Mark Barbadoro v. Department of Developmental Services (SPR 20181276)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records September 7,201 8 SPR1811276 Doreet Goldhaber Department of Developmental Services 500 Harrison Avenue Boston, MA 02 1 18 Dear Ms. Goldhaber: I have received the petition of Mark Barbadoro appealing the response of the Department of Developmental Services (DepartmentIDDS) to a request for public records. G. L. c. 66, 5 IOA; -see -also 950 C.M.R. 32.08(1). Specifically, on July 10,2018, Mr. Barbadoro requested "the addresses of and names of the companies that own dwelling in my city . . ." Previous appeal This request was the subject of a previous appeal. See SPRl811117 Determination of the Supervisor of Records (August 8,2018). In my August 8t" determination, finding that the Department had not met its burden to withhold responsive records under Exemptions (a) and (c) of the Public Records Law, I ordered the Department to provide Mr. Barbadoro with a response to the request, provided in a manner consistent with the order, the Public Records Law, and its Regulations. I also advised Mr. Barbadoro to clarify his public records request to enable the Department to respond appropriately. Following the August 8" determination, the Department provided a response to Mr. Barbadoro on August 22,2018 , based on Mr. Barbadoro's modified request for "[tlhe residential addresses of DDS licensed or certified group homes in Fitchburg, Massachusetts or documentation containing the names of persons or organizations that own or operate DDS licensed or certified group homes in Fitchburg, Massachusetts." The Department denied access to responsive records pursuant to Exemptions (a) and (c) of the Public Records Law. G. L. c. 4, 5 7(26)(a), (c). Unsatisfied with the Department's response, Mr. Barbadoro petitioned this office and this appeal, SPR1811276, was opened as a result. One Ashburton Place, Room 17 19, Boston, Massachusetts 02 108 (6 17) 727-2832. Fax: (6 17) 727-59 14 sec.state.ma.us/pre pre@sec.state.ma.us

Doreet Goldhaber Page 2 September 7,20 18 The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, fj 10A(d); 950 C.M.R. 32.03(4). "Public records" is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, fj 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, fj lO(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 51 1 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, fj lO(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Department's August 22ndr esponse In its August 22,2018 response, the Department indicates that pursuant to G. L. c. 19B, $ [I 1, it is "directed to 'take cognizance of all matters affecting the welfare of persons with an intellectual disability or persons with a developmental disability' within the Commonwealth." The Department also claims that the confidentiality of the Department's group home addresses and their exemption from disclosure under Exemption (c) of the Public Records Law has been upheld by the Massachusetts Superior Court in Hardiman vs. Mass. Dept. of Developmental Services, Mass. Super. Ct. No. 2014-01561-H (Mar. 3,2016). As such, the Department claims the records are exempt from disclosure pursuant to Exemptions (a) and (c) of the Public Records Law. Exemption (c) The Department claims it withheld responsive records pursuant to Exemption (c) of the Public Records Law. Exemption (c) permits the withholding of: personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy

Doreet Goldhaber Page 3 September 7,20 18 First clause of Exemption (c) medical - Exemption (c) contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432-34 (1983). The first clause creates a categorical exemption for personnel and medical information that relates to Id. an identifiable individual and is of a "personal nature." at 434. Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. School Comm. of Westport, 401 Mass. 306,308 (1987); Globe Newspaper Co., 388 Mass. at 438. Generally, medical information is sufficiently personal to warrant exemption. Globe Newspaper Co., 338 Mass. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person's body. Globe Newspaper Co. v. Chief Medical Examiner, 404 Mass. 132, 135 (1987). Under the first clause of Exemption (c), the Department contends that disclosing the addresses of its group homes or the names of group home owners or operators, may be used to identifl individuals living in the homes and result in the disclosure of their medical diagnoses. The Department explains that "[tlo be eligible to receive supports from DDS an individual must be domiciled in the Commonwealth, and must be a person with intellectual disability, . . . or developmental disability (i.e. a diagnosis of Autism Spectrum Disorder, Prader-Willi Syndrome, or Smith-Magenis Syndrome)." The Department asserts that because ". . . only individuals with intellectual or developmental disability ('IDIDD') are eligible for DDS supports, the disclosure of an individual's status as a DDS client is the equivalent of a disclosure of that person's medical diagnosis of Intellectual Disability, Autism Spectrum Disorder, Prader-Willi Syndrome, or Smith-Magenis Syndrome." As such, the Department contends that disclosing this information together "with other publicly available information, runs not just the risk -but the likelihood - that residents, and their medical diagnosis of [IDIDD], will be publicly disclosed." The Department also claims that every year, in accordance with G. L. c. 5 1, $5 4,6, the Board of Registrars in Massachusetts cities and towns must prepare "Street Lists" which identifies the names of residents, their address, birth year, and occupation. The Department explains that with this information it is easy to obtain the identities of individuals living at a particular address. The Department asserts that it has ". . . tangible proof the public disclosure of its group home addresses may be used to identify the residents living and receiving supports in these homes. As only individuals with IDIDD may live in a DDS group home, revealing the addresses of the homes is indistinguishable from a public disclosure of the medical diagnoses of the individuals identified as residing in these homes." The Department cites Hardiman, which held that disclosure of group home addresses constitute an indirect identification of the individuals residing in such homes, as well as a public disclosure of the individuals' medical diagnoses, to support its position. Hardiman, Mass. Super. Ct. at 6. The Department further asserts that disclosure of the addresses of the owners or operators of its group homes "within a particular municipality, in combination with publicly available Assessor's data, is highly likely to result in the public disclosure of DDS group home addresses and the identities of the residents living therein." The Department explains that because this

