from situations businesses are navigating right now, panelists gave attendees practical, actionable guidance on the legal and business ramifications of putting AI to work. About Wilson Elser’s Data Use & AI Governance Practice  Wilson Elser is a trusted privacy, security, and AI governance firm in the United States and the preeminent defense litigation firm in the privacy and cyber class action space. For more information about the practice, go to: https://www.wilsonelser.com/data-use-ai-governance About Wilson Elser Wilson Elser is the preeminent defense litigation firm in the United States. Over more than four decades, our litigation and trial lawyers have gained a reputation for taking on and prevailing in the most challenging and technical cases, frequently “parachuting in” to assume unresolved matters from other law firms. Our success also derives from winning on our clients’ terms and rigorously adhering to their guidelines. We are ranked 94 in the Am Law 100 and 30 in the National Law Journal’s NLJ 500. For more information, go to www.wilsonelser.com About Ankura, LLC  Ankura is a leading global consulting and expert services advisory firm with a broad range of specialties across industries, including the cybersecurity, data privacy and governance, and artificial intelligence space. The firm combines strategic advisory with deep technical expertise, hands-on implementation, and expert support to address complex business challenges. Ankura has more than 35 locations and supports projects in more than 115 countries. For more information, go to https://ankura.com/ About Privado AI   Privado AI is an agentic data privacy management platform that helps privacy and compliance teams automate manual governance workflows, map data flows, and detect consent-compliance violations at scale. Founded in 2020, the company leverages specialized AI agents to replace traditional, slow, questionnaire-based compliance methods. For more information, go to https://www.privado.ai/

In Snyder v. Virginia Mason Medical Center, No. 104136-5 (Wash. Oct. 1, 2026), the Washington Supreme Court held that corporate defense counsel, risk managers, and claims adjusters may not communicate ex parte with a hospital’s former employee health care providers about patient care. The Court reaffirmed Loudon v. Mhyre, 110 Wn.2d 675, 756 P.2d 138 (1988) prohibiting ex parte communication by defense counsel with a plaintiff’s treating physicians, held that prejudice is presumed when Loudon is violated, and ruled that a quality improvement (QI) committee member’s involvement in defense strategy waives the committee’s statutory privilege under Wash. Rev. Code § 70.41.200. As a result, informal contact with former employee providers should stop, and factual inquiries should proceed through formal discovery under Wash. Super. Ct. Civ. R. 30 or 31. This article explains how Snyder fits within Washington’s patient confidentiality and corporate privilege framework, how it applies to different categories of providers, and what hospitals and their counsel should do now. Patient Confidentiality vs. Corporate Privilege To navigate the procedural boundaries governing medical malpractice defense in Washington, practitioners must understand the fundamental statutory tension between a patient’s right to health care confidentiality and an institution's right to confer with corporate counsel. Under Washington's Uniform Health Care Information Act, health care providers and their agents are strictly prohibited from disclosing health information without explicit written authorization, except as otherwise provided by law. Wash. Rev. Code § 70.02.020; State v. Scherf, 192 Wn.2d 350, 387, 431 P.3d 976, 995 (2018); King v. Riveland, 125 Wn.2d 500, 509, 886 P.2d 160, 165 (1994). This privacy right is reinforced by Washington's statutory physician-patient privilege, which protects treating physicians from being compelled to testify regarding medical information acquired while attending a patient. Wash. Rev. Code § 5.60.060(4). While a patient automatically waives this statutory privilege upon filing a personal injury or medical malpractice lawsuit under Wash. Rev. Code § 5.60.060(4)(b), the Washington Supreme Court has consistently held that this waiver is not absolute. In Loudon v. Mhyre, 110 Wn.2d 675, 678, 756 P.2d 138, 140 (1988), the Court established a bright-line prohibition against defense counsel engaging in private, ex parte communications with a plaintiff’s treating physicians. The Loudon rule safeguards the fiduciary doctor-patient relationship, prevents inadvertent disclosure of irrelevant medical records, and eliminates the risk of turning defense attorneys into potential trial witnesses. Loudon, 110 Wn.2d at 682, 756 P.2d at 142; Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d 659, 666, 244 P.3d 939, 942–43 (2010). On the corporate side, health care facilities rely on corporate attorney-client privilege to conduct internal risk investigations. Wash. Rev. Code § 5.60.060(2)(a); Upjohn Co. v. United States, 449 U.S. 383, 389, 101 S. Ct. 677, 682, 66 L. Ed. 2d 584 (1981). However, in Newman v. Highland School District No. 203, 186 Wn.2d 769, 381 P.3d 1188 (2016), the Washington Supreme Court established a strict temporal boundary on corporate privilege, holding that privilege does not extend to post-employment communications with former employees: “The underlying purpose of the corporate attorney-client privilege is to foster full and frank communications between counsel and the client (i.e., the corporation), not its former employees... This purpose is preserved by limiting the scope of the privilege to the duration of the employer-employee relationship.” Newman, 186 Wn.2d at 781, 381 P.3d at 1193 (quoting Restatement (Third) of the Law Governing Lawyers § 73 cmt. e (Am. L. Inst. 2000)). Evolution of Provider Contact Rules: Current vs. Former Personnel How does one reconcile corporate attorney-client privilege with the Loudon doctrine? The Supreme Court addressed this conflict in Youngs v. PeaceHealth, 179 Wn.2d 645, 664, 316 P.3d 1035, 1045 (2014), carving out a narrow exception allowing corporate defense counsel to conduct confidential ex parte interviews with a nonparty treating physician who is a current employee of the hospital, provided those communications are limited strictly to the facts surrounding the alleged negligent incident. In Hermanson v. MultiCare Health System, Inc., 196 Wn.2d 578, 581, 475 P.3d 484, 487 (2020), the Court extended this principle to current non-physician staff and current independent contractors who are the functional equivalents of employees. However, when a treating provider leaves the facility's employ, the legal landscape shifts dramatically across four distinct provider categories: Current Employee Providers: Fully covered under the Youngs exception. Corporate defense counsel may conduct privileged, ex parte interviews with active employee physicians, nurses, and staff, provided the conversation is confined to the facts of the alleged negligent incident and does not delve into general medical history. Youngs v. PeaceHealth, 179 Wn.2d at 671. Current Independent Contractors: Covered under Hermanson where an agency or functional equivalent relationship exists. If an independent contractor doctor acts as an agent of the facility, corporate counsel may confer ex parte under the same strict factual constraints of Youngs. Hermanson v. MultiCare Health Sys., Inc., 196 Wn.2d at 589–90. Former Employee Providers (Including C-Suite Officers & Owners): Governed strictly by Newman and Snyder. The moment a provider separates from employment, it instantly extinguishes corporate attorney-client privilege over ongoing trial preparation. Because former employees no longer owe agency duties, defense counsel cannot conduct ex parte interviews with former staff regarding patient care under any circumstances. Snyder v. Virginia Mason Med. Ctr., slip op. at 28–29. Quality Improvement (QI) Committee Members: Subject to statutory peer-review immunity under Wash. Rev. Code § 70.41.200(3). While records prepared for QI committees are immune from discovery, committee members must be strictly screened from litigation defense teams. If a QI member participates in active trial strategy or ex parte witness preparation, statutory peer-review privilege is completely forfeited. Snyder, slip op. at 38–39. The Snyder Decision: Presumed Harm, Privilege Logs, and QI Waiver In Snyder v. Virginia Mason Medical Center, No. 104136-5, slip op. (Wash. Oct. 1, 2026) (En Banc), the Washington Supreme Court resolved lingering uncertainties by establishing three definitive holdings that fundamentally reshape medical malpractice litigation. 1. Rejection of Defense Exceptions and Affirmance of Loudon The Supreme Court affirmed that Loudon applies strictly to former employee health care providers, regardless of whether their care forms the primary basis of the hospital's alleged vicarious liability. In doing so, the Court explicitly rejected a series of defense theories: Representation Agreements & Indemnity Contracts: Private employment contracts requiring former doctors to cooperate in litigation defense cannot override statutory patient privacy rights under Wash. Rev. Code § 70.02.020 or physician-patient privilege under Wash. Rev. Code § 5.60.060(4). Hermanson, 196 Wn.2d at 590 n.1; Snyder, slip op. at 25–26. Common Interest / Joint Defense Theories: Shared legal exposure does not authorize defense counsel to conduct ex parte trial strategy sessions with former employee providers or their separate attorneys. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Inapplicability of Youngs: The Court confirmed that the fiduciary doctor-patient relationship survives employment termination, placing former employee providers strictly beyond the reach of the Youngs current-employee exception. Snyder, slip op. at 28–29. 2. Magaña and the Presumption of Prejudice Crucially, the Supreme Court disavowed its prior decision in Magaña v. Hyundai Motor America, 167 Wn.2d 570, 220 P.3d 191 (2009), which required plaintiffs to prove substantial litigation prejudice to obtain discovery sanctions. Holding that ex parte contacts inherently damage the fiduciary doctor-patient relationship, the Court established that prejudice is presumed upon demonstrating a Loudon violation. Snyder, slip op. at 33–34. To evaluate appropriate sanctions—ranging from monetary fines to entering a default judgment on liability—the Supreme Court extended Cedell v. Farmers Insurance Co. of Washington, 176 Wn.2d 686, 295 P.3d 239 (2013), ordering the trial court to conduct an in-camera inspection of all withheld defense privilege log entries generated during unauthorized ex parte contacts. Snyder, slip op. at 35–36. 3. Subject-Matter Waiver of Quality Improvement Immunity Under Wash. Rev. Code § 70.41.200(3), hospital Quality Improvement committee proceedings are confidential. However, in Snyder, the Chief Medical Officer sat on the hospital’s statutory QI committee while simultaneously receiving litigation talking points from defense counsel, coordinating witness outreach, and traveling ex parte to meet with a former resident physician. The Supreme Court held that failing to ethically screen a QI committee member from active litigation strategy taints the committee's inner workings, effecting a complete subject-matter waiver of statutory peer-review privilege. Snyder, slip op. at 38–39. Real-World Realities: Memory Decay, Pre-Litigation Holds, and Sophistication At the end of the day, modern institutional health care delivery renders determining the exact composition of a patient's treatment team—and whether defense counsel is legally permitted to speak with any given provider—an exercise in pure guesswork. It has long been complicated for patients and health systems to figure out who their doctor is in a complex clinical environment involving rotating resident physicians, attending specialists, hospitalists, and independent contractors. Yet, now no one seems to know who the doctor might not be and whether defense counsel should be speaking to them behind closed doors. By establishing an unyielding temporal boundary that severs corporate attorney-client privilege the exact moment an employee separates from service, Newman, 186 Wn.2d at 781, and Snyder, slip op. at 20, 28–29, creates an unworkable practical fiction. In effect, this rigid rule generates an absurd practical presumption: that no health care practitioner can ever retire, relocate, or transition employment if any remote possibility of future litigation may ensue. This jurisprudence fundamentally neglects two operational realities of medical malpractice defense: the necessity of pre-litigation risk investigations and the natural fading of human memory. When an adverse clinical outcome occurs, risk management must investigate immediately to evaluate institutional exposure. While an institution can readily issue electronic litigation holds to preserve health records, paper charts, and audit trails, it is impossible to ask a human witness to hold onto their unrefreshed memories. While interviewing a witness when a facility first learns of a potential claim is straightforward, months or even years frequently elapse between the medical event, the formal filing of a lawsuit, and the procedural opportunity for defense counsel to deploy formal discovery rules under Wash. Super. Ct. Civ. R. 30 or CR 31. Expecting a treating physician to maintain vivid, detailed recollections of a single procedure performed years earlier—without the benefit of informal factual debriefs with risk management—defies human memory and litigation reality. Finally, this line of authority improperly presumes a uniform, strict sophistication across all health care facilities. Snyder presumes that every community hospital, rural health clinic, and small practice group maintains the extensive legal infrastructure, ethical screening walls, and specialized claims teams of a major academic medical center. By imposing strict liability sanctions and an automatic presumption of prejudice for ex parte contacts regardless of actual litigation harm (Snyder, slip op. at 33–34), the Court penalizes health care entities for standard risk management inquiries while ignoring the operational realities of modern medical practice. Specific Application Cases: C-Suite, Mid-Suit Separation, and Dual Roles A. Former C-Suite Executives, Board Members, and Physician-Owners A frequent point of defense confusion is whether a physician’s former status as a C-suite executive (e.g., Chief Medical Officer), board member, or equity owner exempts them from Loudon. Under Washington law, the extent of corporate privilege coverage depends entirely upon temporal status and the subject matter of the communication. This includes: Pre-Separation Corporate Governance Communications (COVERED): Confidential communications made during active executive, board, or ownership tenure regarding hospital administration, risk management, or general business operations remain protected by the entity's attorney-client privilege under Upjohn Co. v. United States, 449 U.S. 383, 391 (1981) and Wash. Rev. Code § 5.60.060(2)(a). Post-Separation Patient Care Communications (NOT COVERED): Once employment, board tenure, or equity ownership severs, corporate attorney-client privilege terminates. Newman, 186 Wn.2d at 781. Reaffirming Newman, the Supreme Court in Snyder, slip op. at 20, 28–29 held that former executive or ownership status creates no exception to Loudon. Because former C-suite physicians and owners no longer possess agency authority or ongoing duties of loyalty to the entity, defense counsel cannot engage in post-separation ex parte trial preparation regarding patient care provided by that physician. B. Mid-Litigation Employment Termination If a treating physician’s employment terminates during active medical malpractice litigation, corporate attorney-client privilege over ongoing trial preparation instantly evaporates at the moment of separation. Under Newman and Snyder, corporate defense counsel is strictly barred from conducting further ex parte strategy sessions with the departing physician, practically necessitating separate independent counsel for the physician to prevent per se Loudon violations and concurrent conflicts under Rule of Professional Conduct 1.7. C. Dual-Roled Physicians and Corporate PMK Designees Quality Improvement (QI) committee members represent one of the most perilous legal landmines for health care facilities under Snyder, slip op. at 38–39. Health care facilities face an inherent dilemma: the individuals best situated to serve as key corporate contacts or Person Most Knowledgeable (PMK) designees under Wash. Super. Ct. Civ. R. 30(b)(6)—such as CMOs or Medical Directors—are almost universally the exact same clinical leaders who sit on statutory QI committees. When a lawsuit emerges, institutions routinely rely on senior officers to investigate the incident and coordinate witness outreach. However, under Snyder, combining statutory peer-review functions with litigation defense strategy destroys the statutory privilege protecting the facility's Quality Improvement proceedings. To protect peer-review immunity, institutions ought to consider implementing proactive, pre-litigation organizational role separation: structurally dividing clinical governance so that high-level physicians on QI committees are permanently barred from acting as litigation claims liaisons or CR 30(b)(6) designees. Practical Compliance  To navigate the strict mandates of Snyder and protect case integrity, corporate defense counsel and health care risk managers must adopt three mandatory practice protocols: Conduct Factual Discovery Exclusively Through Formal Court Rules. Defense counsel must refrain from informal telephone calls, debriefs, or “support visits” with former employee providers. All factual inquiries must occur through formal oral depositions under Wash. Super. Ct. Civ. R. 30 or written depositions under Wash. Super. Ct. Civ. R. 31 upon formal notice to plaintiff's counsel. Strictly Prohibit Using Separate Counsel as a Conduit. If an insurer assigns separate independent counsel to represent a former employee provider under continuing indemnification duties, primary corporate counsel cannot pass trial briefs, expert reports, or strategy talking points ex parte to separate counsel. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Establish Proactive Pre-Litigation QI Ethical Walls. Health care facilities must structurally divide clinical governance so that high-level physicians who serve on statutory Quality Improvement peer-review committees are permanently barred from acting as corporate claims liaisons, risk defense managers, or corporate Person Most Knowledgeable (PMK) designees under CR 30(b)(6). Proactive ethical screening is essential to prevent subject-matter waiver of statutory peer-review immunity under Wash. Rev. Code § 70.41.200.

