Evan Allen v. Boston Public Health Commission (SPR 20190737)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor ofR ecords April 23, 2019 SPR19/737 Batool Raza, Esq. Assistant General Counsel Boston Public Health Commission 1010 Massachusetts A venue, 6th Floor Boston, MA 02118 Dear Attorney Raza: I have received the petition of Evan Allen of the Boston Globe appealing the response of the Boston Public Health Commission (Commission) to a request for public records. G. L. c. 66, § lOA; see also 950 C.M.R. 32.08(1). Specifically, Ms. Allen requested "all EMS responses to 240 Southampton Street from Jan. 1, 2015 until present. I'm not sure what information is included in your logs, but ideally I'd like time and date of call, identity of person who called you, reason for call, patient information (I realize name won't be included here obviously but gender/age), and disposition of the call (treated at scene, transported to hospital, refused treatment, etc.) would be great. Also, if incident reports were generated, the incident report numbers that go with the call." The Commission responded on March 26, 2019 by providing certain information, but withholding records related to individual calls under Exemptions (a) and (c) of the Public Records Law. G. L. c. 4, § 7(26)(a), (c). The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 1O A( d); 950 C.M.R. 32.03(4 ). "Public records" is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 1O (b )(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) ( custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre• pre@sec.state.ma.us

Batool Raza, Esq. SPR19/737 Page 2 April 23, 2019 Appeal In its March 26th response the Commission provided the number of calls per year to the address referenced in the request. However, the Commission declined to produce additional information, asserting that "[a]ny information related to individual calls would constitute a violation of state and federal law, which prohibit the disclosure of confidential medical infolmation without a valid patient authorization form or court order." The Commission cites Exemptions ( a) and (c ) in support of its position. In her appeal petition Ms. Allen indicates "I accept that the identity of the caller, and the age and gender of the patient are protected information. However, I wish to appeal the contention that the time and date of call, the reason for the call, the disposition of the call, and related incident numbers are protected." Exemption (a) The Commission cites the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as it operates through Exemption (a) of the Public Records Law. Exemption (a), known as the statutory exemption, permits the withholding ofrecords that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public's right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). ' This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either "shall not be a public record," "shall be kept confidential" or "shall not be subject to the disclosure provision of the Public Records Law." The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities.

Batoo.l Raza, Esq. SPR19/737 Page 3 April 23, 2019 In its March 26th response the Commission asserts that HIP AA " ... prohibits covered entities, of which the Commission is one, from disclosing protected health information ('PHI') excepting a valid patient authorization form or court order. Under HIPAA, the definition of PHI means individually identifiable health information transmitted or maintained in any form or medium. See 45 CFR 160.103." The Commission indicates "PHI is broadly defined as that which could potentially be used to identify a patient, therefore, the disclosure of nearly any portion of a health record document could inadvertently violate Federal law. In effect, even a redaction of a health record to meet the de-identification standard could still compromise patient confidentiality where any portion of the record could be used, in connection with other publicly available information, to identify the patient." You note that "[t]he Commission has reason to believe that, because of the particularly sensitive information and the amount of information about the incident(s) at this location made available on the Internet, disclosure of any portion would almost certainly violate Federal law." The Commission continues by indicating" ... the fact that a covered entity has performed health care services at a specific location constitutes PHI, as geographies are included in the federal definition of protected information and therefore, are protected by HIP AA and Exemption (a) and (c)." You further assert "[t]herefore, any information about the call to 911, including but not limited to, the time, date and location of individual calls, the identity of the person or persons who called, and the reason for the calls falls under PHI and cannot be disclosed by BPHC. There is a reasonable basis to believe that this information could be used to identify the individual and/or his/her present or past medical condition. Additionally, incident report numbers are specifically unique to the individual being treated, therefore they are also PHI and undisclosable." In her appeal petition Ms. Allen asserts that the Commission" ... does not specifically lay out what fields within the log are being denied. I requested the logs in their entirety, not just the fields that I suspect they contain, and the Commission did not address this gap." She also notes she "[t]he Globe is not asking for names, addresses, birth dates, social security numbers, or medical record numbers of patients treated at or transported from 240 Southampton Street" and asserts "[t]he information the Globe is seeking is not protected by HIP AA because it does not meet the requirement that the patient be identifiable. Therefore, it is [] not protected by MGL Exemption A." Exemption (c) Exemption ( c) of the Public Records Law permits the withholding of: personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy G. L. c. 4, § 7 (26)(c).

Batool Raza, Esq. SPR19/737 Page 4 April 23, 2019 First clause ofE xemption (c) - medical Exemption ( c) contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432-33 (1983). The first clause, relevant to this determination, creates a categorical exemption for personnel and medical information that relates to an identifiable individual and is of a "personal nature." Id. at 434. Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. School Comm. of Westport, 401 Mass. 306,308 (1987); Globe Newspaper Co., 388 Mass. at 438. Generally, medical information is sufficiently personal to warrant exemption. Globe Newspaper Company, 338 Mass. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person's body. Globe Newspaper Co. v. Chief Medical Examiner, 404 Mass. 132, 135 (1987). The Commission asserts that " ... the requested information is exempt from disclosure under Massachusetts law because such documents constitute 'medical files or information' and 'materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy.' M.G.L. c. 4, §7(26)(c)." In her appeal petition Ms. Allen indicates "[t]he Globe does not object to the Commission withholding the name of the caller, the name of the patient, or the gender/age of the patient. Because the patient is thus unnamed and unidentified in the version of the logs I am seeking, the logs would not permit the identification of the victim, and thus would not constitute exempt medical files or information under M.G.L. chapter 4, section 7, cl. 26th (c)." Ms. Allen also mentions that she is seeking the same type of information EMS publicizes on its public twitter account. The Commission's April 18, 2019 response Subsequent to the opening of this appeal the Commission provided a supplemental response on April 18, 2019. In this response the Commission included a list of the fields that are recorded by its Computer-Aided Dispatch ("CAD") system to track EMS responses. You indicate that"[d ]ue to the way PHI is defined in HIP AA, and explained in detail below, all the information recorded in these fields is protected from disclosure since it could potentially be used to identify an individual and his/her past or present medical condition." The Commission also provides additional information regarding its arguments under Exemptions (a) and (c). In light of the Commission's April 18th supplemental response that provides additional information regarding its CAD system and exemption claims, I will consider this appeal closed. Ms. Allen may appeal the substantive nature of the Commission's response within 90 days. See 950 C.M.R. 32.08(1).

Batool Raza, Esq. SPR19/737 Page 5 April 23, 2019 Sincerely, ~~· Rebecca S. Murray Supervisor of Records cc: Evan Allen