Cody Shepard v. Department of Public Health (SPR 20200220)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor ofR ecords February 20, 2020 SPR20/0220 Helen Rush-Lloyd Records Access Officer Department of Public Health 250 Washington Street Boston, MA 02108 Dear Ms. Rush-Lloyd: I have received the petition of Cody Shepard of The Enterprise of Brockton appealing the response of the Department of Public Health (Department/DPH) to a request for public records. G. L. c. 66, § lOA; see also 950 C.M.R. 32.08(1). Specifically, on September 25, 2019, Mr. Shepard requested "[a] list of human cases of Eastern equine encephalitis virus infection in 2019, including the town each victim lives in and the date the [Department] was notified about each case." Previous appeals The requested record was the subject of previous appeals. See SPR19/2002 Determination of the Supervisor of Records (October 16, 2019); SPRl 9/2196 Determination of the Supervisor of Records (November 13, 2019). In my November 13th determination I ordered the Department to provide Mr. Shepard with a response to the request, provided in a manner consistent with the order, the Public Records Law and its Regulations. The Department responded on November 29, 2019. Mr. Shepard appealed and SPR20/0220 was opened as a result. Tlte Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § lOA(d); 950 C.M.R. 32.03(4). "Public records" is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre• pre@sec.state.ma.us

Helen Rush-Lloyd SPR20/0220 Page 2 February 20, 2020 It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 1O (b )(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) ( custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. Current appeal In an October 29, 2019 response, the Department indicated that the requested records are exempt from disclosure pursuant to Exemptions (a) and (c). The Department, however, indicated that an aggregate data " ... regarding Eastern Equine Encephalitis (EEE) including county name, age, date of onset, and virus result ... " is on its website, and provided a link to the information. In my November 13th determination I found it was unclear why the Department could not disclose the towns of the victims. Particularly, it was uncertain how the name of the town constituted personal data under Exemption (a) or an intimate detail of a highly personal nature under Exemption (c). It was additionally uncertain how disclosing the names of towns would lead to the identification of the individuals affected. I indicated the Department must clarify these issues. In its November 29th response the Department explains "[a]s noted in DPH's October 29, 2019 letter, the records you have requested are exempt from disclosure as a public record pursuant to G.L. c. 4, § 7, Cl. 26(c) and (a). The withheld information is medical information of a highly personal nature and contains specific details which may identify individuals and so is exempt from disclosure. Additionally, the disclosure of this information would constitute an unwarranted invasion of privacy. The individuals' privacy interests outweigh the public interest in disclosure." You further assert "[a]dditionally, this information has been withheld pursuant to G.L. c. 4, § 7(26)(a) because it is exempt by statute or necessary implication thereof. Specifically, this material is exempt from disclosure under G.L. c. 4, § 7(26)(c) and is personal data protected from disclosure pursuant to G.L. c. 66A, the Massachusetts Fair Information Practices Act." Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding ofrecords that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public's right to inspect records under the Public Records Law is

Helen Rush-Lloyd SPR20/0220 Page 3 February 20, 2020 restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either "shall not be a public record," "shall be kept confidential" or "shall not be subject to the disclosure provision of the Public Records Law." The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. Fair Information Practices Act (FIP A) The Depatiment is reminded that PIP A and the Public Records Law are to be construed to work together consistent with the legislative purpose. 32 Op. Atty Gen. Mass. 157, 160 (May 18, 1977). PIP A cannot provide a basis for withholding the requested information unless the records fall within a statutory exemption to the definition of public records. See Allen v. Holyoke Hosp., 398 Mass. 372, 379 (1986) (stating that "determining whether the record sought is protected by FIPA depends on whether the record is a public record pursuant to G. L. c. 4, § 7 Twenty-sixth, and subject to the disclosure provisions of G. L. c. 66A"). FIPA, by itself, cannot justify withholding information. A custodian must first specifically explain how the withheld information is exempt from the Public Records Law. Once a record is found to be exempt from the definition of public records, PIP A may also operate to restrict disclosure. Exemption (c) Exemption ( c) permits the withholding of: personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy G. L. c. 4, § 7(26)(c). First clause ofE xemption (c) medical Exemption ( c) contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432-33 (1983). The first clause, relevant to this determination, creates a categorical exemption for personnel and medical information that relates to an identifiable individual and is of a "personal nature." Id. at

