S. Howey v. Boston Public Health Commission (SPR 20190995)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor ofR ecords May 31, 2019 SPR19/995 Batool Raza, Esq. Assistant General Counsel Office of the General Counsel Boston Public Health Commission 1010 Massachusetts A venue Boston, MA 02118 Dear Attorney Raza: I have received the petition of S. Howey appealing the response of the Boston Public Health Commission (Commission) to a request for public records. G. L. c. 66, § lOA; see also 950 C.M.R. 32.08(1). Specifically, on April 30, 2019, S. Howey requested copies of" ... all Computer Aided Dispatch Transcripts (CADs), Calls For Service Reports, all incident reports, all bills, all police reports, all audio files for 911 calls, all log book entries, all documents and all 911 documents pertaining to [a specified address] from April 1, 2018 to the present." The Commission responded on May 14, 2019, denying access to responsive records pursuant to Exemptions (a) and (c) of the Public Records Law. G. L. c. 4, § 7(26)(a), (c). Unsatisfied with the Commission's response, S. Howey petitioned this office and this appeal, SPR19/995, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § IOA(d); 950 C.M.R. 32.03(4). "Public records" is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § IO(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre• pre@sec.state.ma.us

Batool Raza, Esq. SPR19/995 Page 2 May 31, 2019 If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 1O (b )(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Commission's May 14th response In its May 14, 2019 response, the Commission lists the dates the Boston Emergency Medical Services (EMS) responded to the specified address and indicates that the Boston EMS created" ... a CAD sheet, a Patient Care Report ('PCR'), and 911 recordings ...." The Commission explains that "[t]he CAD sheet is created to track EMS responses. This includes the fields needed to coordinate and document dispatch operations including but not limited to, date, time added, time dispatched, time arrived, time closed, call taker ID, event ID, caller name, caller phone number, caller location, location information, and event type." The Commission further explains that "[t]he PCR is an electronic medical record to document the treatment EMS staff provides to the patient when it responds to calls. This contains several drop-down fields and narrative sections used to document patient care. Finally, EMS also has in its possession audio recording of the 911 calls made from [the specified address]." The Commission asserts that "[t]hese reports and recordings are confidential because they contain medical records protected by law." The Commission claims the following exemptions to withhold responsive records from disclosure. Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, §7 (26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public's right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either "shall not be a public record," "shall be kept confidential" or "shall not be subject to the disclosure provision of the Public Records Law." The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit

Batool Raza, Esq. SPR19/995 Page 3 May 31, 2019 access to the listed individuals or entities. Under its Exemption (a) claim, the Commission posits that because it is a covered entity under HIP AA, it is prohibited "from disclosing Protected Health Information ('PHI') without a valid patient authorization form or court order." The Commission indicates that "[u]nder HIPAA, the definition of PHI means individually identifiable health information transmitted or maintained in any form or medium. See 45 CPR 160.103." The Commission explains that "[i]ndividually identifiable health information includes demographic information that is created or received by a health care provider and that which relates to the individual's past, present, or future physical or mental health or condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe the information can be used to identify the individual ( emphasis added). Id." The Commission states that "PHI includes many common identifiers, including, but not limited to, an individual's name, address, birth date, Social Security Number and medical record number when combined with health information." With respect to whether records can be redacted, the Commission states that "[s]ince PHI is broadly defined as that which could potentially be used to identify a patient, the disclosure of nearly any portion of a health record document could inadvertently violate Federal law. In effect, even a redaction of a health record to meet the de-identification standard could still compromise patient confidentiality where any portion of the record could be used, in connection with other publicly available information, to identify the patient." The Commission asserts that it" ... has reason to believe that, because of the particularly sensitive information and the amount of information about the incident(s) at this location made available on the Internet, disclosure of any portion would almost certainly violate Federal law." The Commission also states that" ... Massachusetts law, M.G.L. c. 4, §7(26)(a), protects from disclosure any information 'specifically or by necessary implication exempted from disclosure by statute.' ... [T]he primary purpose of HIP AA' s Privacy Rule is to protect the confidentiality of health records and health information, so HIP AA clearly constitutes a statute that specifically exempts disclosure of health records, such as those requested here. The Privacy Rule also creates a necessary implication that records including PHI must only be disclosed under specific circumstances i.e. under a valid patient authorization or court order." The Commission claims that there exists a reasonable basis to believe that releasing even redacted portions of the responsive records to meet the de-identification standard "could still compromise patient confidentiality where any portion of the record could be used, in connection with other publicly available information, to identify the patient." 45 C.F.R. 164.514 relating to uses and disclosures of protected health information states: (a) De-identification of protected health information: Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually

Batool Raza, Esq. SPR19/995 Page4 May 31, 2019 identifiable health information. (b) Implementation specifications: Requirements for de-identification of protected health information. A covered entity may determine that health information is not individually identifiable health information .... PHI includes many common identifiers, including but not limited to, an individual's name, home address, birth date, Social Security Number and medical record number, when combined with health information. 45 C.F.R. 164.514 (a), (b). Based on the Commission's response, it remains unclear how even with the individual's protected health information redacted from the record, a requestor could still be able to identify the individuals involved. Consequently, I find the Commission has not met its burden of specificity in claiming Exemption (a) to withhold the responsive records in their entirety. Exemption (c) Exemption ( c) of the Public Records Law permits the withholding of: personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy G. L. c. 4, § 7 (26)(c). First clause ofE xemption (c) - medical Exemption ( c) contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432-33 (1983). The first clause, relevant to this determination, creates a categorical exemption for personnel and medical information that relates to an identifiable individual and is of a "personal nature." Id. at 434. Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. School Comm. of Westport, 401 Mass. 306,308 (1987); Globe Newspaper Co., 388 Mass. at 438. Generally, medical information will be of a sufficiently personal nature to warrant exemption. Globe Newspaper Co., 338 Mass. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person's body. Globe Newspaper Co. v. Chief Med. Examiner, 404 Mass. 132, 135 (1987). Second clause ofE xemption (c) - privacy Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public's right to know against the relevant privacy interests at stake. Torres v. Attorney Gen., 391 Mass. 1, 9 (1984); Attorney Gen. v. Assistant Comm'r of Real Property

Batool Raza, Esq. SPR19/995 Page 5 May 31, 2019 Dep't, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case by case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep't of Agric. Res., 477 Mass. 280,292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415,427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292. Under its Exemption ( c) claim, the Commission indicates that the responsive records are exempt from disclosure because" ... such documents constitute 'medical files or information' and 'materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy.' M.G.L. c. 4, §7(26)(c)." Based on the Commission's claim, to the extent that the records contain medical information, the Commission may permissibly withhold such portions from disclosure. However, the Commission has not demonstrated that the records, in their entirety, are intimate details of a highly personal nature. Particularly, it is unclear how dates of birth, statements from the dispatcher within the 911 audio recording, date, time of dispatch, time arrived or time closed, are intimate details of a highly personal nature nor how disclosure would result in personal embarrassment to an individual of normal sensibilities. It is additionally uncertain whether any of the information is available from other sources. PETA, 4 77 Mass. at 292. Also, the Commission did not provide additional information with respect to the balancing test set out in the second clause of Exemption ( c) , which examines whether the public interest in obtaining the requested information outweighs the seriousness of any invasion of privacy. The Commission must clarify these issues. Further, I find the Commission has not met its burden of demonstrating that the responsive records, in their entirety, are exempt pursuant to HIP AA as it operates through Exemption (a) or under Exemption (c). See Reinstein v. Police Comm'r of Boston, 378 Mass. 281, 289-90 (1979) (the statutory exemptions are narrowly construed and are not blanket in

Batool Raza, Esq. SPR19/995 Page 6 May 31, 2019 nature). Any non-exempt, segregable portion of a public record is subject to mandatory disclosure. G. L. c. 66, § 1O (a). I understand a Public Records Division staff attorney contacted your office about this appeal. Conclusion Given that the Commission has not met its burden to withhold responsive records, in their entirety, pursuant to Exemptions (a) and (c), the Commission is ordered to review the records, redact where necessary and provide S. Howey with responsive records, provided in a manner consistent with this order, the Public Records Law, and its Regulations within ten business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. The Commission may file a request for reconsideration of this determination within ten business days of the date of this determination letter. Sincerely, Rebecca S. Murray Supervisor of Records cc: S. Howey