On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923 (Chapter 482, Statutes of 2026), known as the Expanding Privacy Rights Act. The law amends two provisions of the California Consumer Privacy Act (CCPA): (1) the right to delete (Civil Code § 1798.105); and (2) the methods for submitting consumer requests (Civil Code § 1798.130). The legislation was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency (also known as CalPrivacy). This amendment takes effect January 1, 2027. A deletion request will now reach personal information that a business bought or received from others, not only what the consumer provided. Online-only businesses must also offer a web form or portal for privacy requests. For most companies, this is an operational change rather than a new program, but it reaches data stores that many request workflows never touch. Reasons Behind the Amendment Under the prior CCPA text, consumers could request deletion only of information a business collected “from the consumer.” The California Legislature found that the existing right “allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties. This creates a gap in protection.” S.B. 923, 2025–2026 Leg., Reg. Sess. § 1(b) (Cal. 2026) (enacted as 2026 Cal. Stat. ch. 482). CalPrivacy, the legislation’s sponsor, noted that “businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete.” CalPrivacy, California Expands Privacy Protections by Strengthening Deletion Rights (Sept. 27, 2026). With respect to the means for the submission of the requests, the current CCPA regulations require a webform only from businesses that are not exclusively online, and only if they have a website. See 11 CCR § 7020(b) (requests "shall be through its website, such as through a webform."). Online-only businesses with a direct consumer relationship still need only an email address under § 7020(a). As Senator Becker, the author of this bill, explained in his statement, “while most businesses must provide two or more methods to submit privacy requests, online-only businesses that have a direct relationship with the consumer are only required to provide an email address for consumers to submit most privacy requests under the CCPA. This single-method requirement for certain businesses creates barriers for consumers because it offers minimal support or guidance.” Assemb. Comm. on Privacy & Consumer Prot., Analysis of S.B. 923, 2025–2026 Leg., Reg. Sess., at 5 (Cal. June 23, 2026) (as amended June 11, 2026) (quoting author's statement). CalPrivacy, which sponsored the bill, says it aligns California with deletion rights in Delaware, Indiana, Maryland, and New Jersey, and stresses that the CCPA’s existing exemptions, including fraud prevention and legal compliance, remain available. What the Statute Now Says Broader Deletion Right Amended Section 1798.105(a) provides: “A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.” Suppression Records for Third-Party Data For data obtained from other sources, the law gives businesses a defined way to comply: “A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal information remains deleted from the business’s records and is not being used for any other purpose.” Expanded Downstream Obligations The existing duties still apply: the business must “notify any service providers or contractors to delete the consumer’s personal information from their records and notify all third parties to whom the business has sold or shared the personal information,” unless “this proves impossible or involves disproportionate effort.” Service providers and contractors “shall cooperate with the business in responding to a verifiable consumer request.” Because the deletion right is broader, these flow-down duties now reach a larger set of records. Preserved Exceptions  Businesses may still retain information when reasonably necessary to, among other things, “[h]elp to ensure security and integrity” or “[c]omply with a legal obligation.” New Online Request Requirement Amended Section 1798.130(a)(1)(A) provides that a business that “operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address and make an online method, such as a web form or online portal, available” for requests to know, delete, or correct. An email inbox alone will no longer suffice. What Is Required, From Whom, and When Beginning January 1, 2027, every business subject to the CCPA must honor deletion requests for personal information it holds about a consumer, whether it collected that data from the consumer or got it from a broker, vendor, or other third party. For data collected from other sources, a business complies with the new requirements by keeping a record of the request and only the minimum data needed to make sure the consumer's information stays deleted. Service providers and contractors must assist the business in their responses to the consumer rights requests. At the business's direction, they must delete the data and notify their own downstream service providers and contractors to do the same.  Starting from January 1, 2027, a business that operates exclusively online and has a direct relationship with consumers must now offer an online method, such as a web form or portal, in addition to an email address, for submission of consumer requests. Businesses with brick-and-mortar presence keep their current obligation to offer at least two methods for consumer requests, including a toll-free telephone number. Practical Steps to Take Before January 1, 2027 Compliance with contemporary data privacy laws must involve technical solutions along with legal and compliance ones. Online-only businesses seeking to implement the webform or portal for the first time must be mindful of the privacy laws-related requirements, including the need for verification, the regulatory response timelines, and the recordkeeping requirements related to the fulfilled requests. All businesses subject to CCPA should also take the time to map where personal information sourced from third parties resides in their systems, extend deletion workflows to those systems, and build or check their suppression records workflow. This is also a good time to review the mandatory service provider and contractor agreements to confirm compliance with California’s requirements, including support for deletion rights cooperation and flow-down provisions.  Wilson Elser’s Data Use and AI Governance team can help businesses assess how SB 923 affects their deletion workflows, third-party data sources, vendor agreements, and consumer request intake, and can advise on CCPA compliance and other privacy law questions as they arise.

Q: Are employees entitled by law to access their personnel files?   A: There is no federal law that gives private-sector employees the right to view their personnel files. Access is regulated entirely by state-specific laws. There are currently 19 states that legally require employers to permit employees (and sometimes former employees) to view and/or obtain a copy of their personnel file. As of November 8, 2026, that number will increase to 20, when New York’s recently enacted Personnel Records Access Law goes into effect. The majority of states have no law requiring access to personnel files and there is no federal law that confers on current or former employees a statutory right to access their personnel files.  As of October of 2026, the following states provide right of access to current employees: Alaska, California, Colorado, Connecticut, Delaware, Illinois, Iowa, Maine, Massachusetts, Michigan, Minnesota, Nevada, New Hampshire, Oregon, Pennsylvania, Rhode Island, Virgina, Washington, and Wisconsin.  Some states, including New York (as of November 8, 2026), also allow former employees to view their personnel files. Each state has its own caveats to access. For example, Washington allows for a former employee to retain the right of rebuttal or correction for up to two years following their separation from employment.  New York’s new law, Senate Bill 2025-S3460, was signed by Governor Kathy Hochul on September 9, 2026, adding Section 210-b to the New York Labor Law. The law covers public and private sector employers, including individuals, corporations, partnerships, labor organizations, unincorporated associations, other legal businesses and employer agents.  Employers operating in New York should familiarize themselves with the requirements of Section 210-b now, before it goes into effect, and update their document-management and onboarding practices accordingly, as non-compliance may expose them to claims under the New York Labor Law.  What Will New York Law Require? The law in New York will require employers to provide current and former employees with a copy of their personnel records within five (5) business days of a written request, up to twice per calendar year, at no cost to the employee. Employers also must notify employees within ten business (10) days after placing information in a personnel record that is, has been, or may be used to negatively affect the employee’s qualifications for employment, promotion, transfer, additional compensation, or the possibility of disciplinary action. If there is a disagreement with any information within the personnel record, removal or correction of the information may be mutually agreed upon by the employer and the employee. If the employee doesn’t agree with the information the employer places in the file, the employee can submit a written statement explaining the employee’s position, which must become a part of the employee’s personnel record and must accompany the disputed information when it is transmitted to a third party, so long as the original information remains in the file. Employers are not required to permit an employee to review their personnel record more than twice per calendar year, but a notification and review resulting from the placement of negative information in the record does not count toward that limit. Under the new law, to the extent employers create personnel records, without deletions or expungement of information, they are required to maintain them from the date of employment through three years after termination of the employee’s employment. What Types of Documents Are Covered Under New York’s Personnel Records Law? The New York law expressly defines “personnel records” to include the following written information and documents prepared by an employer regarding an employee, for inclusion in the employee’s personnel record: Name, address, date of birth, job title and description  Rate of pay and any other compensation paid to the employee Starting date of employment  The job application of the employee  Resumes or other forms of employment inquiry submitted by the employee to the employer in response to the employer's advertisement  All employee performance evaluations, including but not limited to employee evaluation documents  Written warnings of substandard performance  Lists of probationary periods  Waivers signed by the employee Copies of dated termination notices  Any documents relating to disciplinary action regarding the employee The law applies broadly and is not limited to the above-listed documentation. Examples of documents also likely covered include: 1. Employment agreements and offer letters signed at the start of the employment relationship 2. Handbook and policy acknowledgment forms, such as sign-offs on anti-harassment policies, code of conduct agreements, or confidentiality acknowledgments 3. Performance improvement plans that the employee is asked to sign to confirm receipt 4. Separation-related documents, such as resignation acknowledgments or exit interview forms, to the extent they are placed in the personnel file Note that the law expressly excludes, “information of a personal nature about a person other than the employee if disclosure of the information would constitute a clearly unwarranted invasion of such other person’s privacy.” The law prohibits employers and other persons from discharging, threatening, penalizing, discriminating, or retaliating against employees who exercise their statutory rights.  Practical Tips for New York Employers New York employers should keep several practical points in mind as they prepare to comply with Section 210-b of the Labor Law: 1. Review current practices and protocols. Before November 8, 2026, New York employers should review their personnel record practices and retention procedures. Employers should establish a protocol for tracking and responding to an employee’s request for the employee’s personnel file. Determine whether your organization already provides employees with copies of all signed personnel documents. Employers also should evaluate whether covered personnel records maintained by third-party providers can be produced within five business days.  2. Update onboarding and HR workflows. Ensure that standard operating procedures require HR personnel and managers to provide a copy of every signed document to the employee at the time of signing. Consider building this step into electronic onboarding platforms and document management systems so that copy delivery is automatic rather than dependent on individual compliance to ensure timely compliance with the notification requirements. 3. Leverage electronic signature and document management tools. Employers using e-signature platforms can configure them to send a completed copy of each signed document to the employee automatically, which streamlines compliance and creates a reliable audit trail. 4. Train HR staff and supervisors. Managers and HR professionals who handle personnel paperwork should be informed of the new requirement and understand that every signed document placed in a personnel file must be accompanied by delivery of a copy to the employee. Employers should train HR personnel and managers on the law’s access, notice, retention, and anti-retaliation requirements. 5. Document delivery of copies. Maintain a record confirming that each signed document was provided to the employee. Whether through an electronic system's automatic confirmation, an email transmittal, or a signed acknowledgment of receipt, this documentation can be important if compliance is later questioned. What Are the Risks of Non-Compliance? For companies that violate the law, New York’s Attorney General would be empowered to seek penalties ranging from $500 to $2,500 per violation, and workers who face discrimination or retaliation for asserting their rights would have a private right of action. Broader Considerations New York's enactment of Section 210-b is part of a broader trend of states strengthening employee access to workplace records. For instance, California employers must allow current and former employees to inspect and receive copies of personnel records relating to the employee’s performance or any grievance concerning the employee. In addition, California employers must also provide education and training records upon the employee’s authorized request within a 30-day window. In contrast, employers in the state of Texas are not required to turn over personnel files to current or former employees. Employers operating in multiple jurisdictions should be aware that personnel-file access laws vary significantly from state to state. 

