In today's rapidly changing technological world, e-mail is an important communication tool, for both business and personal use. Indeed, the United States government has recognized the growing significance of e-mail in today's society by enacting the Electronic Communications Privacy Act ("ECPA"), which governs unauthorized access to and disclosure of electronic mail messages. In recognition of the unique role that e-mail communications play in the business world, the ECPA contains an important exception for employers. Employers may review employee e-mails so long as they have consent from the employee (obtained through an employee handbook, policy or similar means) or the employer can show a business necessity for the interception or access.

To take advantage of this exception to the ECPA, all employers should establish a written policy that indicates that an employee should not have an expectation of privacy in e-mail communications, and that reminds employees that company-owned communication systems and e-mail systems are limited to business purposes. A New York court recently re-affirmed the importance of such a policy in Scott v. Beth Israel Medical Center.

In Beth Israel, the plaintiff was the former chairman of the defendant hospital's orthopedic department. Some time after the hospital terminated the plaintiff's employment, the hospital's counsel sent a letter to the plaintiff's counsel, which advised plaintiff's counsel that the hospital was in possession of e-mail correspondence between plaintiff and his attorney. The correspondence also stated the hospital's belief that any potential privilege attached to the communications had been waived by the plaintiff's use of the hospital's e-mail system. The e-mails had been sent to and from the plaintiff's business e-mail account and over the hospital's server.

Plaintiff's counsel responded by informing the hospital that the e-mails were privileged communications belonging to the plaintiff, for which there had been no waiver. Plaintiff's counsel requested immediate return of the e-mails. When the hospital refused to return the e-mails, the plaintiff sought a protective order, arguing that the e-mails were privileged under both the attorney-client privilege and the attorney work-product doctrine. The hospital argued that the plaintiff could not have had any reasonable expectation of privacy in e-mails sent over the hospital's e-mail server and in violation of its e-mail policy.

The hospital's e-mail policy was contained in its Human Resources Policy and Procedure Manual. The e-mail policy prohibited personal use of the company's e-mail systems. In addition, the policy gave the hospital permission to access and monitor e-mails sent on the hospital's computer or communications system. Finally, the hospital required new employees to sign a form acknowledging that they had read and were familiar with the e-mail policy. The court found that the effect of such a policy was to "have the employer looking over your shoulder each time you send an e-mail." Accordingly, the court held that the communication could not have been made in confidence and, therefore, the attorney-client privilege was inapplicable.

Although the Beth Israel decision is not the first addressing the issue of waiving a privilege through e-mail communications, it is the most recent. Most courts addressing the issue agree that employees have a limited expectation of privacy in e-mail and a company can ban personal e-mail use altogether. Companies that allow personal use of e-mail must be careful to draft a policy that gives the company access to the e-mail system. Best practices for such policies include, at a minimum:

• Banning employees' personal use of electronic systems, where appropriate, or otherwise reminding employees that the electronic systems belong to the company and should be used primarily for the company's business;
• Banning e-mail of a sexual nature, or e-mail that is intimidating, hostile, or offensive with respect to sex, age, race, color, religion, national origin, ancestry, disability, marital status, sexual orientation, or any other status protected by federal, state, or local law;
• Notifying the employee that the company has the right to monitor the employee's use of the e-mail or other electronic systems;
• Notifying the employee that third parties, such as information technology employees, have the right to access the employee's e-mail and other electronic systems.

This list is not exhaustive. For more information, or for assistance in drafting an e-mail policy that ensures your company's right to access, monitor and control your employees' e-mail communications, please contact any member of Schiff Hardin's Labor and Employment Group.