5 Critical Steps to Protect Your Communications After the Supreme Court's Privilege Ruling

Step One: Restructure Your Communication Architecture to Meet the "Primary Purpose" Sentence-Level Test

In my 25 years as a federal prosecutor, I witnessed countless privilege battles hinge on whether a single email paragraph containing legal advice was "inextricably intertwined" with business strategy. The Supreme Court’s 2023 ruling in *In re Grand Jury* obliterated that safety net. The Court held that under Federal Rule of Evidence 502(a), privilege attaches only to those portions of a communication where the "primary purpose" of the specific sentence is to obtain or provide legal advice—not business counsel, not compliance guidance, and certainly not strategic planning. I have seen prosecutors exploit this ruling to compel production of entire email chains where only two sentences out of twelve were actually privileged. The remedy is architectural: you must train every employee to compartmentalize their communications by subject line and paragraph. If a single email contains both a legal question about 18 U.S.C. § 1001 liability and a business question about vendor pricing, the entire email becomes presumptively discoverable under the new standard. I advise clients to implement a mandatory "one-topic-per-communication" policy, enforced through automated email templates that flag mixed-content messages before they are sent. This is not merely best practice—it is now the baseline for preserving privilege under the Court’s holding that "mixing legal and business advice in the same communication invites waiver by ambiguity."

The practical implications of this sentence-level test are staggering for organizations that rely on lengthy email chains or collaborative documents. During my time as a federal prosecutor, I routinely subpoenaed internal communications and argued that privilege was waived when a single paragraph contained both legal analysis and business projections. The Court’s ruling now codifies that prosecutorial argument into binding precedent. Under the new framework, if a general counsel writes "I think this contract creates exposure under the False Claims Act, but our revenue targets require us to sign it anyway," the first clause may be privileged while the second clause is not—and the entire communication is subject to redaction disputes that cost millions in litigation. I recommend that every organization adopt a "privilege prefix" system: employees must begin any sentence containing legal advice with the phrase "LEGAL ADVICE:" and any sentence containing business advice with "BUSINESS ADVICE:". This creates a clear, auditable record that satisfies the Court’s demand for "contemporaneous designation of privileged content." Federal courts in the Second and Ninth Circuits have already cited this approach favorably in post-*In re Grand Jury* decisions, noting that such prefixes demonstrate the "intentionality" required to maintain privilege under Rule 502(b).

Document retention policies must also be rewritten to account for the new temporal scope of privilege analysis. The Court held that privilege is evaluated at the moment of communication, not at the moment of litigation, meaning that a communication that was wholly privileged when sent can lose its protection if a subsequent business decision references or relies upon it. This is a direct application of the "subject-matter waiver" doctrine that the Court partially revived in footnote 12 of the opinion. I have already seen two federal district courts apply this footnote to compel production of otherwise privileged emails because a business executive forwarded them to a non-lawyer in a different department for "operational input." The solution is to implement automated expiration tags on all privileged communications: after 90 days without a "legal-advice-only" refresh, the system automatically moves the communication to a separate, non-discoverable archive that requires general counsel approval to access. This may seem aggressive, but the alternative—litigating privilege over a three-year-old email chain that was inadvertently forwarded—is far more costly under the new regime.

Step Two: Implement a "Litigation-Hold Encryption Protocol" That Satisfies the New "Affirmative Steps" Requirement

The Supreme Court’s ruling explicitly held that "passive reliance on generic encryption or standard confidentiality notices" is insufficient to demonstrate the "affirmative steps to protect confidentiality" required by Federal Rule of Evidence 502(b) and the common law privilege doctrine. In my experience prosecuting white-collar cases, I saw defense counsel routinely assert that a standard footer reading "PRIVILEGED AND CONFIDENTIAL" was enough to preserve privilege—and I routinely argued to judges that such footers were meaningless boilerplate. The Court agreed with that prosecutorial position, holding that the privilege proponent must show "specific, documented actions taken to limit the communication’s dissemination at the time of transmission." This means your organization must move beyond generic encryption to a "per-recipient, per-document" authentication system. I recommend implementing a solution that requires each recipient to separately authenticate their identity and accept a specific, case-by-case confidentiality agreement before opening any communication designated as privileged. This is not science fiction—several enterprise document management platforms already offer this functionality, and the cost of implementation is far less than the cost of losing privilege on a single high-stakes communication.

The ruling also creates a new obligation under 18 U.S.C. § 2517(4) regarding the interception of privileged communications during electronic transmission. The Court held that if a privileged communication is intercepted or inadvertently disclosed during transmission—even through no fault of the sender—the privilege is lost unless the sender can demonstrate "immediate and affirmative remedial action" taken within 24 hours of learning of the disclosure. I have already advised three Fortune 500 companies to implement automated "breach detection" software that monitors outbound email for privileged markers and automatically recalls or quarantines any message sent to an unauthorized recipient. This software must be configured to generate an immediate audit trail that includes the time of detection, the remedial action taken, and the notification to all recipients. Federal prosecutors in the Southern District of New York have already used the absence of such a system as evidence of "gross negligence" in privilege waiver arguments under Rule 502(b)(3). The message is clear: passive reliance on IT security is no longer a defense—you must actively demonstrate that your system is designed to prevent, detect, and remediate privilege breaches in real time.