Peter Espey (Of Counsel-Madison, NJ) was quoted in the article “Economic Pressures, Younger Juries Mean NJ Awards Remain Elevated, Lawyers Say,” appearing in the October 22, 2026, edition of Law.com’s New Jersey Law Journal. Peter, who focuses his practice on Medical Malpractice, in addition to other areas, was interviewed along with another defense attorney and two plaintiffs’ attorneys about the increase in jury verdicts and settlements in New Jersey in 2026. The total amount from the top twenty personal injury awards in New Jersey increased by $82 million from 2025 to 2026.  Peter identifies possible reasons, including generational changes among potential jurors, explaining, “Some of the older potential jurors are aging out and less likely to serve, so it’s a new group of people that are the potential jurors. They might see things differently than their parents or grandparents.” Peter also cites inflation, economic strain, and lingering repercussions from the COVID pandemic as fueling litigation and larger settlements, noting that some plaintiffs' attorneys may also be becoming more selective, taking only higher-value cases.  He discussed other potential causes. 

Thomas Comer (Partner, New York), Thomas O’Connor (Associate, White Plains), and Judy Selmeci (Partner, New York), obtained a complete defense verdict on behalf of the client in Supreme Court, Nassau County before the Hon. Catherine Rizzo. The jury unanimously found that the client bore no liability in connection with plaintiff’s claimed Labor Law accident. Plaintiff, a 24-year-old demolition laborer at the time of the alleged incident, claimed that he sustained injuries as a result of a fall from a scaffold while performing interior demolition work. He alleged significant orthopedic injuries, including to his knee, spine, and shoulder, and underwent multiple surgical procedures, including a two-level lumbar laminectomy, a single-level cervical fusion, and a left shoulder arthroscopy. He further claimed total disability, with over $1,000,000 in alleged future lost wages. Plaintiff’s theory as to the client was not based on any actual involvement in the work, but on an effort to characterize the client as a “contractor” or statutory agent based largely on a permit issued in its name. The defense focused on a clear and targeted strategy: establishing that the client had no authority to direct, supervise, or control the injury-producing work. The evidence showed that the client did not perform work at the site, did not retain plaintiff or any subcontractors, did not receive payment, and had no role in how the work was carried out. Instead, the work was performed independently by others, without the client’s knowledge or involvement. During the charge conference, the team secured modified jury instructions to both PJI 2:216 and 2:217. Over opposition, the Court agreed to instruct the jury that it must first determine whether the client had the authority to supervise, direct, or control the work before considering any potential Labor Law liability. That framework was reinforced in the verdict sheet, which required the jury to address this threshold issue at the outset. At trial, the defense also highlighted significant credibility issues in plaintiff’s account, including his admission that he told medical providers he was injured in a bicycle accident. Through cross-examination and the testimony of a neutral medical witness, the defense established that plaintiff offered multiple, inconsistent explanations for this discrepancy. Following nearly four hours of deliberations, the jury returned a unanimous defense verdict, with the jury assigning 0% liability to the client.

Jennifer Martin (Partner-Dallas, TX) and Graham R. Pulvere (Partner -Birmingham, AL) will present the Wilson Elser Forum webinar “Drawing the Line: Aligning Scope-of-Loss Disputes Right from the Start” on October 27, 2026. When an insurer and an insured disagree on what's covered damage and what isn't, the claim process can quickly become contentious. This session offers claims professionals practical guidance for managing scope-of-loss disputes from day one. The presenters cover how to timely retain the right experts, ensure their assessments align with policy terms and definitions, critically evaluate competing reports, and build a well-supported claim file that can withstand scrutiny, including in appraisal.

Keti Mebuke Wade (Associate-Chicago, IL) will present “Defending Policy Limit Cases and Bad Faith Claims” at the Fall Meeting of the Joint Claims Executives Associations (JCEA). The 2026 meeting, Preparing Today's Leaders for Tomorrow's Claims Environment, will be held in Nashville, Tennessee, October 25 ‒ 27. With policy-limit demands and bad faith allegations remaining among the highest-risk exposures facing insurers, Keti’s session offers a practical framework for claims leaders to evaluate policy-limit exposure cases, coordinate investigation and documentation efforts, and respond strategically to time-limited demands in ways that strengthen settlement positioning while reducing bad-faith risk.  

Washington, D.C. partners Ryan Duffy and Kathleen Warin secured two significant victories in the U.S. District Court for the District of Columbia on behalf of the Financial Industry Regulatory Authority (FINRA). In two separate cases, former securities brokers sought to expunge customer dispute information from their registration records maintained by FINRA in the Central Registration Depository (CRD) system, which is publicly available through BrokerCheck as required under the Securities Exchange Act of 1934. The plaintiffs each asserted claims for equitable expungement, declaratory judgment, and a permanent injunction. In both cases, the Wilson Elser team successfully argued that the plaintiffs failed to identify any cognizable cause of action against FINRA that would entitle them to expungement relief. Ryan and Kathleen demonstrated that neither the Exchange Act nor FINRA Rules create a private right of action against FINRA for expungement of customer dispute information from the CRD, and that the plaintiffs' claims for equitable relief, declaratory judgment, and a permanent injunction were remedies rather than cognizable causes of action. Both courts agreed in full, granting FINRA's motions to dismiss with prejudice. They held that the Exchange Act's comprehensive regulatory scheme does not authorize private suits against FINRA for actions taken pursuant to its statutory obligations, and that federal courts have overwhelmingly declined to recognize any such private right of action. The courts also rejected the plaintiffs’ arguments that their inherent equitable powers could supply the missing cause of action, reaffirming the well-established principle that equitable expungement, declaratory relief, and injunctive relief are forms of remedy ‒ not independent sources of legal entitlement. Together, these decisions provide critical legal authority and reinforce that brokers have no private right of action against FINRA for expungement of customer dispute information maintained pursuant to its statutory obligations. 

Jonathan Meer (Partner-New York, NY) will present on the panel "D&O Liability Insurance ‒ What's Changing and Why It Matters" at the Anderson Kill 30th Annual Policyholder Conference on October 28, 2026, held in Manhattan, New York. Jonathan’s panel will provide the insurer side of coverage disputes in light of current developments. His panel will examine the evolving D&O liability landscape and the emerging risks that are reshaping coverage for corporate directors and officers, using hypothetical situations and examples of recent trends. Panelists will also discuss developments in securities litigation, regulatory enforcement, emerging technologies, and other exposures that may impact D&O programs, as well as address changing policy terms, insurer positions, and strategies policyholders can use to protect and maximize their D&O coverage.

On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923 (Chapter 482, Statutes of 2026), known as the Expanding Privacy Rights Act. The law amends two provisions of the California Consumer Privacy Act (CCPA): (1) the right to delete (Civil Code § 1798.105); and (2) the methods for submitting consumer requests (Civil Code § 1798.130). The legislation was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency (also known as CalPrivacy). This amendment takes effect January 1, 2027. A deletion request will now reach personal information that a business bought or received from others, not only what the consumer provided. Online-only businesses must also offer a web form or portal for privacy requests. For most companies, this is an operational change rather than a new program, but it reaches data stores that many request workflows never touch. Reasons Behind the Amendment Under the prior CCPA text, consumers could request deletion only of information a business collected “from the consumer.” The California Legislature found that the existing right “allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties. This creates a gap in protection.” S.B. 923, 2025–2026 Leg., Reg. Sess. § 1(b) (Cal. 2026) (enacted as 2026 Cal. Stat. ch. 482). CalPrivacy, the legislation’s sponsor, noted that “businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete.” CalPrivacy, California Expands Privacy Protections by Strengthening Deletion Rights (Sept. 27, 2026). With respect to the means for the submission of the requests, the current CCPA regulations require a webform only from businesses that are not exclusively online, and only if they have a website. See 11 CCR § 7020(b) (requests "shall be through its website, such as through a webform."). Online-only businesses with a direct consumer relationship still need only an email address under § 7020(a). As Senator Becker, the author of this bill, explained in his statement, “while most businesses must provide two or more methods to submit privacy requests, online-only businesses that have a direct relationship with the consumer are only required to provide an email address for consumers to submit most privacy requests under the CCPA. This single-method requirement for certain businesses creates barriers for consumers because it offers minimal support or guidance.” Assemb. Comm. on Privacy & Consumer Prot., Analysis of S.B. 923, 2025–2026 Leg., Reg. Sess., at 5 (Cal. June 23, 2026) (as amended June 11, 2026) (quoting author's statement). CalPrivacy, which sponsored the bill, says it aligns California with deletion rights in Delaware, Indiana, Maryland, and New Jersey, and stresses that the CCPA’s existing exemptions, including fraud prevention and legal compliance, remain available. What the Statute Now Says Broader Deletion Right Amended Section 1798.105(a) provides: “A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.” Suppression Records for Third-Party Data For data obtained from other sources, the law gives businesses a defined way to comply: “A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal information remains deleted from the business’s records and is not being used for any other purpose.” Expanded Downstream Obligations The existing duties still apply: the business must “notify any service providers or contractors to delete the consumer’s personal information from their records and notify all third parties to whom the business has sold or shared the personal information,” unless “this proves impossible or involves disproportionate effort.” Service providers and contractors “shall cooperate with the business in responding to a verifiable consumer request.” Because the deletion right is broader, these flow-down duties now reach a larger set of records. Preserved Exceptions  Businesses may still retain information when reasonably necessary to, among other things, “[h]elp to ensure security and integrity” or “[c]omply with a legal obligation.” New Online Request Requirement Amended Section 1798.130(a)(1)(A) provides that a business that “operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address and make an online method, such as a web form or online portal, available” for requests to know, delete, or correct. An email inbox alone will no longer suffice. What Is Required, From Whom, and When Beginning January 1, 2027, every business subject to the CCPA must honor deletion requests for personal information it holds about a consumer, whether it collected that data from the consumer or got it from a broker, vendor, or other third party. For data collected from other sources, a business complies with the new requirements by keeping a record of the request and only the minimum data needed to make sure the consumer's information stays deleted. Service providers and contractors must assist the business in their responses to the consumer rights requests. At the business's direction, they must delete the data and notify their own downstream service providers and contractors to do the same.  Starting from January 1, 2027, a business that operates exclusively online and has a direct relationship with consumers must now offer an online method, such as a web form or portal, in addition to an email address, for submission of consumer requests. Businesses with brick-and-mortar presence keep their current obligation to offer at least two methods for consumer requests, including a toll-free telephone number. Practical Steps to Take Before January 1, 2027 Compliance with contemporary data privacy laws must involve technical solutions along with legal and compliance ones. Online-only businesses seeking to implement the webform or portal for the first time must be mindful of the privacy laws-related requirements, including the need for verification, the regulatory response timelines, and the recordkeeping requirements related to the fulfilled requests. All businesses subject to CCPA should also take the time to map where personal information sourced from third parties resides in their systems, extend deletion workflows to those systems, and build or check their suppression records workflow. This is also a good time to review the mandatory service provider and contractor agreements to confirm compliance with California’s requirements, including support for deletion rights cooperation and flow-down provisions.  Wilson Elser’s Data Use and AI Governance team can help businesses assess how SB 923 affects their deletion workflows, third-party data sources, vendor agreements, and consumer request intake, and can advise on CCPA compliance and other privacy law questions as they arise.

