S. Howey v. Boston Public Health Commission (SPR 20180627)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division

Rebecca S. Murray Supervisor of Records

May 18, 2018 SPR18/627

Mimi Brown, Esq.

Assistant General Counsel

Boston Public Health Commission Office of the General Counsel 1010 Massachusetts Avenue Boston, MA 02118 .

Dear Attorney Brown:

I have received the petition of S. Howey appealing the response of the Boston Public Health Commission (Commission) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). S. Howey requested a copy of records pertaining to an identified address in the City of Boston from January 9, 2018-the present, specifically:

911 audio call file(s) and documents; and Log-book entries.

e Computer-aided dispatch report/transcript (CAD); e Calls for service report(s);

e Incident report(s);

e Bill(s);

e Police report(s);

@

e

In its May 3, 2018 response, the Commission informed S. Howey that Boston Emergency Medical Services did not respond to, or transport patient(s) from, the identified address on the requested dates. Therefore, the Commission only has two responsive records: a CAD report, which was provided, and a 911 call audio file, which was withheld. Under the Public Records Law, the Commission is not required to create a record in response to a public records request. See G. L. c. 66, § 6A(d). The duty to comply with requests for records extends to those records that exist and are in the possession, custody, or control of the custodian of records at the time of the request. See G. L. c. 66, § 10(a)(ii). Given that the Commission is under no duty to create records in response to a request, the Commission has met its burden of responding to the requests for records other than the 911 audio file.

One Ashburton Place, Room 1719, Boston, Massachusetts 02108 * (617) 727-2832¢ Fax: (617) 727-5914 sec.state.ma.us/pre * pre@sec.state.ma.us

Mimi Brown, Esq. SPR18/627 Page 2 May 18, 2018

The Commission withheld the 911 call audio file, in its entirety, pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as it operates through Exemption (a), as well as Exemption (c) due to the patient’s identifying information, including medical

condition. As a result, S. Howey petitioned the Supervisor of Records and this appeal was opened.

The Public Records Law

The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26).

It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv) (written response must “identify any records, categories of records or portions of records that the agency or municipality intends to withhold, and provide the specific reasons for such withholding, including the specific exemption or exemptions upon which the withholding is based...”); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption).

The Commission’s May 3, 2018 response

The Commission’s May 3 response indicates that the 911 audio recording contains “Protected Health Information” (PHD) as defined by HIPAA, which would prevent the Commission from disclosing any PHI including a description of patients’ names and home addresses, medical conditions, dates of birth, and social security numbers. The Commission contends that without a signed patient authorization form or court order, health insurance information cannot be disclosed. Therefore, the Commission is withholding the 911 audio file pursuant to Exemption (a) of the Public Records Law.

Additionally, the Commission indicated that it withheld the 911 audio recording in its entirety under Exemption (c) because the record is a medical file of a personal nature and relates to a particular individual. The Commission contends that even redacted, the record would indirectly identify an individual due to the amount of information about the incident in the redacted 911 audio file and otherwise available on the internet through various media outlets and elsewhere.

Exemption (a)

Exemption (a), known as the statutory exemption, permits the withholding of records that are:

Mimi Brown, Esq. SPR18/627 Page 3 May 18, 2018

specifically or by necessary implication exempted from disclosure by statute

G.L. c. 4, § 7(26)(a).

A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public's right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977).

This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.”

The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities.

HIPAA

The statute that the Commission indicates applies to withhold any Protected Health Information (PHI) from the 911 audio file is the Privacy Rule of HIPAA, 42 U.S.C. 1320d and its Regulations, 45 CFR Parts 160 and 164. The Commission contends that it is prohibited from disclosing PHI, without patient authorization or court order or as may be permitted by the privacy rule.

Under 45 CFR 160.103, “individually identifiable information” means any information,including demographic information collected from an individual, that:

(a) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (b) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and— (i) identifies the individual; or (ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.

The Commission contends that HIPAA does not give the Commission discretion in releasing records containing PHI; therefore, the entire 911 audio file must be withheld. However, the privacy rule of HIPAA regarding PHI, would allow the Commission to disclose the 911

Mimi Brown, Esq. SPR18/627 Page 4 May 18, 2018

audio file where it can be “de-identified” to protect the personally identifiable information contained in the record. 45 CFR 164.514 relating to uses and disclosures of protected health information states:

(a) De-identification of protected health information: Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health insurance.

