by Todd W. Smith

The meteoric rise and calamitous fall of Theranos and its founder, Elizabeth Holmes, have inspired myriad articles, books, television shows, movies, and podcasts. An array of civil, regulatory, and criminal proceedings followed in the wake of the company’s collapse, including ongoing criminal proceedings against Holmes, once touted as the “Steve Jobs” of biotechnology for her seemingly innovative reimagining of laboratory blood testing procedures.

While cautionary tales from the Theranos saga abound, the latest lesson hits particularly close to home for lawyers representing corporate clients. In United States v. Elizabeth A. Holmes, a criminal proceeding against Holmes pending in the Northern District of California, a recent privilege ruling serves as a potent reminder of the importance of defining who is (and who is not) the client when you are representing clients in the corporate context.

In that decision, issued by United States Magistrate Judge Nathaniel M. Cousins, the Court concluded that a trove of documents was not protected by Holmes’ individual attorney-client privilege, notwithstanding Holmes’ subjective belief that the law firm involved (Boies Schiller Flexner LLP) was representing her individually.¹

The firm had begun representing both Holmes and Theranos in an intellectual property dispute in 2011. Over the years, the firm continued to represent Holmes and Theranos on a variety of issues related to Theranos’ patent portfolio, press interactions, and inquiries from government agencies. Notably, despite the breadth and duration of the law firm’s involvement, Holmes and the firm never signed an engagement letter or otherwise took any steps to formalize the scope of the firm’s representation. Once the DOJ and SEC began investigating her, Holmes retained separate counsel to represent her in those proceedings.

In her pending criminal case (United States v. Holmes), the government served Holmes with its exhibit list for trial, which included thirteen documents that Holmes claimed implicated her individual attorney-client privilege. Holmes argued that she understood that the Boies Schiller firm jointly represented Theranos and her as an individual, not merely as a representative of Theranos. The government disagreed, arguing that there was no joint representation, and, thus, the documents were subject only to Theranos’ corporate privilege, which the company had already waived.

The court rejected Holmes’ claim of privilege based on her subjective belief that she was individually represented along with Theranos, opting instead to apply the Ninth Circuit’s Graf test to determine whether a joint representation existed.² Under Graf, the party seeking to assert the individual privilege must satisfy all of the following factors to establish a joint representation: First, they must show they approached counsel for the purpose of seeking legal advice. Second, they must demonstrate that when they approached counsel they made it clear they were seeking legal advice in their individual rather than in their representative capacity. Third, they must demonstrate that the counsel saw fit to communicate with them in their individual capacity, knowing that a possible conflict could arise. Fourth, they must prove that their conversations with counsel were confidential. Fifth, they must show that the substance of their conversations with counsel did not concern matters within the company or the general affairs of the company.³

Applying the Graf factors, the court found that Holmes failed to establish a joint representation. The court pointed out (i) the absence of an engagement letter between the law firm and Holmes (or Theranos, for that matter), (ii) the lack of evidence of payments from Holmes’ personal accounts to the law firm, (iii) the fact the contested documents included other Theranos employees, and (iv) the subject matter of the communications, which related to Theranos’ general affairs and not Holmes’ individual legal interests.

Consequently, the court found the subject documents were not protected by Holmes’ individual attorney-client privilege, but only by Theranos’ privilege. Because the company’s privilege already had been waived, the documents were deemed admissible at trial.

So, what can corporate lawyers take away from this decision? Quite a bit. Below are several practical steps that corporate counsel should consider taking to avoid confusion about the scope of their representation and to protect the privilege of their client—whether that be the company, the individual executives, or both. Nor are these considerations limited to outside counsel. Rather, they apply equally, if not more directly, to in-house lawyers whose “client” is typically the very company that employs them.

Carefully Define the Client in the Engagement Letter
First and foremost, lawyers should carefully define at the outset of the representation who is and, just as importantly, who is not their client. If you are representing only the company, and not any of the company’s executives or employees, your engagement letter should state as much.⁴ For similar reasons, it is good practice for a lawyer to prepare a separate engagement letter for each new matter he or she takes on, even if it is for an existing client. This is helpful to avoid ambiguity over the scope of the representation if a lawyer is handling multiple matters for the same client.