In Snyder v. Virginia Mason Medical Center, No. 104136-5 (Wash. Oct. 1, 2026), the Washington Supreme Court held that corporate defense counsel, risk managers, and claims adjusters may not communicate ex parte with a hospital’s former employee health care providers about patient care. The Court reaffirmed Loudon v. Mhyre, 110 Wn.2d 675, 756 P.2d 138 (1988) prohibiting ex parte communication by defense counsel with a plaintiff’s treating physicians, held that prejudice is presumed when Loudon is violated, and ruled that a quality improvement (QI) committee member’s involvement in defense strategy waives the committee’s statutory privilege under Wash. Rev. Code § 70.41.200. As a result, informal contact with former employee providers should stop, and factual inquiries should proceed through formal discovery under Wash. Super. Ct. Civ. R. 30 or 31. This article explains how Snyder fits within Washington’s patient confidentiality and corporate privilege framework, how it applies to different categories of providers, and what hospitals and their counsel should do now. Patient Confidentiality vs. Corporate Privilege To navigate the procedural boundaries governing medical malpractice defense in Washington, practitioners must understand the fundamental statutory tension between a patient’s right to health care confidentiality and an institution's right to confer with corporate counsel. Under Washington's Uniform Health Care Information Act, health care providers and their agents are strictly prohibited from disclosing health information without explicit written authorization, except as otherwise provided by law. Wash. Rev. Code § 70.02.020; State v. Scherf, 192 Wn.2d 350, 387, 431 P.3d 976, 995 (2018); King v. Riveland, 125 Wn.2d 500, 509, 886 P.2d 160, 165 (1994). This privacy right is reinforced by Washington's statutory physician-patient privilege, which protects treating physicians from being compelled to testify regarding medical information acquired while attending a patient. Wash. Rev. Code § 5.60.060(4). While a patient automatically waives this statutory privilege upon filing a personal injury or medical malpractice lawsuit under Wash. Rev. Code § 5.60.060(4)(b), the Washington Supreme Court has consistently held that this waiver is not absolute. In Loudon v. Mhyre, 110 Wn.2d 675, 678, 756 P.2d 138, 140 (1988), the Court established a bright-line prohibition against defense counsel engaging in private, ex parte communications with a plaintiff’s treating physicians. The Loudon rule safeguards the fiduciary doctor-patient relationship, prevents inadvertent disclosure of irrelevant medical records, and eliminates the risk of turning defense attorneys into potential trial witnesses. Loudon, 110 Wn.2d at 682, 756 P.2d at 142; Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d 659, 666, 244 P.3d 939, 942–43 (2010). On the corporate side, health care facilities rely on corporate attorney-client privilege to conduct internal risk investigations. Wash. Rev. Code § 5.60.060(2)(a); Upjohn Co. v. United States, 449 U.S. 383, 389, 101 S. Ct. 677, 682, 66 L. Ed. 2d 584 (1981). However, in Newman v. Highland School District No. 203, 186 Wn.2d 769, 381 P.3d 1188 (2016), the Washington Supreme Court established a strict temporal boundary on corporate privilege, holding that privilege does not extend to post-employment communications with former employees: “The underlying purpose of the corporate attorney-client privilege is to foster full and frank communications between counsel and the client (i.e., the corporation), not its former employees... This purpose is preserved by limiting the scope of the privilege to the duration of the employer-employee relationship.” Newman, 186 Wn.2d at 781, 381 P.3d at 1193 (quoting Restatement (Third) of the Law Governing Lawyers § 73 cmt. e (Am. L. Inst. 2000)). Evolution of Provider Contact Rules: Current vs. Former Personnel How does one reconcile corporate attorney-client privilege with the Loudon doctrine? The Supreme Court addressed this conflict in Youngs v. PeaceHealth, 179 Wn.2d 645, 664, 316 P.3d 1035, 1045 (2014), carving out a narrow exception allowing corporate defense counsel to conduct confidential ex parte interviews with a nonparty treating physician who is a current employee of the hospital, provided those communications are limited strictly to the facts surrounding the alleged negligent incident. In Hermanson v. MultiCare Health System, Inc., 196 Wn.2d 578, 581, 475 P.3d 484, 487 (2020), the Court extended this principle to current non-physician staff and current independent contractors who are the functional equivalents of employees. However, when a treating provider leaves the facility's employ, the legal landscape shifts dramatically across four distinct provider categories: Current Employee Providers: Fully covered under the Youngs exception. Corporate defense counsel may conduct privileged, ex parte interviews with active employee physicians, nurses, and staff, provided the conversation is confined to the facts of the alleged negligent incident and does not delve into general medical history. Youngs v. PeaceHealth, 179 Wn.2d at 671. Current Independent Contractors: Covered under Hermanson where an agency or functional equivalent relationship exists. If an independent contractor doctor acts as an agent of the facility, corporate counsel may confer ex parte under the same strict factual constraints of Youngs. Hermanson v. MultiCare Health Sys., Inc., 196 Wn.2d at 589–90. Former Employee Providers (Including C-Suite Officers & Owners): Governed strictly by Newman and Snyder. The moment a provider separates from employment, it instantly extinguishes corporate attorney-client privilege over ongoing trial preparation. Because former employees no longer owe agency duties, defense counsel cannot conduct ex parte interviews with former staff regarding patient care under any circumstances. Snyder v. Virginia Mason Med. Ctr., slip op. at 28–29. Quality Improvement (QI) Committee Members: Subject to statutory peer-review immunity under Wash. Rev. Code § 70.41.200(3). While records prepared for QI committees are immune from discovery, committee members must be strictly screened from litigation defense teams. If a QI member participates in active trial strategy or ex parte witness preparation, statutory peer-review privilege is completely forfeited. Snyder, slip op. at 38–39. The Snyder Decision: Presumed Harm, Privilege Logs, and QI Waiver In Snyder v. Virginia Mason Medical Center, No. 104136-5, slip op. (Wash. Oct. 1, 2026) (En Banc), the Washington Supreme Court resolved lingering uncertainties by establishing three definitive holdings that fundamentally reshape medical malpractice litigation. 1. Rejection of Defense Exceptions and Affirmance of Loudon The Supreme Court affirmed that Loudon applies strictly to former employee health care providers, regardless of whether their care forms the primary basis of the hospital's alleged vicarious liability. In doing so, the Court explicitly rejected a series of defense theories: Representation Agreements & Indemnity Contracts: Private employment contracts requiring former doctors to cooperate in litigation defense cannot override statutory patient privacy rights under Wash. Rev. Code § 70.02.020 or physician-patient privilege under Wash. Rev. Code § 5.60.060(4). Hermanson, 196 Wn.2d at 590 n.1; Snyder, slip op. at 25–26. Common Interest / Joint Defense Theories: Shared legal exposure does not authorize defense counsel to conduct ex parte trial strategy sessions with former employee providers or their separate attorneys. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Inapplicability of Youngs: The Court confirmed that the fiduciary doctor-patient relationship survives employment termination, placing former employee providers strictly beyond the reach of the Youngs current-employee exception. Snyder, slip op. at 28–29. 2. Magaña and the Presumption of Prejudice Crucially, the Supreme Court disavowed its prior decision in Magaña v. Hyundai Motor America, 167 Wn.2d 570, 220 P.3d 191 (2009), which required plaintiffs to prove substantial litigation prejudice to obtain discovery sanctions. Holding that ex parte contacts inherently damage the fiduciary doctor-patient relationship, the Court established that prejudice is presumed upon demonstrating a Loudon violation. Snyder, slip op. at 33–34. To evaluate appropriate sanctions—ranging from monetary fines to entering a default judgment on liability—the Supreme Court extended Cedell v. Farmers Insurance Co. of Washington, 176 Wn.2d 686, 295 P.3d 239 (2013), ordering the trial court to conduct an in-camera inspection of all withheld defense privilege log entries generated during unauthorized ex parte contacts. Snyder, slip op. at 35–36. 3. Subject-Matter Waiver of Quality Improvement Immunity Under Wash. Rev. Code § 70.41.200(3), hospital Quality Improvement committee proceedings are confidential. However, in Snyder, the Chief Medical Officer sat on the hospital’s statutory QI committee while simultaneously receiving litigation talking points from defense counsel, coordinating witness outreach, and traveling ex parte to meet with a former resident physician. The Supreme Court held that failing to ethically screen a QI committee member from active litigation strategy taints the committee's inner workings, effecting a complete subject-matter waiver of statutory peer-review privilege. Snyder, slip op. at 38–39. Real-World Realities: Memory Decay, Pre-Litigation Holds, and Sophistication At the end of the day, modern institutional health care delivery renders determining the exact composition of a patient's treatment team—and whether defense counsel is legally permitted to speak with any given provider—an exercise in pure guesswork. It has long been complicated for patients and health systems to figure out who their doctor is in a complex clinical environment involving rotating resident physicians, attending specialists, hospitalists, and independent contractors. Yet, now no one seems to know who the doctor might not be and whether defense counsel should be speaking to them behind closed doors. By establishing an unyielding temporal boundary that severs corporate attorney-client privilege the exact moment an employee separates from service, Newman, 186 Wn.2d at 781, and Snyder, slip op. at 20, 28–29, creates an unworkable practical fiction. In effect, this rigid rule generates an absurd practical presumption: that no health care practitioner can ever retire, relocate, or transition employment if any remote possibility of future litigation may ensue. This jurisprudence fundamentally neglects two operational realities of medical malpractice defense: the necessity of pre-litigation risk investigations and the natural fading of human memory. When an adverse clinical outcome occurs, risk management must investigate immediately to evaluate institutional exposure. While an institution can readily issue electronic litigation holds to preserve health records, paper charts, and audit trails, it is impossible to ask a human witness to hold onto their unrefreshed memories. While interviewing a witness when a facility first learns of a potential claim is straightforward, months or even years frequently elapse between the medical event, the formal filing of a lawsuit, and the procedural opportunity for defense counsel to deploy formal discovery rules under Wash. Super. Ct. Civ. R. 30 or CR 31. Expecting a treating physician to maintain vivid, detailed recollections of a single procedure performed years earlier—without the benefit of informal factual debriefs with risk management—defies human memory and litigation reality. Finally, this line of authority improperly presumes a uniform, strict sophistication across all health care facilities. Snyder presumes that every community hospital, rural health clinic, and small practice group maintains the extensive legal infrastructure, ethical screening walls, and specialized claims teams of a major academic medical center. By imposing strict liability sanctions and an automatic presumption of prejudice for ex parte contacts regardless of actual litigation harm (Snyder, slip op. at 33–34), the Court penalizes health care entities for standard risk management inquiries while ignoring the operational realities of modern medical practice. Specific Application Cases: C-Suite, Mid-Suit Separation, and Dual Roles A. Former C-Suite Executives, Board Members, and Physician-Owners A frequent point of defense confusion is whether a physician’s former status as a C-suite executive (e.g., Chief Medical Officer), board member, or equity owner exempts them from Loudon. Under Washington law, the extent of corporate privilege coverage depends entirely upon temporal status and the subject matter of the communication. This includes: Pre-Separation Corporate Governance Communications (COVERED): Confidential communications made during active executive, board, or ownership tenure regarding hospital administration, risk management, or general business operations remain protected by the entity's attorney-client privilege under Upjohn Co. v. United States, 449 U.S. 383, 391 (1981) and Wash. Rev. Code § 5.60.060(2)(a). Post-Separation Patient Care Communications (NOT COVERED): Once employment, board tenure, or equity ownership severs, corporate attorney-client privilege terminates. Newman, 186 Wn.2d at 781. Reaffirming Newman, the Supreme Court in Snyder, slip op. at 20, 28–29 held that former executive or ownership status creates no exception to Loudon. Because former C-suite physicians and owners no longer possess agency authority or ongoing duties of loyalty to the entity, defense counsel cannot engage in post-separation ex parte trial preparation regarding patient care provided by that physician. B. Mid-Litigation Employment Termination If a treating physician’s employment terminates during active medical malpractice litigation, corporate attorney-client privilege over ongoing trial preparation instantly evaporates at the moment of separation. Under Newman and Snyder, corporate defense counsel is strictly barred from conducting further ex parte strategy sessions with the departing physician, practically necessitating separate independent counsel for the physician to prevent per se Loudon violations and concurrent conflicts under Rule of Professional Conduct 1.7. C. Dual-Roled Physicians and Corporate PMK Designees Quality Improvement (QI) committee members represent one of the most perilous legal landmines for health care facilities under Snyder, slip op. at 38–39. Health care facilities face an inherent dilemma: the individuals best situated to serve as key corporate contacts or Person Most Knowledgeable (PMK) designees under Wash. Super. Ct. Civ. R. 30(b)(6)—such as CMOs or Medical Directors—are almost universally the exact same clinical leaders who sit on statutory QI committees. When a lawsuit emerges, institutions routinely rely on senior officers to investigate the incident and coordinate witness outreach. However, under Snyder, combining statutory peer-review functions with litigation defense strategy destroys the statutory privilege protecting the facility's Quality Improvement proceedings. To protect peer-review immunity, institutions ought to consider implementing proactive, pre-litigation organizational role separation: structurally dividing clinical governance so that high-level physicians on QI committees are permanently barred from acting as litigation claims liaisons or CR 30(b)(6) designees. Practical Compliance  To navigate the strict mandates of Snyder and protect case integrity, corporate defense counsel and health care risk managers must adopt three mandatory practice protocols: Conduct Factual Discovery Exclusively Through Formal Court Rules. Defense counsel must refrain from informal telephone calls, debriefs, or “support visits” with former employee providers. All factual inquiries must occur through formal oral depositions under Wash. Super. Ct. Civ. R. 30 or written depositions under Wash. Super. Ct. Civ. R. 31 upon formal notice to plaintiff's counsel. Strictly Prohibit Using Separate Counsel as a Conduit. If an insurer assigns separate independent counsel to represent a former employee provider under continuing indemnification duties, primary corporate counsel cannot pass trial briefs, expert reports, or strategy talking points ex parte to separate counsel. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Establish Proactive Pre-Litigation QI Ethical Walls. Health care facilities must structurally divide clinical governance so that high-level physicians who serve on statutory Quality Improvement peer-review committees are permanently barred from acting as corporate claims liaisons, risk defense managers, or corporate Person Most Knowledgeable (PMK) designees under CR 30(b)(6). Proactive ethical screening is essential to prevent subject-matter waiver of statutory peer-review immunity under Wash. Rev. Code § 70.41.200.