(b) Implementation specifications: Requirements for de-identification of protected health information. A covered entity may determine that health insurance is not individually identifiable health information...PHI includes many common identifiers, including but not limited to, an individual’s name, home address, birth date, Social Security Number and medical record number, when combined with health information.

45 CFR 164.514 (a), (b).

The Commission claims that there exists a reasonable basis to believe that releasing even redacted portions of the 911 audio file could be used to identify individuals. It is unclear from the Commission’s May 3” response how even with the individual’s protected health information redacted from the record, a requestor could still be able to identify the individual. Consequently, the Commission has not met its burden of specificity in claiming Exemption (a) to withhold the 911 audio file in its entirety. .

Exemption (c)

The Commission indicated it also withheld the responsive record pursuant to Exemption (c) because the 911 audio file contains “medical files or information.”

Exemption (c) of the Public Records Law permits the withholding of:

personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy

G.L.c. 4, § 7 (26)\(c).

This exemption contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432-33 (1983). The Commission indicates that the first clause, which creates a categorical exemption for personnel and medical information that relates to an identifiable individual and is of a “personal nature” applies to this request and record. Id. at 434. Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. School Comm. of Westport, 401 Mass. 306, 308 (1987); Globe Newspaper Co., 388 Mass. at 438. Generally, medical information will be of a sufficiently personal nature to warrant exemption. Globe

Mimi Brown, Esq. SPR18/627 Page 5 May 18, 2018

Newspaper Company, 338 Mass. at 432-34. There is a strong public policy in Massachusetts that

favors confidentiality as to medical data about a person’s body. Globe Newspaper Co. v. Chief Medical Examiner, 404 Mass. 132, 135 (1987).

The Commission has claimed that the 911 audio recording has been withheld in its entirety under the first clause of Exemption (c) due to any medical information contained in the record. The first clause of Exemption (c) will allow the Commission to withhold any medical information of a specifically named individual, so it is unclear whether the Commission could

redact the 911 audio recording to protect the medical information of the recipient of the medical care.

It is also uncertain whether it is necessary for the Commission to withhold the medical information, if the audio recording does not specifically identify or specifically name the individual who is the subject of the medical information. While the Commission indicates that it must withhold the record due to medical information and/or identifying information of the subject of the medical care or treatment, the Commission did not specifically demonstrate how the first clause of Exemption (c) would allow the Commission to withhold any portion of the recording containing the statements of the dispatcher, or a caller other than the individual who is the recipient of the medical care.

Therefore, | find that the Commission has not met its burden of demonstrating that the first clause of Exemption (c) allows the Commission to withhold the 911 audio file in its entirety.

Specificity in claiming exemptions; duty to segregate

I find the Commission has not met its burden of demonstrating that the 911 audio file is exempt, in its entirety, pursuant to HIPAA as it operates through Exemption (a) or under Exemption (c). See Reinstein v. Police Comm’r of Boston, 378 Mass. 281, 289-90 (1979) (the statutory exemptions are narrowly construed and are not blanket in nature). Pursuant to the Public Records Law, the burden shall be upon the custodian to prove with specificity how an exemption applies to withhold all the responsive records. See G. L. c. 66, § 10(b)(iv); see also Globe Newspaper Co. v. Police Comm’r, 419 Mass. 852, 857 (1995); Flatley, 419 Mass. at 511.

Under the Public Records Law, records custodians have a duty to segregate exempt material or content from public records, and provide the non-exempt portion of a public record. G. L. c. 66, § 10(a). In its response, the Commission must provide any non-exempt portions of the 911 audio file. If there are any fees associated with providing the record, a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2).

Conclusion

Accordingly, given that the Commission has not met its burden to withhold the 911 audio file in its entirety pursuant to Exemptions (a) and (c), and indicated that the record could be redacted to protect the personally identifying information including medical information, the

Mimi Brown, Esq. SPR18/627 Page 6 May 18, 2018

Commission is ordered to review the records, redact where necessary and provide the responsive 911 audio file to S. Howey in a manner consistent with this order, the Public Records Law, and its Regulations within ten business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. The Commission may request reconsideration of this determination within ten business days.

Sincerely,

filuwea Moma

Rebecca S. Murray Supervisor of Records

cc: S. Howey