Matthew Rocheleau v. Boston Public Health Commission (SPR 20200322)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records March 4, 2020 SPR20/0322 Batool Raza, Esq. Assistant General Counsel Office of the General Counsel Boston Public Health Commission 1010 Massachusetts A venue Boston, MA 02118 Dear Attorney Raza: I have received the petition of Matthew Rocheleau of the Boston Globe appealing the response of the Boston Public Health Commission (Commission) to a request for public records. G. L. c. 66, § lOA; see also 950 C.M.R. 32.08(1). Specifically, on December 27, 2019, Mr. Rocheleau requested copies of "[a]ny/all Boston Fire Department and Boston Emergency Medical Services reports and any/all logs of calls and responses for an incident that occurred roughly between 1:30 p.m. and 2 p.m. on Monday Dec. 9, 2019 ... " Previous appeal This request was the subject of a previous appeal. See SPR20/0072 Determinations of the Supervisor of Records (January 24, 2020; February 20, 2020). In my January 24th determination I ordered the Commission to provide this office with an un-redacted copy of the records at issue for in camera inspection. The Commission participated a meeting and produced documents for review and I would like to thank the Commission for its cooperation. Prior to the issuance of a determination regarding the in camera review, the Commission provided a supplemental response on February 19, 2020. Mr. Rocheleau subsequently petitioned this office appealing this response. Consequently, this office opened SPR20/322. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § lOA(d); 950 C.M.R. 32.03(4). "Public records" is broadly defined to include all documentary materials or data, regardless of physical One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre• pre@sec.state.ma.us

Batool Raza, Esq. SPR20/0322 Page2 March 4, 2020 form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 1 O(b )(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. Current appeal In a January 21, 2020 response the Commission claimed that the Health Insurance Portability and Accountability Act (HIP AA) and its regulations, as they operate through Exemption (a), as well as Exemption (c) of the Public Records Law, apply to withhold the responsive records from disclosure. In its February 19th response the Commission provides additional information regarding its claims under Exemptions (a) and (c). Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public's right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either "shall not be a public record," "shall be kept confidential" or "shall not be subject to the disclosure provision of the Public Records Law." The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities.

Batool Raza, Esq. SPR20/0322 Page 3 March 4, 2020 Exemption (c) Exemption ( c) of the Public Records Law permits the withholding of: personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy G. L. c. 4, § 7(26)(c). First clause ofE xemption (c) - medical Exemption ( c) contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432-33 (1983). The first clause, relevant to this determination, creates a categorical exemption for personnel and medical information that relates to an identifiable individual and is of a "personal nature." Id. at 434. Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. School Comm. of Westport, 401 Mass. 306, 308 (1987); Globe Newspaper Co., 388 Mass. at 438. Generally, medical information will be of a sufficiently personal nature to warrant exemption. Globe Newspaper Co., 338 Mass. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person's body. Globe Newspaper Co. v. Chief Med. Examiner, 404 Mass. 132, 135 (1987). Second clause ofE xemption (c) - privacy Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public's right to know against the relevant privacy interests at stake. Torres v. Attorney Gen., 391 Mass. 1, 9 (1984); Attorney Gen. v. Assistant Comm'r of Real Property Dep't, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case by case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep't of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415,427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number).

Batool Raza, Esq. SPR20/0322 Page 4 March 4, 2020· This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA , 4 77 Mass. at 291. The public has a re~ognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292. The Commission's January 21st response In its January 21st response the Commission asserted that because it is a covered entity under HIP AA, it is prohibited "from disclosing Protected Health Information (' PHI') without a valid patient authorization form or comi order." The Commission indicates that "[u Jnder HIP AA, the definition of PHI means individually identifiable health information transmitted or maintained in any form or medium. See 45 CPR 160.103." The Commission stated that "[i]ndividually identifiable health information includes demographic information that is created or received by a health care provider ... or for which there is a reasonable basis to believe the information can be used to identify the individual (emphasis added). Id." The Commission stated that "PHI includes many common identifiers, including, but not limited to, an individual's name, address, birth date, Social Security Number and medical record number when combined with health information." The Commission further explained that "[bJ ased on the current definition of PHI and the de-identification standard, the time and date of the call, the reason for the call, and the nature of the call are all presumed by federal law to constitute information that can potentially be used to identify a patient and therefore are subject to protection." The Commission also noted that "[s]imilarly, incident numbers used by Boston EMS are not randomized numbers, but in fact use a combination of the date and time of the incident. U.S. Department of Health and Human Services regulations state that all elements of date are considered PHI ... Therefore, these data fields are also protected from disclosure under federal regulation. 45 C.F.R. § 164.514(b)." The Commission also explained "[t]he Safe Harbor method (per 45 CPR 164.514(b) (2)) requires the removal of specified identifiers of the individual and of the individual's relatives, household members, and employers, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual. This level of de-identification effectively excludes all information currently recorded by Boston EMS in its system." The Commission's February 19th response In its February 19th response the Commission provides information regarding the content of the responsive records. You indicate "[t]he individuals responding these phone calls at dispatch are trained EMTs and provide medical care and guidance to the callers as they wait for help to arrive. Therefore, the information contained in these calls contains medical information, and details regarding the health and well-being of the patient. This information can range from