AI State Laws Now Top 150 Around the Country New York – October 19, 2026 – National law firm Wilson Elser, in partnership with Ankura Consulting Group, LLC and Privado AI, recently held an inaugural conference on privacy, security, and AI governance. The program focused on evolving privacy laws and security best practices, with artificial intelligence front and center as organizations navigate a growing patchwork of state AI laws. “Convergence: The Intersection of Privacy, Security & AI Governance” was held September 30 at Wilson Elser’s New York offices, featuring speakers from Wilson Elser, Ankura, Privado AI, and several insurance carriers. JD Cheema, Founder of Privado AI, delivered a keynote on technology-enabled data discovery and AI governance.  “Privacy, security, and AI governance are no longer separate conversations. Agentic AI, tightening regulation, and a more active enforcement environment have brought them into the same room,” said Jana Farmer, partner and cochair of Wilson Elser’s Data Use & AI Governance Practice. “At the moment, there is no comprehensive federal standard governing AI use in the United States.”  “Instead, we’re seeing a rapidly growing patchwork of state laws and regulations,” said Farmer, noting that states including New York, California, Utah, Texas, and Colorado have passed more than 150 AI-related laws in the last year alone. “Given this landscape, businesses should plan for the possibility that some of the use cases of AI technology could become restricted after deployment, so that their AI investments hold up as the rules develop.”  The program paired practitioner-level content with built-in opportunities to connect. Convergence was attended by general counsel, privacy and security leaders, cybersecurity and risk professionals, the insurance and carrier community, and outside advisors who serve them. Conference panels included: Navigating the Privacy and AI Landscape: From New Laws to the Courtroom Panelists: Jana Slavina Farmer, AIGP, Wilson Elser; Nicole Nguyen, Senior Director, Privacy Engineering and Technology Practice, Ankura; JD Cheema, Privado; and Christina Van Wert, Senior Manager, Cyber & Professional Lines Group, Tokio Marine HCC.  Topic: Privacy and AI regulation continues to develop on several fronts, and organizations are fielding attention from legislators, regulators, and plaintiffs alike. Through an interactive session, panelists traced the newest privacy and AI legislation, current enforcement priorities, and litigation trends, giving attendees a practical compliance walkthrough they can put to immediate use. Cybersecurity and AI: Governing Agentic Systems Panelists: Dominik Cvitanovic, Wilson Elser; John Schrader, Senior Managing Director, Cyber, Privacy & AI Security Practice, Ankura; Craig Linton, Head of U.S. Underwriting Management for Cyber Risks, Beazley; and Bridget Choi, Cyber Insurance Product Lead, Gallagher. Topic: Agentic AI is reshaping how organizations operate, creating a new class of cybersecurity, contractual, and operational risk. Insurers and insureds alike are asking questions that cut across every industry deploying these systems. Using scenarios drawn from real-world deployments and cyber events, panelists gave attendees practical guidance on governing agentic AI before, during, and after an incident. Cybersecurity Pitfalls and Avoiding the Wrath of Regulators Panelists: Anjali Das, Wilson Elser; Nicole Nguyen, Senior Director, Privacy Engineering and Technology Practice, Ankura; John Schrader, Senior Managing Director, Cyber, Privacy & AI Security Practice, Ankura; and Cody Valdez (former Deputy AG, New Jersey Attorney General’s Office), now an attorney at Wilson Elser. Topic: When a cybersecurity incident hits, regulators are rarely far behind, and they increasingly arrive from several directions at once. A single event can draw parallel scrutiny from the SEC, state financial regulators, health privacy enforcers, and state attorneys general, each with its own rules, deadlines, and enforcement posture. Drawing on recent investigations and enforcement actions, this panel mapped where organizations most often stumble and gave attendees a practical playbook for staying on the right side of the agencies that matter. Implementing AI Across the Business: A Practical Guide to the Risks Panelists: Jana Slavina Farmer, AIGP, Wilson Elser; Jonathan Meer, Wilson Elser; Scott Margolis, Managing Director, Data and Information Governance Practice, Ankura; Matthew McQueeny, AAANow.ai and Earnfluencing; and Rahmila Nadi, Women Leading AI Topic: AI is changing how organizations operate, and the legal and operational risks reach well beyond any single department. No one-size-fits-all approach exists, but common themes cut across every business weighing how to adopt AI responsibly. Through scenarios drawn from situations businesses are navigating right now, panelists gave attendees practical, actionable guidance on the legal and business ramifications of putting AI to work. About Wilson Elser’s Data Use & AI Governance Practice  Wilson Elser is a trusted privacy, security, and AI governance firm in the United States and the preeminent defense litigation firm in the privacy and cyber class action space. For more information about the practice, go to: https://www.wilsonelser.com/data-use-ai-governance About Wilson Elser Wilson Elser is the preeminent defense litigation firm in the United States. Over more than four decades, our litigation and trial lawyers have gained a reputation for taking on and prevailing in the most challenging and technical cases, frequently “parachuting in” to assume unresolved matters from other law firms. Our success also derives from winning on our clients’ terms and rigorously adhering to their guidelines. We are ranked 94 in the Am Law 100 and 30 in the National Law Journal’s NLJ 500. For more information, go to www.wilsonelser.com About Ankura, LLC  Ankura is a leading global consulting and expert services advisory firm with a broad range of specialties across industries, including the cybersecurity, data privacy and governance, and artificial intelligence space. The firm combines strategic advisory with deep technical expertise, hands-on implementation, and expert support to address complex business challenges. Ankura has more than 35 locations and supports projects in more than 115 countries. For more information, go to https://ankura.com/ About Privado AI   Privado AI is an agentic data privacy management platform that helps privacy and compliance teams automate manual governance workflows, map data flows, and detect consent-compliance violations at scale. Founded in 2020, the company leverages specialized AI agents to replace traditional, slow, questionnaire-based compliance methods. For more information, go to https://www.privado.ai/

Q: Are employees entitled by law to access their personnel files?   A: There is no federal law that gives private-sector employees the right to view their personnel files. Access is regulated entirely by state-specific laws. There are currently 19 states that legally require employers to permit employees (and sometimes former employees) to view and/or obtain a copy of their personnel file. As of November 8, 2026, that number will increase to 20, when New York’s recently enacted Personnel Records Access Law goes into effect. The majority of states have no law requiring access to personnel files and there is no federal law that confers on current or former employees a statutory right to access their personnel files.  As of October of 2026, the following states provide right of access to current employees: Alaska, California, Colorado, Connecticut, Delaware, Illinois, Iowa, Maine, Massachusetts, Michigan, Minnesota, Nevada, New Hampshire, Oregon, Pennsylvania, Rhode Island, Virgina, Washington, and Wisconsin.  Some states, including New York (as of November 8, 2026), also allow former employees to view their personnel files. Each state has its own caveats to access. For example, Washington allows for a former employee to retain the right of rebuttal or correction for up to two years following their separation from employment.  New York’s new law, Senate Bill 2025-S3460, was signed by Governor Kathy Hochul on September 9, 2026, adding Section 210-b to the New York Labor Law. The law covers public and private sector employers, including individuals, corporations, partnerships, labor organizations, unincorporated associations, other legal businesses and employer agents.  Employers operating in New York should familiarize themselves with the requirements of Section 210-b now, before it goes into effect, and update their document-management and onboarding practices accordingly, as non-compliance may expose them to claims under the New York Labor Law.  What Will New York Law Require? The law in New York will require employers to provide current and former employees with a copy of their personnel records within five (5) business days of a written request, up to twice per calendar year, at no cost to the employee. Employers also must notify employees within ten business (10) days after placing information in a personnel record that is, has been, or may be used to negatively affect the employee’s qualifications for employment, promotion, transfer, additional compensation, or the possibility of disciplinary action. If there is a disagreement with any information within the personnel record, removal or correction of the information may be mutually agreed upon by the employer and the employee. If the employee doesn’t agree with the information the employer places in the file, the employee can submit a written statement explaining the employee’s position, which must become a part of the employee’s personnel record and must accompany the disputed information when it is transmitted to a third party, so long as the original information remains in the file. Employers are not required to permit an employee to review their personnel record more than twice per calendar year, but a notification and review resulting from the placement of negative information in the record does not count toward that limit. Under the new law, to the extent employers create personnel records, without deletions or expungement of information, they are required to maintain them from the date of employment through three years after termination of the employee’s employment. What Types of Documents Are Covered Under New York’s Personnel Records Law? The New York law expressly defines “personnel records” to include the following written information and documents prepared by an employer regarding an employee, for inclusion in the employee’s personnel record: Name, address, date of birth, job title and description  Rate of pay and any other compensation paid to the employee Starting date of employment  The job application of the employee  Resumes or other forms of employment inquiry submitted by the employee to the employer in response to the employer's advertisement  All employee performance evaluations, including but not limited to employee evaluation documents  Written warnings of substandard performance  Lists of probationary periods  Waivers signed by the employee Copies of dated termination notices  Any documents relating to disciplinary action regarding the employee The law applies broadly and is not limited to the above-listed documentation. Examples of documents also likely covered include: 1. Employment agreements and offer letters signed at the start of the employment relationship 2. Handbook and policy acknowledgment forms, such as sign-offs on anti-harassment policies, code of conduct agreements, or confidentiality acknowledgments 3. Performance improvement plans that the employee is asked to sign to confirm receipt 4. Separation-related documents, such as resignation acknowledgments or exit interview forms, to the extent they are placed in the personnel file Note that the law expressly excludes, “information of a personal nature about a person other than the employee if disclosure of the information would constitute a clearly unwarranted invasion of such other person’s privacy.” The law prohibits employers and other persons from discharging, threatening, penalizing, discriminating, or retaliating against employees who exercise their statutory rights.  Practical Tips for New York Employers New York employers should keep several practical points in mind as they prepare to comply with Section 210-b of the Labor Law: 1. Review current practices and protocols. Before November 8, 2026, New York employers should review their personnel record practices and retention procedures. Employers should establish a protocol for tracking and responding to an employee’s request for the employee’s personnel file. Determine whether your organization already provides employees with copies of all signed personnel documents. Employers also should evaluate whether covered personnel records maintained by third-party providers can be produced within five business days.  2. Update onboarding and HR workflows. Ensure that standard operating procedures require HR personnel and managers to provide a copy of every signed document to the employee at the time of signing. Consider building this step into electronic onboarding platforms and document management systems so that copy delivery is automatic rather than dependent on individual compliance to ensure timely compliance with the notification requirements. 3. Leverage electronic signature and document management tools. Employers using e-signature platforms can configure them to send a completed copy of each signed document to the employee automatically, which streamlines compliance and creates a reliable audit trail. 4. Train HR staff and supervisors. Managers and HR professionals who handle personnel paperwork should be informed of the new requirement and understand that every signed document placed in a personnel file must be accompanied by delivery of a copy to the employee. Employers should train HR personnel and managers on the law’s access, notice, retention, and anti-retaliation requirements. 5. Document delivery of copies. Maintain a record confirming that each signed document was provided to the employee. Whether through an electronic system's automatic confirmation, an email transmittal, or a signed acknowledgment of receipt, this documentation can be important if compliance is later questioned. What Are the Risks of Non-Compliance? For companies that violate the law, New York’s Attorney General would be empowered to seek penalties ranging from $500 to $2,500 per violation, and workers who face discrimination or retaliation for asserting their rights would have a private right of action. Broader Considerations New York's enactment of Section 210-b is part of a broader trend of states strengthening employee access to workplace records. For instance, California employers must allow current and former employees to inspect and receive copies of personnel records relating to the employee’s performance or any grievance concerning the employee. In addition, California employers must also provide education and training records upon the employee’s authorized request within a 30-day window. In contrast, employers in the state of Texas are not required to turn over personnel files to current or former employees. Employers operating in multiple jurisdictions should be aware that personnel-file access laws vary significantly from state to state. 

Peter Espey (Of Counsel-Madison, NJ) was quoted in the article “Economic Pressures, Younger Juries Mean NJ Awards Remain Elevated, Lawyers Say,” appearing in the October 22, 2026, edition of Law.com’s New Jersey Law Journal. Peter, who focuses his practice on Medical Malpractice, in addition to other areas, was interviewed along with another defense attorney and two plaintiffs’ attorneys about the increase in jury verdicts and settlements in New Jersey in 2026. The total amount from the top twenty personal injury awards in New Jersey increased by $82 million from 2025 to 2026.  Peter identifies possible reasons, including generational changes among potential jurors, explaining, “Some of the older potential jurors are aging out and less likely to serve, so it’s a new group of people that are the potential jurors. They might see things differently than their parents or grandparents.” Peter also cites inflation, economic strain, and lingering repercussions from the COVID pandemic as fueling litigation and larger settlements, noting that some plaintiffs' attorneys may also be becoming more selective, taking only higher-value cases.  He discussed other potential causes. 

