S. Howey v. Boston Public Health Commission (SPR 20191204)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supen•isor ofR ecords July 1, 2019 SPR19/1204 Batool Raza, Esq. Assistant General Counsel Office of the General Counsel Boston Public Health Commission 1010 Massachusetts A venue Boston, MA 021 l 8 Dear Attorney Raza: I have received the petition of S. Howey appealing the response of the Boston Public Health Commission (Commission) to a request for public records. G. L. c. 66, § 1O A; see also 950 C.M.R. 32.08([). Specifically, on April 30, 2019, S. Howey requested copies of". .. all Computer Aided Dispatch Transcripts (CADs), Calls For Service Reports, all incident reports, all bills, all police reports, all audio files for 911 calls, all log book entries, all documents and all 911 documents petiaining to [a specified address] from April 1, 2018 to the present." Previous appeal The requested records were the subject of a previous appeal. See SPRl 9/995 Determination of the Supervisor of Records (May 31, 2019). In my May 3151 determination I found that the Commission had not met its burden to withhold responsive records, in their entirety, under Exemption (a) and the second clause ofExemption (c). Accordingly, I ordered the Commission to review the records, redact where necessary and provide S. Howey with responsive records, provided in a manner consistent with the order, the Public Records Law, and its Regulations. Following the May 31st determination, the Commission responded on June 14, 2019, providing additional information regarding its position to withhold responsive records from disclosure, pursuant to Exemptions (a) and (c) of the Public Records Law. G. L. c. 4, § 7(26)(a), (c). Unsatisfied with the Commission's response, S. Howey petitioned this office and this appeal, SPRl 9/1204, was opened as a result. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre• pre@sec.state.ma.us

Batool Raza, Esq. SPR19/1204 Page2 July 1, 2019 The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § IOA(d); 950 C.M.R. 32.03(4). "Public records" is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 1O (b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507,511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 1 O(b )(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Commission's June 14'" response In its June 14, 2019 response, the Commission reiterates that it possesses" ... a CAD sheet, a Patient Care Report ('PCR'), and a 911 call recording. The CAD sheet is created to track EMS responses. It includes the fields needed to coordinate and document dispatch operations including but not limited to, date, time added, time dispatched, time arrived, time closed, call taker ID, event ID, caller name, caller phone number, caller location, location information, event type, and type of call." The Commission further states that "[t]he PCR is an electronic medical record to document the treatment EMS staff provides to the patient when it responds to calls. This contains several drop-down fields and narrative sections used to document patient care. Finally, EMS also has in its possession audio recording of the 911 calls made from [a specified address]." The Commission asse1ts that "[t]hese reports and recordings are confidential because they contain medical records protected by law," and cites Exemptions (a) and (c). Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public's right to inspect records under the Public Records Law is

Batool Raza, Esq. SPR19/1204 Page 3 July l, 2019 restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Comt, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either "shall not be a public record," "shall be kept confidential" or "shall not be subject to the disclosure provision of the Public Records Law." The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. Under its Exemption (a) claim, the Commission posits that because it is a covered entity under HIPAA, it is prohibited "from disclosing Protected Health Information ('PHI') without a valid patient authorization form or court order." The Commission indicates that "[u]nder HIP AA, the definition of PHI means individually identifiable health information transmitted or maintained in any form or medium. See 45 CFR 160.103." The Commission explains that "[i]ndividually identifiable health information includes demographic information that is created or received by a health care provider and that which relates to the individual's past, present, or future physical or mental health or condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or.for which there is a reasonable basis to believe the information can be used to identify the individual (emphasis added). Id." The Commission states that "PHI includes many common identifiers, including, but not limited to, an individual's name, address, birth date, Social Security Number and medical record number when combined with health information." The Commission posits that "[bJ ased on the current definition of PHI and the de identification standard, the time and date of the call, the reason for the call, and the nature of the call are all presumed by federal law to constitute information that can potentially be used to identify a patient and therefore are subject to protection. A broad range of categories of information are deemed protected by federal regulation because they could reveal the patient's medical condition, even without the disclosure of an individual's name or gender." The Commission further states that"[s Jimilarly, incident numbers used by Boston EMS are not randomized numbers, but in fact use a combination of the date and time of the incident. U.S. Depaitment of Health and Human Services regulations state that all elements of date are considered PHI. Furthermore, 'any other unique identifying number, characteristic, or code' is also considered PHI. Therefore, these data fields are also protected from disclosure under federal regulation. 45 C.F.R. § 164.514(b)." Regarding the de-identification of the records, the Commission states that" ... the de identification standard under HIP AA requires either an expe1t determination method (See 45