Doreet Goldhaber Page 4 September 7,2018 information is publicly available, if an individual possesses the names of individuals or entities owning or operating its group homes, such information can easily be entered into the City's online database to instantly identify the residential properties such entity owns. Consequently, the Department contends that its "identification of group home owners or operators within a specific town would allow a person who obtains this information to consult the online assessor's information to identify group home addresses owned by such entities, which, in turn is the equivalent of a public disclosure of the names of group home residents and their medical diagnoses." Second clause of Exemption (c) -privacy Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public's right to know against the relevant privacy interests at stake. Torres v. Attorney Gen., 391 Mass. 1, 9 (1984); Attorney Gen. v. Assistant Comm'r of Real Property Dep't, 380 Mass. 623,625 (1980). Therefore, determinations must be made on a case by case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep't of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family Id. disputes and reputation. at 292 n. 13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415,427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 29 1. The public has a recognized interest in knowing whether public servants are carrying out their duties Id. in a law-abiding and efficient manner. at 292. Under the second clause of Exemption (c), the Department claims that disclosure of the information would result in personal embarrassment to an individual of normal sensibilities because "[ilnformation concerning an individual's diagnosis of IDIDD specifically indicates an individual has significantly sub-average intellectual functioning (low IQ), significant limitations in adaptive functioning or severe functional limitations, such as the need for assistance in self- care, dressing, eating, toileting, and other daily activities. This information is of highly personal nature to them and exempt from disclosure . . ."

Doreet Goldhaber Page 5 September 7,20 18 Exemption (a) The Department further claims that disclosure of the information is also exempt under the following statutes and regulations, as they operate through Exemption (a) of the Public Records Law. The Department cites G. L. c. 66A, the Fair Information and Practices Act (FIPA); 42 U.S.C. 1320d, et seq., the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations 45 C.F.R. Parts 160 and 164; and its statute and regulations, G. L. c. 123B, $17; 115 C.M.R. 4.03; and 115 C.M.R. 4.06. Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public's right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 15 1, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either "shall not be a public record," "shall be kept confidential" or "shall not be subject to the disclosure provision of the Public Records Law." The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records \to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. The Department cites certain regulations of HIPAA, 45 C.F.R. 164.514(b)(2)(B) and 45 C.F.R. 164.5 14(b)(l)(i), to support its position to withhold responsive records. One of the regulations permit the withholding of: All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.

