A government subpoena does not establish wrongdoing. It does, however, create immediate legal and operational decisions. The company must determine what the issuing authority can demand, preserve potentially responsive records, protect legitimate privileges, and decide who speaks for the organization. Those decisions become harder when officers, employees, and the company have potentially different interests.
Identify the instrument before choosing a response
“Subpoena” is not a single procedure. A federal grand jury subpoena is generally governed by Federal Rule of Criminal Procedure 17. A federal civil subpoena ordinarily implicates Federal Rule of Civil Procedure 45. An administrative demand may arise under a separate statute and enforcement scheme. The recipient, issuing authority, return date, requested materials, and method of service must be identified before objections or production plans are formulated.
A company should not assume that an informal conversation extends a legal deadline. Any extension or modified production arrangement should be documented through the appropriate process.
Preservation belongs to an accountable team
Relevant information may reside in email, messaging systems, shared drives, mobile devices, accounting systems, cloud platforms, and third-party repositories. A preservation plan should identify custodians and sources, suspend relevant routine deletion where appropriate, and document implementation. Preservation does not mean immediate production. The organization may preserve information that is ultimately outside the demand or protected from disclosure.
Information technology personnel can help identify where records are held, but should not independently decide legal responsiveness or privilege. Counsel and designated records custodians should establish a defensible process for collection, review, and production.
Who is the client?
When a lawyer represents an organization, the client is the organization, not automatically its chief executive, directors, or employees. That distinction becomes important during internal interviews and agency inquiries. In Upjohn Co. v. United States, 449 U.S. 383 (1981), the Supreme Court addressed privilege in corporate communications made to secure legal advice. The case does not mean that every conversation involving a company lawyer is privileged.
Appropriate employee interview explanations should address whom counsel represents, the purpose of the interview, and who controls the organization’s privilege. When an individual’s interests may diverge from those of the company, separate counsel may be necessary. The same lawyer should not casually promise personal representation to multiple employees.
Separate legal advice from ordinary business discussion
Copying a lawyer on an operational email does not automatically create privilege. A company should identify the legal purpose of communications, limit distribution when appropriate, and avoid unnecessary forwarding of legal advice. Consultants and other third parties may complicate the analysis. Work-product protection likewise depends on its own requirements and cannot be assumed merely because a document was prepared during a stressful period.
Privilege review should occur before production. Depending on the proceeding, privilege logs, objections, confidentiality arrangements, and protections against inadvertent disclosure may be relevant. Federal Rule of Evidence 502 addresses certain waiver questions, but it is not a substitute for careful review.
Investigative independence and reporting lines
When senior management may be implicated, ordinary reporting channels can become problematic. The organization may need an independent decision-maker, board committee, or outside counsel to supervise fact gathering. The structure should fit the company’s size and governance documents; a small business will not use the same process as a publicly traded corporation.
Determine who authorizes production, who can negotiate scope, who communicates with investigators, and how management receives updates without compromising privilege. A documented decision process reduces inconsistent statements and uncontrolled disclosures.
Evaluate confidentiality and collateral obligations
Subpoenaed records may contain health, financial, educational, employment, or trade-secret information. The relevant confidentiality law and available disclosure exceptions require analysis. A subpoena is not a universal waiver of privacy requirements. The organization should also examine applicable insurance notice conditions, contractual obligations, licensing disclosures, and preservation duties, without assuming that every inquiry triggers immediate external reporting.
Make a request-by-request production matrix
For each request, identify responsive custodians, date ranges, collection methods, objections, privilege issues, and production status. Record what has been searched and what remains outstanding. If a request is overbroad or unclear, counsel may seek clarification, staged production, or relief through the governing procedure. Never alter, fabricate, or conceal records to improve the organization’s position.
The first three days are for control, not conclusions
There is no universal 72-hour response deadline. The initial period is useful for stabilizing the process: verify service and deadlines, issue preservation instructions, identify potential conflicts, assess privilege, and establish accountable communications. Whether the matter later becomes a regulatory dispute, civil enforcement action, or criminal investigation, an orderly start can reduce avoidable harm.
Need counsel for an agency demand? BOLO Health Law assists businesses and professionals with regulatory and government investigations. Review our investigations practice or request an initial matter review.
Related BOLO analysis: For the conflict analysis, consider company counsel, employee conflicts, and representation during investigations.
General legal information, not legal advice. Outcomes depend on the facts and governing law. An initial inquiry does not establish an attorney-client relationship. Do not send confidential, privileged, or protected health information through an initial web form.