Helen Rush-Lloyd SPR20/0220 Page 4 February 20, 2020 434. Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. School Comm. of Westport, 401 Mass. 306, 308 (1987); Globe Newspaper Co., 388 Mass. at 438. Generally, medical information will be of a sufficiently personal nature to warrant exemption. Globe Newspaper Co., 338 Mass. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person's body. Globe Newspaper Co. v. Chief Med. Examiner, 404 Mass. 132, 135 (1987). . Second clause ofE xemption (c) - privacy Analysis under the second clause of Exemption ( c) is subjective in nature and requires a balancing of the public's right to know against the relevant privacy interests at stake. Torres v. Attorney Gen., 391 Mass. 1, 9 (1984); Attorney Gen. v. Assistant Comm'r of Real Property Dep't, 380 Mass. 623,625 (1980). Therefore, determinations must be made on a case by case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep't of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415, 427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA , 4 77 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292. In its November 29th response the Department asse1is "[i]n order to meet its obligations to protect personal data and intimate details of a highly personal nature (such as possible identification of an individual with a suspected or confirmed disease diagnosis), DPH employs the standard for deidentification of protected health information set forth in the HIP AA Privacy Rule at 45 CFR 164.514(b)(2). This is a well-established national regulatory standard which protects patient privacy and the confidentiality of protected health information." You contend that "[a]ccordingly, all geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes must be withheld in order for data to be considered de-identified."

Helen Rush-Lloyd· SPR20/0220 Page 5 February 20, 2020 With respect to the possibility of providing certain responsive information, the Department explains "[t]he initial three digits of a zip code may remain in the information if, according to current publicly available data from the Bureau of the Census, the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and the initial three digits for all such geographic units containing 20,000 or fewer people is changed to 000. Accordingly, to operationalize this standard and balance the public interest in disclosure while ensuring patient confidentiality, DPH made county-level data concerning EEE cases publically available on its website." In his appeal petition Mr. Shepard objects to the Department's standard for de identification of protected health information. He further notes, in part, " ... in saying it uses this method for de-identification, the Department of Public Health is admitting to breaking the Safe Harbor method of de-identification. The [D]epartment always lists a county in press releases announcing new victims who have contracted EEE." Mr. Shepard also claims" ... the Department of Public Health appears to have broken its own policy on Feb. 1. In a press release, posted to the Department of Public Health website, the [D]epartment confirmed the first case of coronavirus in Massachusetts. In doing so, the [D]epartment explicitly stated: '[t]he first case of the 2019 novel coronavirus in Massachusetts has been confirmed in a man returning from Wuhan, China who is in his 20s and lives in · Boston.'" In addition, Mr. Shepard contends "[t]he [D]epartment listed that the victim lives in Boston, not Suffolk County, despite previously justifying that it didn't release the cities or towns of victims who had contracted the Eastern equine encephalitis virus because the [D]epartment's obligation is 'to protect personal data and intimate details of a highly personal nature (such as possible identification of an individual with a suspected or confirmed disease diagnosis).'" Despite the Department's November 29111 response, I find it is unclear why the Department cannot disclose the additional responsive information, including the names of the towns of the victims. Particularly, it is uncertain why the Depaiiment must use the standard for deidentification of protected health information set forth in the HIP AA Privacy Rule at 45 CFR 164.514(b )(2), especially in light of the apparent inconsistent application of this standard described in Mr. Shepard's appeal. In addition, the Department has not established how revealing the names of towns is more likely to lead to the identification of the individuals affected than revealing the applicable county. The Department must address these issues. Conclusion Accordingly, the Department is ordered to provide Mr. Shepard with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within 10 .business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us.

Helen Rush-Lloyd SPR20/0220 Page 6 February 20, 2020 Sincerely, ~UIT~ Supervisor of Records cc: Cody Shepard