Batool Raza, Esq. SPR19/1204 Page4 July 1, 2019 CPR 164.514(b)(l)), or the Safe Harbor method (See 45 CPR 164.514(b)(2)). The U.S. Depaitment of Health and Human Services regulations define de-identified health information as information that neither identifies nor provides a reasonable basis to identify an individual." The Commission contends that "[p ]er the Massachusetts Public Records Law, [it] is under no obligation to hire a statistician to perform the specialized analysis necessary to generate a de identified data set for [S. Howey] under 45 CPR 164.514(b)(l). The Safe Harbor method (per 45 CPR 164.514(b)(2)) requires the removal of specified identifiers of the individual and of the individual's relatives, household members, and employers, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual. This level of de-identification effectively excludes all information currently recorded by Boston EMS in its system." The Commission asserts that " ... even a redaction of a health record to meet the de identification standard could still compromise patient confidentiality where any portion of the record could be used, in connection with other publicly available information, to identify the patient. The Commission has reason to believe that, because of the paiticularly sensitive information at hand, disclosure of any pottion would almost certainly violate federal law and could lead to identification of the individuals." The Commission fmther asserts that" ... given the recent attention on the issue of female health, and the ways in which the public is using individuals' private information to track and harass those receiving treatment at various Planned Parenthood facilities across the nation, the Commission expects there to be significant media attention to its response[,]" and states that S. Howey has already posted the Commission's initial response online. Exemption (c) Exemption (c) of the Public Records Law permits the withholding of: personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy G. L. c. 4, § 7(26)(c). First clause ofE xemption (c) - medical Exemption (c) contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432-33 (1983). The first clause, relevant to this determination, creates a categorical exemption for persom1el and medical information that relates to an identifiable individual and is of a "personal nature." Id. at 434. Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. School Comm. of Westport, 401 Mass. 306,308 (1987); Globe Newspaper Co., 388 Mass. at 438. Generally, medical information will be of a

Batool Raza, Esq. SPR19/1204 Page 5 July 1, 2019 sufficiently personal nature to warrant exemption. Globe Newspaper Co., 338 Mass. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person's body. Globe Newspaper Co. v. Chief Med. Examiner, 404 Mass. 132, 135 (1987). Under the first clause of Exemption (c), the Commission, citing the Globe, Wakefield, and Logan decisions to support its position, asse11s that aside from the records being medical records, " ... there is a grave risk that the requested records, even redacted, would indirectly identify an individual. If, for example, the Commission were to redact the individuals' names, their medical condition, and the street number of their location, there is still enough pertinent information to identify the individual, including the precise location of the call and the date and time the call was made ...." Second clause ofE xemption (c) - privacy Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public's right to know against the relevant privacy interests at stake. Torres v. Attorney Gen., 391 Mass. 1, 9 (1984); Attorney Gen. v. Assistant Comm'r of Real Property Dep't, 380 Mass. 623,625 (1980). Therefore, determinations must be made on a case by case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep't of Agric. Res., 477 Mass. 280,292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415,427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292. Under the second clause of Exemption (c ), the Commission asserts that the records are medical records therefore, it need not provide information regarding the balancing test under the second clause. However, it contends that" ... even if these records are not considered medical records it is the Commission's position that disclosure of this information would constitute an

Batool Raza, Esq. SPR19/1204 Page 6 July I, 2019 unwarranted invasion of personal privacy, and hence is exempt from disclosure pursuant to the exemption's second clause as well." The Commission asserts that" ... the information sought contains 'intimate details' about the individuals because it is directly related to the medical care and treatment they received while at Planned Parenthood. Furthermore, this information could reveal the identity of these individuals and their protected past and present medical information." The Commission asserts that " ... the withheld information is not available from other sources and its disclosure may lead to public embarrassment to these individuals." With respect to the balancing test, the Commission states that "[S. Howey's] interest is not in knowing whether Boston EMS provided adequate care to the individuals transported, but rather in knowing details about Planned Parenthood and the safety of the treatment they provide . . . ." Therefore, [S. Howey's] interest in this case is not outweighed by the individuals' interest in keeping their identity and medical information confidential." In camera inspection In order to facilitate a determination as to the applicability of the Commission's exemption claims, the Commission must provide this office with un-redacted copies of a representative sample of the responsive records for in camera inspection. See 950 C.M.R. 32.08(4 ). After I complete my review of the document, I will return the record to your custody and issue an opinion on the public or exempt nature of the record. The authority to require the submission of records for an in camera inspection emanates from the Code of Massachusetts Regulations. 950 C.M.R. 32.08(4 ); see also G. L. c. 66, § 1. This office interprets the in camera inspection process to be analogous to that utilized by the judicial system. See Rock v. Massachusetts Comm'nAgainst Discrimination, 384 Mass. 198, 206 (1981) (administrative agency entitled deference in the interpretation of its own regulations). Records are not voluntarily submitted, but rather are submitted pursuant to an order by this office that an in camera inspection is necessary to make a proper finding. Records are submitted for the limited purpose of review. This office is not the custodian of records examined in camera, therefore, any request made to this office for records being reviewed in camera will be denied. See 950 C.M.R. 32.08(4 )(c ). This office has a long history of cooperation with governmental agencies with respect to in camera inspection. Custodians submit copies of the relevant records to this office upon a promise of confidentiality. This office does not release records reviewed in camera to anyone under any circumstances. Upon a determination of the public record status, records reviewed in camera are promptly returned to the custodian. To operate in any other fashion would seriously impede our ability to function and would ce1tainly affect our credibility within the legal community.

Batool Raza, Esq. SPR19/1204 Page 7 July 1, 2019 Order Accordingly, the Commission is ordered to provide this office with un-redacted copies of a representative sample of the responsive records for in camera inspection without delay. The Commission may provide this office with an explanation of its position regarding the applicability of an exemption to the responsive records. Please be advised that, unlike the materials provided for in camera inspection, any such additional correspondence would be placed in the file for this appeal and would be subject to public disclosure as a public record. Sincerely, ~n~ Supervisor of Records cc: S. Howey