Batool Raza, Esq. SPR20/0322 Page 5 March 4, 2020 providing medical advice for immediate care, to getting a history of the patient so that the dispatcher can update the EMTs on their way in real-time." With respect to the ability to provide non-exempt portions of the records, the Commission contends, in paii, "[g]iven the nature of the information contained in these calls, it is the Commission's position that disclosure of any p01iion of these calls would most certainly violate the Federal Health Insurance Portability and Accountability Act of 1996 ('HIP AA') under M.G.L. c. 4, §7(26)(a) and the privacy exemption under M.G.L. c. 4, §7(26)(c)." You further note that" ... any information contained in the Patient Care Reports ('PCRs') and/or the Computer-Aided Dispatch ('CAD') sheets is also exempt from disclosure under HIPAA and the privacy exemption. M.G.L. c.4, §7(26)(a) and M.G.L. c.4, §7(26)(c)." The Commission also provides information regarding the ability to provide the "[n]ame and identification of Boston EMS crew members and/or the EMTs." In particular, you contend this information is exempt under the second clause of Exemption ( c) and cite PETA in support of this position. You explain "[i]t is the Commission's position that releasing any identifying information of the EMTs, including their names and/or badge numbers, would implicate a significant risk to their safety. Given the pa1iicularly sensitive and tragic information being requested ( death of an individual on December 9, 2019 at Ruggles MBTA station), and the. information already available online regarding this incident, we believe any information about the EMTs would put them at grave risk." The Commission continues by noting "[e ]very day that an EMT puts on their uniform and reports to duty, they are putting themselves in the hands of the public as they respond to dangerous accidents and situations all over the city. The Commission cannot withhold the EMTs work address since ... Mr. Rocheleau already knows where they work therefore, their name and badge number are the only pieces of information that the Commission can withhold to protect their safety. Given the tragic nature of the underlying incident, EMT names and work address could expose them to unwarranted calls, harassment, or contact that puts their safety at risk. Therefore, it is not in the public's interest to have access to this information and the Commission will not be releasing any such information to Mr. Rocheleau." Basis oft he appeal In his previous appeal petition Mr. Rocheleau asse1ied that "entities covered under HIP AA are not required to keep health information confidential when the records/information provided does not reveal the identity of the individual." Fmiher, Mr. Rocheleau provided 18 specific identifiers that he agrees can be redacted before records can be released. In his current appeal Mr. Rocheleau indicates, in part," ... none of the arguments the Commission makes for why it is withholding the records are valid reasons for the records to be held within their entirety. While the records may contain some information that may require redaction in accordance with certain state and federal public records law exemptions, those would only allow for redaction of those specifically exempt areas, not the withholding of the

Batool Raza, Esq. SPR20/0322 Page 6 March 4, 2020 entire documents. The Globe in its previous response outlined the very specific reasons why materials may be exempt from disclosure under HIPP A and/or under the state's public records law." (e mphasis in original). Providing segregable portions As discussed above, the Commission participated a meeting and produced documents for review. In light of the Commission's January 2ist and February 19111 responses, as well as this office's document review, I find the Commission has met its burden to withhold medical information regarding specifically identified individuals under Exemptions (a) and (c). However, it remains unclear why it cannot provide segregable portions of the responsive records. Any non exempt, segregable portion of a public record is subject to mandatory disclosure. G. L. c. 66, § lO(a). See Reinstein v. Police Comm'r of Boston, 378 Mass. 281, 289-90 (1979) (the statutory exemptions are narrowly construed and are not blanket in nature). For example, the Commission has not established whether the responsive records contain information that is unrelated to an individual's medical condition, nor has it established that the "Boston EMS crew members and/or the EMTs" have a strong privacy interest in light of the factors described in PETA. See PETA, 477 Mass. at 292. Conclusion Accordingly, the Commission is ordered to provide to Mr. Rocheleau a response in a manner consistent with this order, the Public Records Law and Regulations within 10 business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. Sincerely, ~~ Rebecca S. Murray Supervisor of Records cc: Matthew Rocheleau