Doreet Goldhaber Page 6 September 7,20 18 45 C.F.R. 164.514(b)(2)(B). HIPAA also permits the disclosure of de-identified health information, if after applying the de-identified principles and methods, the covered entity . . . determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information. 45 C.F.R. 164.514(b)(l)(i). Under its Exemption (a) claim, the Department indicates that as a health care provider, it is a HIPAA covered entity and therefore must comply with the provisions of HIPAA prohibiting the disclosure of protected health information (PHI). The Department asserts that "[aln individual's status as a resident in a DDS group home is PHI as it relates to the 'past, present, or future physical or mental health or condition of an individual.' . . . [It] is also indicative of the habilitative care and treatment that individuals receive in such settings, and clearly relates to the 'past, present, or future physical or mental health or condition' of an individual." The Department explains that HIPAA included residential addresses as an identifying component of health information requiring the removal of all geographic information smaller than state in order for the information to be considered not individually identifiable health information. The Department explains that HIPAA permits the disclosure of de-identified health information only "if after applying de-identification methods the covered entity 'determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information . . . to identify an individual who is a subject of the information.' 45 C.F.R. 164.51 4(b)(l)(i)." Consequently, the Department asserts that the requested information is exempt from disclosure because, "disclosing as it would the names and medical diagnoses of individuals living in DDS group homes, constitutes PHI pertaining to specific individuals. . . ." The Department also indicates that disclosure of the requested information, which would confirm the identities of individuals living in its facilities are also exempt under its statute, G. L. c. 123B, fj 17, and regulations, 115 C.M.R. 4.03; 406, which protects clients' records. The Department claims that "[ajn individual's name and status as a DDS client discloses personal information about them and their medical diagnoses. This information is maintained in the individual's client record . . . and is confidential." The Department claims that its statute requires such records to be private and not open to the public. The statute and regulations provide in pertinent part: The department shall keep records of the admission, treatment and periodic review of all persons admitted to facilities under its supervision. Such records shall be private and not open to public inspection except (1) upon proper judicial order whether or not in connection with pending judicial proceedings, (2) that the commissioner shall allow the attorney of a patient or resident to inspect records of

Doreet Goldhaber Page 7 September 7,201 8 said patient if requested to do so by the patient, resident or attorney, and (3) that the commissioner may permit inspection or disclosure when in the best interest of the patient or resident as provided in the rules and regulations of the department. This section shall govern the patient records of the department notwithstanding any other provision of law. Access to Records and Record Privacy (2) Inspection by Other Persons. Records of an individual shall be private and not open to inspection by third parties, other than those in 115 CMR 4.06(1)), except as provided in 1 15 CMR 4.06(2). (a) Records shall be open to inspection by a third party upon informed consent by the individual or guardian: 1. Before consent is obtained, the individual or guardian shall be afforded an opportunity to examine the records to be released, and shall be provided with the name of the recipient, possible uses of the information, and possible risks and benefits of, and alternatives to disclosure. 2. A record of such authorization shall be included in the individual's record. 115 C.M.R4.. 06(2)(a). Fair Information Practices Act (FIPA) FIPA, which imposes restrictions on the dissemination of "personal data," reads in pertinent part that the holder maintaining personal data shall: not allow any other agency or individual not employed by the holder to have access to personal data unless such access is authorized by statute or regulations which are consistent with the purposes of this chapter or is approved by the data subject whose personal data are sought if the data subject is entitled to access under clause (i). In support of its position to withhold records, the Department asserts that "[rlecords or information pertaining to individuals' medical diagnoses is clearly personal data that is protected by FIPA." The Department states that it has indicated that disclosure of the requested information would also disclose the medical diagnoses of persons living in its facilities. As such, the Department asserts that whereas such information is exempt from disclosure under Exemption (c), and further exempt by HIPAA and DDS's statute and regulations through Exemption (a), FIPA should also apply to protect this information from disclosure.

Doreet Goldhaber Page 8 September 7, 20 18 Burden of speczj?ci@ The Department indicates that to be eligible to reside in its facilities, an individual must have an intellectual or developmental disability. The Department asserts that because only individuals with intellectual or developmental disability are eligible for its supports, disclosure of an individual as a DDS client would serve to disclose the person's medical diagnosis. The Department further posits that disclosing the addresses of its group homes or the addresses of organizations that own or operate its facilities, would lead to the disclosure of the medical diagnoses of its clients due to the availability of information from its annual Street List and Assessor's data which can be easily accessed on its website. The Department explains that anyone who possesses this information can easily match the information obtained with the Street List or the Assessor's data, to determine the names of the individuals who reside in these facilities. Consequently, the Department contends that this would result in the indirect identification of the medical information and other data relating to specifically named individuals. In light of the foregoing, I find the Department has met its burden to withhold responsive records pursuant to the first clause of Exemption (c). Accordingly, I decline to opine on the Department's second clause of Exemption (c) and Exemption (a) claims supporting non- disclosure of the requested records. Despite my finding that the Department has met its burden under Exemption (c) and may permissibly withhold responsive records from disclosure, the Department and Mr. Barbadoro are encouraged to communicate further to enable the Department to address his concerns. Whereas Mr. Barbadoro is the Building Commissioner of the City of Fitchburg and has a public safety interest in this matter, he may have a greater right of access to this information outside of the Public Records Law. Conclusion Accordingly, I will now consider this administrative appeal closed. Sincerely, V Rebecca S. Murray Supervisor of Records cc: Mark Barbadoro