Kevin Sherlock v. Boston Public Health Commission (SPR 20191974)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division

Rebecca S. Murray Supervisor of Records

October 11, 2019 SPR19/1974

Batool Raza, Esq.

Assistant General Counsel

Boston Public Health Commission Office of General Counsel Boston, MA 02118

Dear Attorney Raza:

I have received the petition of Kevin Sherlock appealing the response of the Boston Public Health Commission (Commission) to a request for public records. G. L. c. 66, § 10A; see also 950 C.MLR. 32.08(1). Specifically, on June 12, 2019, Mr. Sherlock requested “a list of service (fire, alarm, ambulance, emergency medical services) from January 1, 2010 or from the

_ start of your department’s computerized database (whichever is earlier) to the present (the day

your department processes this request), for the following address...” Mr. Sherlock indicated that a CAD spreadsheet or printout would satisfy his request if it contains “date and time of each incident, type of incident, and outcome and notes.” Mr. Sherlock also requested “. . . an explanation for any codes or abbreviations used on the list of all calls for service[, r and mentions that he does not prefer personal information.

After being denied the above request, on » June 27, 2019, Mr. Sherlock amended his original public records request and requested “. . . a list by date only from 1/1/2010 to the present on EMS calls to the address in question...? If not, . .. a number of how many EMS calls have taken place at the address in question .. . each year from 2010 to the present[.]” The Commission provided a response on July 30, 2019, denying access to responsive records pursuant to Exemptions (a) and (c) of the Public Records Law. G. L. c. 4, § 7(26)(a), (c). Unsatisfied with the Commission’s response, Mr. Sherlock petitioned this office and this appeal, SPR19/1974, was opened as a result. While this appeal was pending, the Commission provided a supplemental response dated October 7, 2019.

The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all

governmental records are public records. G. L. c. 66, § 10A(d); 950 C.MLR. 32.03(4). “Public records” is: broadly defined to include all documentary materials or data, regardless of physical

One Ashburton Place, Room 1719, Boston, Massachusetts 02108 * (617) 727-2832* Fax: (617) 727- 5914 sec. state. ma. us/pre * pre@sec.state.ma.us

Batool Raza, Esq. SPR19/1974 Page 2 October 11, 2019

form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26).

It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass, 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record.

If there are any fees associated with a response a written, good faith estimate must be provided, G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. ;

The Commission’s July 30" response

In its July 30, 2019 response, the Commission indicates that it is “. . . unable to provide any information [it] records during its provision and care of patients because of the sensitive nature of the information.” The Commission posits that because it is a covered entity under HIPAA, it is prohibited “from disclosing Protected Health Information without a valid | patient authorization form or court order.”

The Commission also states that the requested information is exempt under Exemption (c), because “. . . it constitutes ‘medical files or information’ and ‘materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy.’ ...”

The Commission’s October 7™ supplemental response

In its October 7, 2019 response, the Commission reiterates that as a covered entity under HIPAA, “. . . information it (and Boston EMS) collects is considered protected health information (‘PHI’) and is subject to the protections afforded under HIPAA. Therefore, redacting patient names is not sufficient de-identification, per HIPAA, to release this information.”

The Commission contends that Mr. Sherlock’s “. . . request for the number of times EMS has responded to the address . . . is not a public records request but rather a question since it does not request any records or documents. Therefore, it is not subject to the protections and privileges associated with a public records request.” The Commission explains that because “CAD sheets ... are privileged and protected not only under federal law (HIPAA) but also under the Massachusetts Public Records law per exemption (c)[,]... [it] .. . can only provide an explanation of codes or abbreviations . .. to Mr. Sherlock . . .” and provides this record. The Commission claims the rest of the requested records are exempt under Exemptions (a) and (c).

Batool Raza, Esq. SPR19/1974 Page 3 October 11, 2019

Exemption (a)

Exemption (a), known as the statutory exemption, permits the withholding of records that are:

specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a).

A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). .

This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.”

The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities.

Under Exemption (a), the Commission indicates that “[u]nder HIPAA, the definition of PHI means individually identifiable health information transmitted or maintained in any form or medium. See 45 CFR 160.103.” The Commission explains that “[i]ndividually identifiable health information includes demographic information that is created or received by a health care provider and that which.relates to the individual’s past, present, or future physical or mental health or condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe the information can be used to identify the individual (emphasis added), Id.” The Commission states that “PHI includes many common identifiers, including, but not limited to, an individual’s name, address, birth date, Social Security Number and medical record number when combined with health information.”

The Commission posits that “[b]ased on the current definition of PHI and the de- identification standard, the time and date of the call, the reason for the call, and the nature of the call are all presumed by federal law to constitute information that can potentially be used to identify a patient and therefore are subject to protection. A broad range of categories of information are deemed protected by federal regulation because they could reveal the patient’s medical condition, even without the disclosure of an individual’s name or gender.” The Commission further states that “[s]imilarly, incident numbers used by Boston EMS are not

Batool Raza, Esq. SPR19/1974 Page 4 October 11, 2019

randomized numbers, but in fact use a combination of the date and time of the incident. U.S. Department of Health and Human Services regulations state that all elements of date are considered PHI. Furthermore, ‘any other unique identifying number, characteristic, or code’ is also considered PHI. Therefore, these data fields are also protected from disclosure under federal regulation. 45 C.F.R. § 164.514(b).”