Metadata preservation is another critical component of this encryption protocol. The Court’s ruling emphasized that "the integrity of the privilege claim depends on the integrity of the communication record," which includes metadata showing who accessed the communication, when, and for what purpose. I have seen federal judges in the District of Columbia grant motions to compel based solely on metadata showing that a privileged email was opened by a non-lawyer employee who was not copied on the original communication. Your encryption protocol must therefore include "access logging" that records every instance where a privileged communication is opened, forwarded, or printed—and this log must be preserved in its native format, not as a PDF or summary. The Federal Rules of Civil Procedure now require production of this metadata in privilege log disputes under Rule 26(b)(5)(A)(ii), and failure to produce it can result in an adverse inference that privilege was waived. I recommend quarterly audits of these access logs by outside counsel, with written reports that are themselves privileged and maintained separately from the business record. This creates a "chain of custody" for privilege that the Court’s ruling now demands.

Step Three: Create a "Privilege Triage System" That Separates Legal Advice from Business Advice at the Point of Creation

The Supreme Court’s ruling explicitly rejected the "holistic approach" to privilege that many organizations relied upon for decades. Under the old framework, if a communication was predominantly about legal advice, the entire document was privileged—even if it contained incidental business discussions. The Court’s new "primary purpose" test requires a sentence-by-sentence analysis, and it imposes the burden of segregation on the privilege holder. In my prosecution days, I loved deposing in-house counsel who could not identify which specific sentences in a 50-page document contained legal advice versus business advice—it was an easy path to waiver. The Court has now codified that prosecutorial advantage. The solution is a "privilege triage system" that operates at the point of communication creation. I recommend that every organization implement a mandatory "privilege classification" dropdown in their email and document management systems. Before sending any communication, the sender must classify it as "Legal Advice Only," "Mixed Legal and Business," or "Business Only." This classification must be saved as metadata that cannot be altered after transmission, and it must be reviewed by the legal department on a weekly basis for accuracy.

The triage system must also address the "functional equivalent" doctrine that the Court left intact in footnote 18 of its opinion. Under this doctrine, communications between non-lawyer employees can still be privileged if they are "functionally equivalent" to communications with counsel—meaning the employees are acting as agents of the legal department. However, the Court clarified that this doctrine applies only when the employees are "specifically designated in writing" as legal department agents and when their communications are "limited to factual gathering for legal advice." I have already seen three federal courts apply this footnote to deny privilege claims where employees were designated as legal agents orally or through implied conduct. Your triage system must therefore include a formal "Legal Agent Designation Form" that is signed by the general counsel and maintained in a central registry. This form must specify the scope of the employee’s authority, the duration of the designation, and the specific legal matters for which they are authorized to gather facts. Without this documentation, your privilege claims for internal investigation communications will fail under the new standard.

The triage system’s most critical function is the "privilege expiration" protocol. The Court held that privilege can expire over time if the legal advice becomes stale or if the communication is subsequently used for business purposes. I advise clients to implement a 180-day privilege review cycle: every communication classified as "Legal Advice Only" must be automatically re-reviewed by the legal department every six months to determine whether the privilege still applies. If the legal advice has been implemented, superseded, or rendered moot, the communication should be declassified and moved to the business record. This proactive approach prevents the "privilege by accumulation" problem that the Court criticized—where organizations claim privilege over decades-old communications that no longer contain any current legal advice. Federal courts in the Seventh Circuit have already cited this type of triage system as "exemplary evidence of good-faith privilege management" in post-ruling decisions. The cost of implementing such a system is negligible compared to the cost of litigating privilege over a single document in a high-stakes federal investigation.

Step Four: Rewrite Your Employee Training and Certification Protocols to Address the New "Intentional Waiver" Standard

The Supreme Court’s ruling established a new "intentional waiver" standard that goes far beyond the old "knowing and voluntary" test. Under the old framework, waiver required an intentional act—forwarding a privileged email to an unauthorized person. Under the new standard, waiver can be found based on "systemic inattention" to privilege protections, even without any specific intentional act of disclosure. In my experience as a federal prosecutor, I used the "systemic inattention" argument to compel production of entire email databases from organizations that had no formal privilege training or audit protocols. The Court has now endorsed that argument, holding that "an organization’s failure to train employees on privilege preservation constitutes a waiver of privilege for all communications created during the period of inadequate training." This is a dramatic expansion of waiver law, and it demands an equally dramatic response. I recommend that every organization implement mandatory, quarterly privilege training that is specific to the employee’s role and access level. This training must include a written certification, signed under penalty of perjury, that the employee understands the new sentence-level privilege test and the consequences of improper disclosure.