Give Frequent “Upjohn” Warnings
A company necessarily acts through its constituents, i.e., its employees, shareholders, officers, and directors. For a lawyer representing the company, this can create confusion about what communications are privileged and who controls the privilege. In Upjohn Co. v. United States, the United States Supreme Court weighed in on this issue, holding that communications between a company’s lawyer and a company employee are subject to the company’s privilege if they relate to issues within the scope of the employee’s duties and if the employee is aware that he or she is being questioned so that the company may obtain legal advice.⁵ In doing so, the Supreme Court rejected the previously-used “control group” test whereby only communications with employees within a company’s “control group” were considered privileged.⁶

This holding led to the establishment of the so-called “Upjohn” warning, whereby corporate lawyers remind the constituents with whom they are communicating that, while the communications may be privileged, it is the company—not the individual—that controls the privilege. That means that the company may decide to waive the privilege even over an individual employee’s objection. The lawyer should also inform the individual that they may wish to consult with their own lawyer if they have any concerns about their own potential exposure.

These Upjohn warnings can be particularly important in the context of internal investigations when company lawyers are interviewing employees about their knowledge of the events at issue. This importance was exemplified in the Ninth Circuit’s decision in United States v. Ruehle. In that case, Broadcom’s then CFO, William Ruehle, was interviewed as part of an internal review of the company’s stock option granting practices.⁷ While Broadcom’s counsel testified that it gave Mr. Ruehle an Upjohn warning, Mr. Ruehle denied receiving one, testifying that he believed the law firm was representing him personally, in addition to representing the company.⁸ In the end, the Ninth Circuit determined that Mr. Ruehle’s statements to counsel were not protected by his individual attorney-client privilege and lifted a district court order suppressing the statements.⁹

While the Ninth Circuit’s decision ultimately turned on other facts, the court’s opinion highlighted the need to clearly define and document not only who is the client, but who controls the privilege.

Maintain Confidentiality of Communications Between Counsel and Company
Company counsel, whether in-house or outside counsel, should limit communications to only those employees or executives who are necessary to the communication on a “need to know” basis. And those recipients should be advised to keep such legal advice confidential, and that forwarding it to others, either outside or inside the company, could jeopardize the privilege. Company employees should be educated to limit their requests for legal advice to lawyers and other indispensable parties, avoiding mass “cc” lists and “replies to all.” Maintaining confidentiality, including by limiting the distribution of privileged communications, is critical to maintain a company’s attorney-client privilege.

Separate Legal Advice From Business Advice
Corporate counsel often provide clients with business advice in addition to legal advice. While jurisdictions vary in how they treat so-called “mixed” communications (com­munications that include both legal advice and business advice), a company’s lawyer would be prudent to take steps to separate, to the extent possible, communications that involve legal advice from those that involve business advice. Courts have held that indiscriminately copying company counsel on emails relating to business communications does not render such communications privileged.¹⁰ For similar reasons, corporate lawyers should counsel their client that requests for business advice (or business advice mixed with legal advice) may not be privileged and potentially could be discoverable down the road.

While the Theranos saga continues to unfold, it has not ceased providing valuable lessons for lawyers and executives alike. The latest decision in USA v. Holmes is a particularly important reminder for corporate practitioners of steps they can take to preserve their clients’ attorney-client privilege—be it the company, its executives, or both.

ENDNOTES

1. United States v. Holmes, No. 18CR00258EJD1NC, 2021 WL 2309980 (N.D. Cal. June 3, 2021).
2. United States v. Graf, 610 F.3d 1148 (9th Cir. 2010).
3. Holmes, 2021 WL 2309980 at *3 (citing Graf, 610 F.3d at 1160).
4. While outside the scope of this article, if a lawyer is jointly representing the company and one or more of its constituents, he or she should consider whether any actual or potential conflicts of interest may exist among the joint clients, including seeking informed written consent from the joint clients, as appropriate.
5. See Upjohn v. United States, 449 U.S. 383, 394 (1981).
6. Id. at 397.
7. United States v. Ruehle, 583 F.3d 600 (9th Cir. 2009).
8. Id. at 605.
9. Id. at n.3 (“[T]he district court seems to have disbelieved the Irell lawyers who took no notes nor memorialized their conversation on this issue in writing, and it apparently credited Ruehle’s testimony that no such warnings were given. We cannot say that this finding is clearly erroneous on the record before us.”).
10. See Thomas v. Kellogg Co., 2016 WL 2939099, at *2 (W.D. Wash. May 20, 2016) (“It is certainly not the case that adding an attorney to an email string or a distribution list makes widely disseminated, business communications privileged.”).

Todd W. Smith is a partner at Umberg Zipser LLP where he practices complex business litigation in state and federal courts, with a focus on defending law firms and lawyers in legal malpractice actions. He is a member of the OCBA’s Professionalism & Ethics Committee. The views expressed herein are his own. He can be reached at tsmith@umbergzipser.com.