Regarding the de-identification of the records, the Commission states that “. . . the de- identification standard under HIPAA requires either an expert determination method (See 45 CFR 164.514(b)(1)), or the Safe Harbor method (See 45 CFR 164.514(b)(2)). The U.S. Department of Health and Human Services regulations define de-identified health information as information that neither identifies nor provides a reasonable basis to identify an individual.” The Commission contends that “[p]er the Massachusetts Public Records Law, [it] is under no obligation to hire a statistician to perform the specialized analysis necessary to generate a de- identified data set under 45 CFR 164.514(b)(1) in response to a public records request. The Safe Harbor method (per 45 CFR 164.514(b)(2)) requires the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual. This level of de-identification effectively excludes all information currently recorded by Boston EMS in its system.”

The Commission asserts that “. . . even a redaction of a health record to meet the de- identification standard could still compromise patient confidentiality where any portion of the record could be used, in connection with other publicly available information, to identify the patient. The Commission has reason to believe that, because of the particularly sensitive information at hand, disclosure of any portion would almost certainly violate federal law and could lead to identification of the individuals.” The Commission further asserts that“... given the recent attention on the issue of female health, and the ways in which the public is using individuals’ private information to track and harass those receiving treatment at various Planned Parenthood facilities across the nation, the Commission expects there to be significant media attention to its response.”

Exemption (c) Exemption (c) of the Public Records Law permits the withholding of: personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwatranted invasion of personal privacy G. L. c. 4, § 7(26)(c).

First clause of Exemption (c) — medical

Exemption (c) contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass, 427, 432-33 (1983). The

Batool Raza, Esq. SPR19/1974 Page 5 , October 11, 2019

first clause, relevant to this determination, creates a categorical exemption for personnel and medical information that relates to an identifiable individual and is of a “personal nature.” Id. at 434, Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. School Comm. of Westport, 401 Mass. 306, 308 (1987); Globe Newspaper Co., 388 Mass, at 438. Generally, medical information will be of a sufficiently personal nature to warrant exemption. Globe Newspaper Co., 338 Mass. at 432-34, There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person’s body. Globe Newspaper Co. v. Chief Med. Examiner, 404 Mass. 132, 135 (1987).

| Under the first clause of Exemption (c), the Commission, citing the Globe, Wakefield, and Logan decisions to support its position, asserts that aside from the records being medical records, “. . . there is a grave risk that the requested records, even redacted, would indirectly identify an individual. [f, for example, the Commission were to redact the individuals’ names, their medical condition, and the street number of their location, there is still enough pertinent information to identify the individual, including the precise location of the call and the date and time the call was made... .”

Second clause of Exemption (c) — privacy

Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Attorney Gen., 391 Mass. 1, 9 (1984); Attorney Gen. v. Assistant Comm’r of Real Property Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case by case basis.

This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017).

The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415, 427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number).

This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292.

Batool Raza, Esq. . SPR19/1974 Page 6 October 11, 2019

Under the second clause of Exemption (c), the Commission asserts that the records are medical records therefore, it need not provide information regarding the balancing test under the second clause. However, it contends that “... even if these records are not considered medical records it is the Commission’s position that disclosure of this information would constitute an unwarranted invasion of personal privacy, and hence is exempt from disclosure pursuant to the exemption’s second clause as well.” The Commission asserts that “. . . the information sought contains ‘intimate details’ about the individuals because it is directly related to the medical care and treatment they received while at Planned Parenthood. Furthermore, this information could reveal the identity of these individuals and their protected past and present medical information.”

With respect to the balancing test, the Commission states that “[Mr. Sherlock’s] interest is not in knowing whether Boston EMS provided adequate care to the individuals transported|[,] - [but rather] .. . in knowing details about the level of care and treatment Planned Parenthood provides, .. .” Therefore, [Mr. Sherlock’s] interest in this case is not outweighed by the individuals’ interest in keeping their identity and medical information confidential.” The Commission asserts that “. . . the withheld information is not available from other sources and its disclosure may lead to public embarrassment to these individuals.”

Although portions of the records may fall within an exemption to the Public Records . -Law, based on the Commiission’s response, it remains unclear how disclosing “a list of calls for service .. .” with patient information redacted, would create a grave risk of directly or indirectly identifying the individuals involved.

Further, with respect to Mr. Sherlock’s June 27" public records request, requesting “... a number of how many EMS calls have taken place at the address in question... each year from 2010 to the present[,]” it is unclear from the Commission’s responses if it possesses records responsive to this portion of the request. The Commission must clarify this matter.

Conclusion

Accordingly, the Commission is ordered to provide Mr. Sherlock with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us.

Lilesea

KLeceo. S. Murray Supervisor of Records

cc: Kevin Sherlock