Thomas Comer (Partner, New York), Thomas O’Connor (Associate, White Plains), and Judy Selmeci (Partner, New York), obtained a complete defense verdict on behalf of the client in Supreme Court, Nassau County before the Hon. Catherine Rizzo. The jury unanimously found that the client bore no liability in connection with plaintiff’s claimed Labor Law accident. Plaintiff, a 24-year-old demolition laborer at the time of the alleged incident, claimed that he sustained injuries as a result of a fall from a scaffold while performing interior demolition work. He alleged significant orthopedic injuries, including to his knee, spine, and shoulder, and underwent multiple surgical procedures, including a two-level lumbar laminectomy, a single-level cervical fusion, and a left shoulder arthroscopy. He further claimed total disability, with over $1,000,000 in alleged future lost wages. Plaintiff’s theory as to the client was not based on any actual involvement in the work, but on an effort to characterize the client as a “contractor” or statutory agent based largely on a permit issued in its name. The defense focused on a clear and targeted strategy: establishing that the client had no authority to direct, supervise, or control the injury-producing work. The evidence showed that the client did not perform work at the site, did not retain plaintiff or any subcontractors, did not receive payment, and had no role in how the work was carried out. Instead, the work was performed independently by others, without the client’s knowledge or involvement. During the charge conference, the team secured modified jury instructions to both PJI 2:216 and 2:217. Over opposition, the Court agreed to instruct the jury that it must first determine whether the client had the authority to supervise, direct, or control the work before considering any potential Labor Law liability. That framework was reinforced in the verdict sheet, which required the jury to address this threshold issue at the outset. At trial, the defense also highlighted significant credibility issues in plaintiff’s account, including his admission that he told medical providers he was injured in a bicycle accident. Through cross-examination and the testimony of a neutral medical witness, the defense established that plaintiff offered multiple, inconsistent explanations for this discrepancy. Following nearly four hours of deliberations, the jury returned a unanimous defense verdict, with the jury assigning 0% liability to the client.

Jennifer Martin (Partner-Dallas, TX) and Graham R. Pulvere (Partner -Birmingham, AL) will present the Wilson Elser Forum webinar “Drawing the Line: Aligning Scope-of-Loss Disputes Right from the Start” on October 27, 2026. When an insurer and an insured disagree on what's covered damage and what isn't, the claim process can quickly become contentious. This session offers claims professionals practical guidance for managing scope-of-loss disputes from day one. The presenters cover how to timely retain the right experts, ensure their assessments align with policy terms and definitions, critically evaluate competing reports, and build a well-supported claim file that can withstand scrutiny, including in appraisal.

Keti Mebuke Wade (Associate-Chicago, IL) will present “Defending Policy Limit Cases and Bad Faith Claims” at the Fall Meeting of the Joint Claims Executives Associations (JCEA). The 2026 meeting, Preparing Today's Leaders for Tomorrow's Claims Environment, will be held in Nashville, Tennessee, October 25 ‒ 27. With policy-limit demands and bad faith allegations remaining among the highest-risk exposures facing insurers, Keti’s session offers a practical framework for claims leaders to evaluate policy-limit exposure cases, coordinate investigation and documentation efforts, and respond strategically to time-limited demands in ways that strengthen settlement positioning while reducing bad-faith risk.  

Washington, D.C. partners Ryan Duffy and Kathleen Warin secured two significant victories in the U.S. District Court for the District of Columbia on behalf of the Financial Industry Regulatory Authority (FINRA). In two separate cases, former securities brokers sought to expunge customer dispute information from their registration records maintained by FINRA in the Central Registration Depository (CRD) system, which is publicly available through BrokerCheck as required under the Securities Exchange Act of 1934. The plaintiffs each asserted claims for equitable expungement, declaratory judgment, and a permanent injunction. In both cases, the Wilson Elser team successfully argued that the plaintiffs failed to identify any cognizable cause of action against FINRA that would entitle them to expungement relief. Ryan and Kathleen demonstrated that neither the Exchange Act nor FINRA Rules create a private right of action against FINRA for expungement of customer dispute information from the CRD, and that the plaintiffs' claims for equitable relief, declaratory judgment, and a permanent injunction were remedies rather than cognizable causes of action. Both courts agreed in full, granting FINRA's motions to dismiss with prejudice. They held that the Exchange Act's comprehensive regulatory scheme does not authorize private suits against FINRA for actions taken pursuant to its statutory obligations, and that federal courts have overwhelmingly declined to recognize any such private right of action. The courts also rejected the plaintiffs’ arguments that their inherent equitable powers could supply the missing cause of action, reaffirming the well-established principle that equitable expungement, declaratory relief, and injunctive relief are forms of remedy ‒ not independent sources of legal entitlement. Together, these decisions provide critical legal authority and reinforce that brokers have no private right of action against FINRA for expungement of customer dispute information maintained pursuant to its statutory obligations. 

Jonathan Meer (Partner-New York, NY) will present on the panel "D&O Liability Insurance ‒ What's Changing and Why It Matters" at the Anderson Kill 30th Annual Policyholder Conference on October 28, 2026, held in Manhattan, New York. Jonathan’s panel will provide the insurer side of coverage disputes in light of current developments. His panel will examine the evolving D&O liability landscape and the emerging risks that are reshaping coverage for corporate directors and officers, using hypothetical situations and examples of recent trends. Panelists will also discuss developments in securities litigation, regulatory enforcement, emerging technologies, and other exposures that may impact D&O programs, as well as address changing policy terms, insurer positions, and strategies policyholders can use to protect and maximize their D&O coverage.

On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923 (Chapter 482, Statutes of 2026), known as the Expanding Privacy Rights Act. The law amends two provisions of the California Consumer Privacy Act (CCPA): (1) the right to delete (Civil Code § 1798.105); and (2) the methods for submitting consumer requests (Civil Code § 1798.130). The legislation was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency (also known as CalPrivacy). This amendment takes effect January 1, 2027. A deletion request will now reach personal information that a business bought or received from others, not only what the consumer provided. Online-only businesses must also offer a web form or portal for privacy requests. For most companies, this is an operational change rather than a new program, but it reaches data stores that many request workflows never touch. Reasons Behind the Amendment Under the prior CCPA text, consumers could request deletion only of information a business collected “from the consumer.” The California Legislature found that the existing right “allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties. This creates a gap in protection.” S.B. 923, 2025–2026 Leg., Reg. Sess. § 1(b) (Cal. 2026) (enacted as 2026 Cal. Stat. ch. 482). CalPrivacy, the legislation’s sponsor, noted that “businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete.” CalPrivacy, California Expands Privacy Protections by Strengthening Deletion Rights (Sept. 27, 2026). With respect to the means for the submission of the requests, the current CCPA regulations require a webform only from businesses that are not exclusively online, and only if they have a website. See 11 CCR § 7020(b) (requests "shall be through its website, such as through a webform."). Online-only businesses with a direct consumer relationship still need only an email address under § 7020(a). As Senator Becker, the author of this bill, explained in his statement, “while most businesses must provide two or more methods to submit privacy requests, online-only businesses that have a direct relationship with the consumer are only required to provide an email address for consumers to submit most privacy requests under the CCPA. This single-method requirement for certain businesses creates barriers for consumers because it offers minimal support or guidance.” Assemb. Comm. on Privacy & Consumer Prot., Analysis of S.B. 923, 2025–2026 Leg., Reg. Sess., at 5 (Cal. June 23, 2026) (as amended June 11, 2026) (quoting author's statement). CalPrivacy, which sponsored the bill, says it aligns California with deletion rights in Delaware, Indiana, Maryland, and New Jersey, and stresses that the CCPA’s existing exemptions, including fraud prevention and legal compliance, remain available. What the Statute Now Says Broader Deletion Right Amended Section 1798.105(a) provides: “A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.” Suppression Records for Third-Party Data For data obtained from other sources, the law gives businesses a defined way to comply: “A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal information remains deleted from the business’s records and is not being used for any other purpose.” Expanded Downstream Obligations The existing duties still apply: the business must “notify any service providers or contractors to delete the consumer’s personal information from their records and notify all third parties to whom the business has sold or shared the personal information,” unless “this proves impossible or involves disproportionate effort.” Service providers and contractors “shall cooperate with the business in responding to a verifiable consumer request.” Because the deletion right is broader, these flow-down duties now reach a larger set of records. Preserved Exceptions  Businesses may still retain information when reasonably necessary to, among other things, “[h]elp to ensure security and integrity” or “[c]omply with a legal obligation.” New Online Request Requirement Amended Section 1798.130(a)(1)(A) provides that a business that “operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address and make an online method, such as a web form or online portal, available” for requests to know, delete, or correct. An email inbox alone will no longer suffice. What Is Required, From Whom, and When Beginning January 1, 2027, every business subject to the CCPA must honor deletion requests for personal information it holds about a consumer, whether it collected that data from the consumer or got it from a broker, vendor, or other third party. For data collected from other sources, a business complies with the new requirements by keeping a record of the request and only the minimum data needed to make sure the consumer's information stays deleted. Service providers and contractors must assist the business in their responses to the consumer rights requests. At the business's direction, they must delete the data and notify their own downstream service providers and contractors to do the same.  Starting from January 1, 2027, a business that operates exclusively online and has a direct relationship with consumers must now offer an online method, such as a web form or portal, in addition to an email address, for submission of consumer requests. Businesses with brick-and-mortar presence keep their current obligation to offer at least two methods for consumer requests, including a toll-free telephone number. Practical Steps to Take Before January 1, 2027 Compliance with contemporary data privacy laws must involve technical solutions along with legal and compliance ones. Online-only businesses seeking to implement the webform or portal for the first time must be mindful of the privacy laws-related requirements, including the need for verification, the regulatory response timelines, and the recordkeeping requirements related to the fulfilled requests. All businesses subject to CCPA should also take the time to map where personal information sourced from third parties resides in their systems, extend deletion workflows to those systems, and build or check their suppression records workflow. This is also a good time to review the mandatory service provider and contractor agreements to confirm compliance with California’s requirements, including support for deletion rights cooperation and flow-down provisions.  Wilson Elser’s Data Use and AI Governance team can help businesses assess how SB 923 affects their deletion workflows, third-party data sources, vendor agreements, and consumer request intake, and can advise on CCPA compliance and other privacy law questions as they arise.