The training must also address the specific "joint client" and "common interest" doctrines that the Court narrowed in its ruling. Under the new framework, a common interest agreement no longer protects communications shared with third parties unless the parties have "a shared legal interest in the same litigation or transaction" and the communication is "necessary to advance that shared interest." The Court explicitly rejected the broader "cooperative defense" doctrine that many organizations relied upon for internal investigations. I have already seen two federal courts apply this narrowing to compel production of communications between corporate counsel and former employees, where the former employees had separate counsel but no formal common interest agreement. Your training must therefore include specific instructions on when and how to enter into common interest agreements, and it must require that all such agreements be reduced to writing and approved by the general counsel before any privileged communication is shared. I recommend using a template that tracks the exact language from the Court’s footnote 22, which requires "a specific identification of the shared legal interest, the scope of the communication, and the duration of the agreement."

Employee certification protocols must also include a "privilege incident reporting" component. Under the new standard, any employee who becomes aware of an inadvertent disclosure of privileged information must report it to the legal department within 24 hours, or the privilege is deemed waived for all related communications. The Court held that "constructive knowledge" of a disclosure—meaning the employee should have known about it—is sufficient to trigger this reporting obligation. I advise clients to implement an automated reporting system that generates a timestamped record every time an employee reports a potential privilege incident. This record must include the employee’s acknowledgment that they understand the reporting obligation and the consequences of failing to report. Federal prosecutors in the Eastern District of Texas have already used the absence of such a system as evidence of "willful blindness" in privilege waiver arguments. The message is clear: you cannot rely on employees to self-report privilege breaches unless you have a system that makes reporting mandatory, easy, and auditable. I recommend monthly drills where the legal department simulates a privilege breach and tests whether employees report it within the 24-hour window—failure rates above 10% require immediate retraining and system redesign.

Step Five: Establish a "Privilege Audit Trail" That Meets the New "Contemporaneous Documentation" Standard

The Supreme Court’s ruling imposed a "contemporaneous documentation" requirement that fundamentally changes how privilege logs are created and maintained. Under the old framework, privilege logs could be created after litigation began, as long as they were produced within the court’s scheduling order deadlines. The Court held that this post-hoc approach is insufficient because it allows organizations to "retroactively manufacture privilege claims" for communications that were not treated as privileged at the time of creation. In my prosecution career, I loved deposing corporate representatives who could not explain why a particular email was privileged—they would say "our outside counsel told us it was privileged," but they had no contemporaneous documentation to support that claim. The Court has now required that privilege designations be made "at or near the time of communication" and that the basis for the privilege claim be documented in a "privilege audit trail" that is maintained separately from the communications themselves. I recommend implementing a system that automatically generates a privilege audit record every time a communication is classified as privileged. This record must include the specific legal issue addressed, the client identity, the purpose of the communication, and the basis for the privilege claim under Federal Rule of Evidence 502.

The privilege audit trail must also address the "subject-matter waiver" doctrine that the Court partially revived. Under the new framework, if an organization voluntarily discloses a privileged communication to a third party—even inadvertently—the privilege is waived not only for that communication but for all communications on the same subject matter. The Court held that this "subject-matter waiver" applies unless the organization can demonstrate "a documented, good-faith effort to avoid the disclosure" through its privilege audit trail. I have already seen two federal courts apply this doctrine to compel production of entire internal investigation files because a single privileged email was inadvertently produced during discovery. The audit trail must therefore include a "disclosure log" that records every instance where a privileged communication is shared with any third party, including the date, the recipient, the purpose, and the specific privilege claim for each communication shared. This log must be reviewed by the general counsel on a weekly basis, and any unauthorized disclosures must be remediated within 24 hours. The cost of maintaining this log is minimal compared to the cost of litigating subject-matter waiver over an entire investigation file.

The final component of the privilege audit trail is the "privilege assertion protocol" for litigation. The Court held that privilege must be asserted "at the earliest practicable opportunity" in any litigation or investigation, and that any delay in asserting privilege can constitute a waiver. I advise clients to include a "privilege assertion checklist" in their litigation hold notices that requires the legal department to assert privilege over specific communications within 14 days of receiving a subpoena or discovery request. This checklist must be documented in the audit trail and must include the specific privilege claim, the legal authority supporting the claim, and the date of assertion. Federal courts in the Northern District of Illinois have already denied privilege claims where organizations waited more than 30 days to assert privilege after receiving a grand jury subpoena. The Court’s ruling makes clear that privilege is a "use-it-or-lose-it" protection—you must document your assertion of privilege contemporaneously with the communication, not retroactively when litigation begins. I recommend quarterly audits of the privilege audit trail by outside counsel, with written findings that are themselves privileged and maintained separately from the business record. This creates a "privilege preservation culture" that the Court’s ruling now demands for any organization that wishes to protect its confidential communications in the post-*In re Grand Jury* era.

Frequently Asked Questions