In Snyder v. Virginia Mason Medical Center, No. 104136-5 (Wash. Oct. 1, 2026), the Washington Supreme Court held that corporate defense counsel, risk managers, and claims adjusters may not communicate ex parte with a hospital’s former employee health care providers about patient care. The Court reaffirmed Loudon v. Mhyre, 110 Wn.2d 675, 756 P.2d 138 (1988) prohibiting ex parte communication by defense counsel with a plaintiff’s treating physicians, held that prejudice is presumed when Loudon is violated, and ruled that a quality improvement (QI) committee member’s involvement in defense strategy waives the committee’s statutory privilege under Wash. Rev. Code § 70.41.200. As a result, informal contact with former employee providers should stop, and factual inquiries should proceed through formal discovery under Wash. Super. Ct. Civ. R. 30 or 31. This article explains how Snyder fits within Washington’s patient confidentiality and corporate privilege framework, how it applies to different categories of providers, and what hospitals and their counsel should do now. Patient Confidentiality vs. Corporate Privilege To navigate the procedural boundaries governing medical malpractice defense in Washington, practitioners must understand the fundamental statutory tension between a patient’s right to health care confidentiality and an institution's right to confer with corporate counsel. Under Washington's Uniform Health Care Information Act, health care providers and their agents are strictly prohibited from disclosing health information without explicit written authorization, except as otherwise provided by law. Wash. Rev. Code § 70.02.020; State v. Scherf, 192 Wn.2d 350, 387, 431 P.3d 976, 995 (2018); King v. Riveland, 125 Wn.2d 500, 509, 886 P.2d 160, 165 (1994). This privacy right is reinforced by Washington's statutory physician-patient privilege, which protects treating physicians from being compelled to testify regarding medical information acquired while attending a patient. Wash. Rev. Code § 5.60.060(4). While a patient automatically waives this statutory privilege upon filing a personal injury or medical malpractice lawsuit under Wash. Rev. Code § 5.60.060(4)(b), the Washington Supreme Court has consistently held that this waiver is not absolute. In Loudon v. Mhyre, 110 Wn.2d 675, 678, 756 P.2d 138, 140 (1988), the Court established a bright-line prohibition against defense counsel engaging in private, ex parte communications with a plaintiff’s treating physicians. The Loudon rule safeguards the fiduciary doctor-patient relationship, prevents inadvertent disclosure of irrelevant medical records, and eliminates the risk of turning defense attorneys into potential trial witnesses. Loudon, 110 Wn.2d at 682, 756 P.2d at 142; Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d 659, 666, 244 P.3d 939, 942–43 (2010). On the corporate side, health care facilities rely on corporate attorney-client privilege to conduct internal risk investigations. Wash. Rev. Code § 5.60.060(2)(a); Upjohn Co. v. United States, 449 U.S. 383, 389, 101 S. Ct. 677, 682, 66 L. Ed. 2d 584 (1981). However, in Newman v. Highland School District No. 203, 186 Wn.2d 769, 381 P.3d 1188 (2016), the Washington Supreme Court established a strict temporal boundary on corporate privilege, holding that privilege does not extend to post-employment communications with former employees: “The underlying purpose of the corporate attorney-client privilege is to foster full and frank communications between counsel and the client (i.e., the corporation), not its former employees... This purpose is preserved by limiting the scope of the privilege to the duration of the employer-employee relationship.” Newman, 186 Wn.2d at 781, 381 P.3d at 1193 (quoting Restatement (Third) of the Law Governing Lawyers § 73 cmt. e (Am. L. Inst. 2000)). Evolution of Provider Contact Rules: Current vs. Former Personnel How does one reconcile corporate attorney-client privilege with the Loudon doctrine? The Supreme Court addressed this conflict in Youngs v. PeaceHealth, 179 Wn.2d 645, 664, 316 P.3d 1035, 1045 (2014), carving out a narrow exception allowing corporate defense counsel to conduct confidential ex parte interviews with a nonparty treating physician who is a current employee of the hospital, provided those communications are limited strictly to the facts surrounding the alleged negligent incident. In Hermanson v. MultiCare Health System, Inc., 196 Wn.2d 578, 581, 475 P.3d 484, 487 (2020), the Court extended this principle to current non-physician staff and current independent contractors who are the functional equivalents of employees. However, when a treating provider leaves the facility's employ, the legal landscape shifts dramatically across four distinct provider categories: Current Employee Providers: Fully covered under the Youngs exception. Corporate defense counsel may conduct privileged, ex parte interviews with active employee physicians, nurses, and staff, provided the conversation is confined to the facts of the alleged negligent incident and does not delve into general medical history. Youngs v. PeaceHealth, 179 Wn.2d at 671. Current Independent Contractors: Covered under Hermanson where an agency or functional equivalent relationship exists. If an independent contractor doctor acts as an agent of the facility, corporate counsel may confer ex parte under the same strict factual constraints of Youngs. Hermanson v. MultiCare Health Sys., Inc., 196 Wn.2d at 589–90. Former Employee Providers (Including C-Suite Officers & Owners): Governed strictly by Newman and Snyder. The moment a provider separates from employment, it instantly extinguishes corporate attorney-client privilege over ongoing trial preparation. Because former employees no longer owe agency duties, defense counsel cannot conduct ex parte interviews with former staff regarding patient care under any circumstances. Snyder v. Virginia Mason Med. Ctr., slip op. at 28–29. Quality Improvement (QI) Committee Members: Subject to statutory peer-review immunity under Wash. Rev. Code § 70.41.200(3). While records prepared for QI committees are immune from discovery, committee members must be strictly screened from litigation defense teams. If a QI member participates in active trial strategy or ex parte witness preparation, statutory peer-review privilege is completely forfeited. Snyder, slip op. at 38–39. The Snyder Decision: Presumed Harm, Privilege Logs, and QI Waiver In Snyder v. Virginia Mason Medical Center, No. 104136-5, slip op. (Wash. Oct. 1, 2026) (En Banc), the Washington Supreme Court resolved lingering uncertainties by establishing three definitive holdings that fundamentally reshape medical malpractice litigation. 1. Rejection of Defense Exceptions and Affirmance of Loudon The Supreme Court affirmed that Loudon applies strictly to former employee health care providers, regardless of whether their care forms the primary basis of the hospital's alleged vicarious liability. In doing so, the Court explicitly rejected a series of defense theories: Representation Agreements & Indemnity Contracts: Private employment contracts requiring former doctors to cooperate in litigation defense cannot override statutory patient privacy rights under Wash. Rev. Code § 70.02.020 or physician-patient privilege under Wash. Rev. Code § 5.60.060(4). Hermanson, 196 Wn.2d at 590 n.1; Snyder, slip op. at 25–26. Common Interest / Joint Defense Theories: Shared legal exposure does not authorize defense counsel to conduct ex parte trial strategy sessions with former employee providers or their separate attorneys. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Inapplicability of Youngs: The Court confirmed that the fiduciary doctor-patient relationship survives employment termination, placing former employee providers strictly beyond the reach of the Youngs current-employee exception. Snyder, slip op. at 28–29. 2. Magaña and the Presumption of Prejudice Crucially, the Supreme Court disavowed its prior decision in Magaña v. Hyundai Motor America, 167 Wn.2d 570, 220 P.3d 191 (2009), which required plaintiffs to prove substantial litigation prejudice to obtain discovery sanctions. Holding that ex parte contacts inherently damage the fiduciary doctor-patient relationship, the Court established that prejudice is presumed upon demonstrating a Loudon violation. Snyder, slip op. at 33–34. To evaluate appropriate sanctions—ranging from monetary fines to entering a default judgment on liability—the Supreme Court extended Cedell v. Farmers Insurance Co. of Washington, 176 Wn.2d 686, 295 P.3d 239 (2013), ordering the trial court to conduct an in-camera inspection of all withheld defense privilege log entries generated during unauthorized ex parte contacts. Snyder, slip op. at 35–36. 3. Subject-Matter Waiver of Quality Improvement Immunity Under Wash. Rev. Code § 70.41.200(3), hospital Quality Improvement committee proceedings are confidential. However, in Snyder, the Chief Medical Officer sat on the hospital’s statutory QI committee while simultaneously receiving litigation talking points from defense counsel, coordinating witness outreach, and traveling ex parte to meet with a former resident physician. The Supreme Court held that failing to ethically screen a QI committee member from active litigation strategy taints the committee's inner workings, effecting a complete subject-matter waiver of statutory peer-review privilege. Snyder, slip op. at 38–39. Real-World Realities: Memory Decay, Pre-Litigation Holds, and Sophistication At the end of the day, modern institutional health care delivery renders determining the exact composition of a patient's treatment team—and whether defense counsel is legally permitted to speak with any given provider—an exercise in pure guesswork. It has long been complicated for patients and health systems to figure out who their doctor is in a complex clinical environment involving rotating resident physicians, attending specialists, hospitalists, and independent contractors. Yet, now no one seems to know who the doctor might not be and whether defense counsel should be speaking to them behind closed doors. By establishing an unyielding temporal boundary that severs corporate attorney-client privilege the exact moment an employee separates from service, Newman, 186 Wn.2d at 781, and Snyder, slip op. at 20, 28–29, creates an unworkable practical fiction. In effect, this rigid rule generates an absurd practical presumption: that no health care practitioner can ever retire, relocate, or transition employment if any remote possibility of future litigation may ensue. This jurisprudence fundamentally neglects two operational realities of medical malpractice defense: the necessity of pre-litigation risk investigations and the natural fading of human memory. When an adverse clinical outcome occurs, risk management must investigate immediately to evaluate institutional exposure. While an institution can readily issue electronic litigation holds to preserve health records, paper charts, and audit trails, it is impossible to ask a human witness to hold onto their unrefreshed memories. While interviewing a witness when a facility first learns of a potential claim is straightforward, months or even years frequently elapse between the medical event, the formal filing of a lawsuit, and the procedural opportunity for defense counsel to deploy formal discovery rules under Wash. Super. Ct. Civ. R. 30 or CR 31. Expecting a treating physician to maintain vivid, detailed recollections of a single procedure performed years earlier—without the benefit of informal factual debriefs with risk management—defies human memory and litigation reality. Finally, this line of authority improperly presumes a uniform, strict sophistication across all health care facilities. Snyder presumes that every community hospital, rural health clinic, and small practice group maintains the extensive legal infrastructure, ethical screening walls, and specialized claims teams of a major academic medical center. By imposing strict liability sanctions and an automatic presumption of prejudice for ex parte contacts regardless of actual litigation harm (Snyder, slip op. at 33–34), the Court penalizes health care entities for standard risk management inquiries while ignoring the operational realities of modern medical practice. Specific Application Cases: C-Suite, Mid-Suit Separation, and Dual Roles A. Former C-Suite Executives, Board Members, and Physician-Owners A frequent point of defense confusion is whether a physician’s former status as a C-suite executive (e.g., Chief Medical Officer), board member, or equity owner exempts them from Loudon. Under Washington law, the extent of corporate privilege coverage depends entirely upon temporal status and the subject matter of the communication. This includes: Pre-Separation Corporate Governance Communications (COVERED): Confidential communications made during active executive, board, or ownership tenure regarding hospital administration, risk management, or general business operations remain protected by the entity's attorney-client privilege under Upjohn Co. v. United States, 449 U.S. 383, 391 (1981) and Wash. Rev. Code § 5.60.060(2)(a). Post-Separation Patient Care Communications (NOT COVERED): Once employment, board tenure, or equity ownership severs, corporate attorney-client privilege terminates. Newman, 186 Wn.2d at 781. Reaffirming Newman, the Supreme Court in Snyder, slip op. at 20, 28–29 held that former executive or ownership status creates no exception to Loudon. Because former C-suite physicians and owners no longer possess agency authority or ongoing duties of loyalty to the entity, defense counsel cannot engage in post-separation ex parte trial preparation regarding patient care provided by that physician. B. Mid-Litigation Employment Termination If a treating physician’s employment terminates during active medical malpractice litigation, corporate attorney-client privilege over ongoing trial preparation instantly evaporates at the moment of separation. Under Newman and Snyder, corporate defense counsel is strictly barred from conducting further ex parte strategy sessions with the departing physician, practically necessitating separate independent counsel for the physician to prevent per se Loudon violations and concurrent conflicts under Rule of Professional Conduct 1.7. C. Dual-Roled Physicians and Corporate PMK Designees Quality Improvement (QI) committee members represent one of the most perilous legal landmines for health care facilities under Snyder, slip op. at 38–39. Health care facilities face an inherent dilemma: the individuals best situated to serve as key corporate contacts or Person Most Knowledgeable (PMK) designees under Wash. Super. Ct. Civ. R. 30(b)(6)—such as CMOs or Medical Directors—are almost universally the exact same clinical leaders who sit on statutory QI committees. When a lawsuit emerges, institutions routinely rely on senior officers to investigate the incident and coordinate witness outreach. However, under Snyder, combining statutory peer-review functions with litigation defense strategy destroys the statutory privilege protecting the facility's Quality Improvement proceedings. To protect peer-review immunity, institutions ought to consider implementing proactive, pre-litigation organizational role separation: structurally dividing clinical governance so that high-level physicians on QI committees are permanently barred from acting as litigation claims liaisons or CR 30(b)(6) designees. Practical Compliance  To navigate the strict mandates of Snyder and protect case integrity, corporate defense counsel and health care risk managers must adopt three mandatory practice protocols: Conduct Factual Discovery Exclusively Through Formal Court Rules. Defense counsel must refrain from informal telephone calls, debriefs, or “support visits” with former employee providers. All factual inquiries must occur through formal oral depositions under Wash. Super. Ct. Civ. R. 30 or written depositions under Wash. Super. Ct. Civ. R. 31 upon formal notice to plaintiff's counsel. Strictly Prohibit Using Separate Counsel as a Conduit. If an insurer assigns separate independent counsel to represent a former employee provider under continuing indemnification duties, primary corporate counsel cannot pass trial briefs, expert reports, or strategy talking points ex parte to separate counsel. Smith v. Orthopedics Int'l, Ltd., 170 Wn.2d at 668; Snyder, slip op. at 27–28. Establish Proactive Pre-Litigation QI Ethical Walls. Health care facilities must structurally divide clinical governance so that high-level physicians who serve on statutory Quality Improvement peer-review committees are permanently barred from acting as corporate claims liaisons, risk defense managers, or corporate Person Most Knowledgeable (PMK) designees under CR 30(b)(6). Proactive ethical screening is essential to prevent subject-matter waiver of statutory peer-review immunity under Wash. Rev. Code § 70.41.200.

AI State Laws Now Top 150 Around the Country New York – October 19, 2026 – National law firm Wilson Elser, in partnership with Ankura Consulting Group, LLC and Privado AI, recently held an inaugural conference on privacy, security, and AI governance. The program focused on evolving privacy laws and security best practices, with artificial intelligence front and center as organizations navigate a growing patchwork of state AI laws. “Convergence: The Intersection of Privacy, Security & AI Governance” was held September 30 at Wilson Elser’s New York offices, featuring speakers from Wilson Elser, Ankura, Privado AI, and several insurance carriers. JD Cheema, Founder of Privado AI, delivered a keynote on technology-enabled data discovery and AI governance.  “Privacy, security, and AI governance are no longer separate conversations. Agentic AI, tightening regulation, and a more active enforcement environment have brought them into the same room,” said Jana Farmer, partner and cochair of Wilson Elser’s Data Use & AI Governance Practice. “At the moment, there is no comprehensive federal standard governing AI use in the United States.”  “Instead, we’re seeing a rapidly growing patchwork of state laws and regulations,” said Farmer, noting that states including New York, California, Utah, Texas, and Colorado have passed more than 150 AI-related laws in the last year alone. “Given this landscape, businesses should plan for the possibility that some of the use cases of AI technology could become restricted after deployment, so that their AI investments hold up as the rules develop.”  The program paired practitioner-level content with built-in opportunities to connect. Convergence was attended by general counsel, privacy and security leaders, cybersecurity and risk professionals, the insurance and carrier community, and outside advisors who serve them. Conference panels included: Navigating the Privacy and AI Landscape: From New Laws to the Courtroom Panelists: Jana Slavina Farmer, AIGP, Wilson Elser; Nicole Nguyen, Senior Director, Privacy Engineering and Technology Practice, Ankura; JD Cheema, Privado; and Christina Van Wert, Senior Manager, Cyber & Professional Lines Group, Tokio Marine HCC.  Topic: Privacy and AI regulation continues to develop on several fronts, and organizations are fielding attention from legislators, regulators, and plaintiffs alike. Through an interactive session, panelists traced the newest privacy and AI legislation, current enforcement priorities, and litigation trends, giving attendees a practical compliance walkthrough they can put to immediate use. Cybersecurity and AI: Governing Agentic Systems Panelists: Dominik Cvitanovic, Wilson Elser; John Schrader, Senior Managing Director, Cyber, Privacy & AI Security Practice, Ankura; Craig Linton, Head of U.S. Underwriting Management for Cyber Risks, Beazley; and Bridget Choi, Cyber Insurance Product Lead, Gallagher. Topic: Agentic AI is reshaping how organizations operate, creating a new class of cybersecurity, contractual, and operational risk. Insurers and insureds alike are asking questions that cut across every industry deploying these systems. Using scenarios drawn from real-world deployments and cyber events, panelists gave attendees practical guidance on governing agentic AI before, during, and after an incident. Cybersecurity Pitfalls and Avoiding the Wrath of Regulators Panelists: Anjali Das, Wilson Elser; Nicole Nguyen, Senior Director, Privacy Engineering and Technology Practice, Ankura; John Schrader, Senior Managing Director, Cyber, Privacy & AI Security Practice, Ankura; and Cody Valdez (former Deputy AG, New Jersey Attorney General’s Office), now an attorney at Wilson Elser. Topic: When a cybersecurity incident hits, regulators are rarely far behind, and they increasingly arrive from several directions at once. A single event can draw parallel scrutiny from the SEC, state financial regulators, health privacy enforcers, and state attorneys general, each with its own rules, deadlines, and enforcement posture. Drawing on recent investigations and enforcement actions, this panel mapped where organizations most often stumble and gave attendees a practical playbook for staying on the right side of the agencies that matter. Implementing AI Across the Business: A Practical Guide to the Risks Panelists: Jana Slavina Farmer, AIGP, Wilson Elser; Jonathan Meer, Wilson Elser; Scott Margolis, Managing Director, Data and Information Governance Practice, Ankura; Matthew McQueeny, AAANow.ai and Earnfluencing; and Rahmila Nadi, Women Leading AI Topic: AI is changing how organizations operate, and the legal and operational risks reach well beyond any single department. No one-size-fits-all approach exists, but common themes cut across every business weighing how to adopt AI responsibly. Through scenarios drawn from situations businesses are navigating right now, panelists gave attendees practical, actionable guidance on the legal and business ramifications of putting AI to work. About Wilson Elser’s Data Use & AI Governance Practice  Wilson Elser is a trusted privacy, security, and AI governance firm in the United States and the preeminent defense litigation firm in the privacy and cyber class action space. For more information about the practice, go to: https://www.wilsonelser.com/data-use-ai-governance About Wilson Elser Wilson Elser is the preeminent defense litigation firm in the United States. Over more than four decades, our litigation and trial lawyers have gained a reputation for taking on and prevailing in the most challenging and technical cases, frequently “parachuting in” to assume unresolved matters from other law firms. Our success also derives from winning on our clients’ terms and rigorously adhering to their guidelines. We are ranked 94 in the Am Law 100 and 30 in the National Law Journal’s NLJ 500. For more information, go to www.wilsonelser.com About Ankura, LLC  Ankura is a leading global consulting and expert services advisory firm with a broad range of specialties across industries, including the cybersecurity, data privacy and governance, and artificial intelligence space. The firm combines strategic advisory with deep technical expertise, hands-on implementation, and expert support to address complex business challenges. Ankura has more than 35 locations and supports projects in more than 115 countries. For more information, go to https://ankura.com/ About Privado AI   Privado AI is an agentic data privacy management platform that helps privacy and compliance teams automate manual governance workflows, map data flows, and detect consent-compliance violations at scale. Founded in 2020, the company leverages specialized AI agents to replace traditional, slow, questionnaire-based compliance methods. For more information, go to https://www.privado.ai/

Q: Are employees entitled by law to access their personnel files?   A: There is no federal law that gives private-sector employees the right to view their personnel files. Access is regulated entirely by state-specific laws. There are currently 19 states that legally require employers to permit employees (and sometimes former employees) to view and/or obtain a copy of their personnel file. As of November 8, 2026, that number will increase to 20, when New York’s recently enacted Personnel Records Access Law goes into effect. The majority of states have no law requiring access to personnel files and there is no federal law that confers on current or former employees a statutory right to access their personnel files.  As of October of 2026, the following states provide right of access to current employees: Alaska, California, Colorado, Connecticut, Delaware, Illinois, Iowa, Maine, Massachusetts, Michigan, Minnesota, Nevada, New Hampshire, Oregon, Pennsylvania, Rhode Island, Virgina, Washington, and Wisconsin.  Some states, including New York (as of November 8, 2026), also allow former employees to view their personnel files. Each state has its own caveats to access. For example, Washington allows for a former employee to retain the right of rebuttal or correction for up to two years following their separation from employment.  New York’s new law, Senate Bill 2025-S3460, was signed by Governor Kathy Hochul on September 9, 2026, adding Section 210-b to the New York Labor Law. The law covers public and private sector employers, including individuals, corporations, partnerships, labor organizations, unincorporated associations, other legal businesses and employer agents.  Employers operating in New York should familiarize themselves with the requirements of Section 210-b now, before it goes into effect, and update their document-management and onboarding practices accordingly, as non-compliance may expose them to claims under the New York Labor Law.  What Will New York Law Require? The law in New York will require employers to provide current and former employees with a copy of their personnel records within five (5) business days of a written request, up to twice per calendar year, at no cost to the employee. Employers also must notify employees within ten business (10) days after placing information in a personnel record that is, has been, or may be used to negatively affect the employee’s qualifications for employment, promotion, transfer, additional compensation, or the possibility of disciplinary action. If there is a disagreement with any information within the personnel record, removal or correction of the information may be mutually agreed upon by the employer and the employee. If the employee doesn’t agree with the information the employer places in the file, the employee can submit a written statement explaining the employee’s position, which must become a part of the employee’s personnel record and must accompany the disputed information when it is transmitted to a third party, so long as the original information remains in the file. Employers are not required to permit an employee to review their personnel record more than twice per calendar year, but a notification and review resulting from the placement of negative information in the record does not count toward that limit. Under the new law, to the extent employers create personnel records, without deletions or expungement of information, they are required to maintain them from the date of employment through three years after termination of the employee’s employment. What Types of Documents Are Covered Under New York’s Personnel Records Law? The New York law expressly defines “personnel records” to include the following written information and documents prepared by an employer regarding an employee, for inclusion in the employee’s personnel record: Name, address, date of birth, job title and description  Rate of pay and any other compensation paid to the employee Starting date of employment  The job application of the employee  Resumes or other forms of employment inquiry submitted by the employee to the employer in response to the employer's advertisement  All employee performance evaluations, including but not limited to employee evaluation documents  Written warnings of substandard performance  Lists of probationary periods  Waivers signed by the employee Copies of dated termination notices  Any documents relating to disciplinary action regarding the employee The law applies broadly and is not limited to the above-listed documentation. Examples of documents also likely covered include: 1. Employment agreements and offer letters signed at the start of the employment relationship 2. Handbook and policy acknowledgment forms, such as sign-offs on anti-harassment policies, code of conduct agreements, or confidentiality acknowledgments 3. Performance improvement plans that the employee is asked to sign to confirm receipt 4. Separation-related documents, such as resignation acknowledgments or exit interview forms, to the extent they are placed in the personnel file Note that the law expressly excludes, “information of a personal nature about a person other than the employee if disclosure of the information would constitute a clearly unwarranted invasion of such other person’s privacy.” The law prohibits employers and other persons from discharging, threatening, penalizing, discriminating, or retaliating against employees who exercise their statutory rights.  Practical Tips for New York Employers New York employers should keep several practical points in mind as they prepare to comply with Section 210-b of the Labor Law: 1. Review current practices and protocols. Before November 8, 2026, New York employers should review their personnel record practices and retention procedures. Employers should establish a protocol for tracking and responding to an employee’s request for the employee’s personnel file. Determine whether your organization already provides employees with copies of all signed personnel documents. Employers also should evaluate whether covered personnel records maintained by third-party providers can be produced within five business days.  2. Update onboarding and HR workflows. Ensure that standard operating procedures require HR personnel and managers to provide a copy of every signed document to the employee at the time of signing. Consider building this step into electronic onboarding platforms and document management systems so that copy delivery is automatic rather than dependent on individual compliance to ensure timely compliance with the notification requirements. 3. Leverage electronic signature and document management tools. Employers using e-signature platforms can configure them to send a completed copy of each signed document to the employee automatically, which streamlines compliance and creates a reliable audit trail. 4. Train HR staff and supervisors. Managers and HR professionals who handle personnel paperwork should be informed of the new requirement and understand that every signed document placed in a personnel file must be accompanied by delivery of a copy to the employee. Employers should train HR personnel and managers on the law’s access, notice, retention, and anti-retaliation requirements. 5. Document delivery of copies. Maintain a record confirming that each signed document was provided to the employee. Whether through an electronic system's automatic confirmation, an email transmittal, or a signed acknowledgment of receipt, this documentation can be important if compliance is later questioned. What Are the Risks of Non-Compliance? For companies that violate the law, New York’s Attorney General would be empowered to seek penalties ranging from $500 to $2,500 per violation, and workers who face discrimination or retaliation for asserting their rights would have a private right of action. Broader Considerations New York's enactment of Section 210-b is part of a broader trend of states strengthening employee access to workplace records. For instance, California employers must allow current and former employees to inspect and receive copies of personnel records relating to the employee’s performance or any grievance concerning the employee. In addition, California employers must also provide education and training records upon the employee’s authorized request within a 30-day window. In contrast, employers in the state of Texas are not required to turn over personnel files to current or former employees. Employers operating in multiple jurisdictions should be aware that personnel-file access laws vary significantly from state to state. 

Peter Espey (Of Counsel-Madison, NJ) was quoted in the article “Economic Pressures, Younger Juries Mean NJ Awards Remain Elevated, Lawyers Say,” appearing in the October 22, 2026, edition of Law.com’s New Jersey Law Journal. Peter, who focuses his practice on Medical Malpractice, in addition to other areas, was interviewed along with another defense attorney and two plaintiffs’ attorneys about the increase in jury verdicts and settlements in New Jersey in 2026. The total amount from the top twenty personal injury awards in New Jersey increased by $82 million from 2025 to 2026.  Peter identifies possible reasons, including generational changes among potential jurors, explaining, “Some of the older potential jurors are aging out and less likely to serve, so it’s a new group of people that are the potential jurors. They might see things differently than their parents or grandparents.” Peter also cites inflation, economic strain, and lingering repercussions from the COVID pandemic as fueling litigation and larger settlements, noting that some plaintiffs' attorneys may also be becoming more selective, taking only higher-value cases.  He discussed other potential causes. 

Thomas Comer (Partner, New York), Thomas O’Connor (Associate, White Plains), and Judy Selmeci (Partner, New York), obtained a complete defense verdict on behalf of the client in Supreme Court, Nassau County before the Hon. Catherine Rizzo. The jury unanimously found that the client bore no liability in connection with plaintiff’s claimed Labor Law accident. Plaintiff, a 24-year-old demolition laborer at the time of the alleged incident, claimed that he sustained injuries as a result of a fall from a scaffold while performing interior demolition work. He alleged significant orthopedic injuries, including to his knee, spine, and shoulder, and underwent multiple surgical procedures, including a two-level lumbar laminectomy, a single-level cervical fusion, and a left shoulder arthroscopy. He further claimed total disability, with over $1,000,000 in alleged future lost wages. Plaintiff’s theory as to the client was not based on any actual involvement in the work, but on an effort to characterize the client as a “contractor” or statutory agent based largely on a permit issued in its name. The defense focused on a clear and targeted strategy: establishing that the client had no authority to direct, supervise, or control the injury-producing work. The evidence showed that the client did not perform work at the site, did not retain plaintiff or any subcontractors, did not receive payment, and had no role in how the work was carried out. Instead, the work was performed independently by others, without the client’s knowledge or involvement. During the charge conference, the team secured modified jury instructions to both PJI 2:216 and 2:217. Over opposition, the Court agreed to instruct the jury that it must first determine whether the client had the authority to supervise, direct, or control the work before considering any potential Labor Law liability. That framework was reinforced in the verdict sheet, which required the jury to address this threshold issue at the outset. At trial, the defense also highlighted significant credibility issues in plaintiff’s account, including his admission that he told medical providers he was injured in a bicycle accident. Through cross-examination and the testimony of a neutral medical witness, the defense established that plaintiff offered multiple, inconsistent explanations for this discrepancy. Following nearly four hours of deliberations, the jury returned a unanimous defense verdict, with the jury assigning 0% liability to the client.