Cody Shepard v. Department of Public Health (SPR 20200609)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records April 13, 2020 SPR20/0609 Helen Rush-Lloyd Records Access Officer Department of Public Health 250 Washington Street Boston, MA 02108 Dear Ms. Rush-Lloyd: I have received the petition of Cody Shepard of The Enterprise of Brockton appealing the response of the Department of Public Health (Department/DPH) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). Specifically, on September 25, 2019, Mr. Shepard requested “[a] list of human cases of Eastern equine encephalitis virus infection in 2019, including the town each victim lives in and the date the [Department] was notified about each case.” Previous appeals The requested record was the subject of previous appeals. See SPR19/2002 Determination of the Supervisor of Records (October 16, 2019); SPR19/2196 Determination of the Supervisor of Records (November 13, 2019); SPR20/0220 Determination of the Supervisor of Records (February 20, 2020). In my February 20th determination I ordered the Department to provide Mr. Shepard with a response to the request, provided in a manner consistent with the order, the Public Records Law and its Regulations. The Department responded on March 5, 2020. Mr. Shepard appealed and SPR20/0609 was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Helen Rush-Lloyd SPR20/0609 Page 2 April 13, 2020 It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. Current appeal In an October 29, 2019 response, the Department indicated that the requested records are exempt from disclosure pursuant to Exemptions (a) and (c). The Department, however, indicated that an aggregate data “. . . regarding Eastern Equine Encephalitis (EEE) including county name, age, date of onset, and virus result . . .” is on its website, and provided a link to the information. The Department also provided a response on November 29, 2019. In my February 20th determination I found it was unclear why the Department cannot disclose additional responsive information, including the names of the towns of the victims. Particularly, I found it was uncertain why the Department must use the standard for deidentification of protected health information set forth in the HIPAA Privacy Rule at 45 CFR 164.514(b)(2), especially in light of the apparent inconsistent application of this standard described in Mr. Shepard’s prior appeal. In addition, the Department had not established how revealing the names of towns is more likely to lead to the identification of the individuals affected than revealing the applicable county. I indicated that the Department must address these issues. The Department provided additional information in its March 5th response. Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.”

Helen Rush-Lloyd SPR20/0609 Page 3 April 13, 2020 The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. Fair Information Practices Act (FIPA) The Department is reminded that FIPA and the Public Records Law are to be construed to work together consistent with the legislative purpose. 32 Op. Atty Gen. Mass. 157, 160 (May 18, 1977). FIPA cannot provide a basis for withholding the requested information unless the records fall within a statutory exemption to the definition of public records. See Allen v. Holyoke Hosp., 398 Mass. 372, 379 (1986) (stating that “determining whether the record sought is protected by FIPA depends on whether the record is a public record pursuant to G. L. c. 4, § 7 Twenty-sixth, and subject to the disclosure provisions of G. L. c. 66A”). FIPA, by itself, cannot justify withholding information. A custodian must first specifically explain how the withheld information is exempt from the Public Records Law. Once a record is found to be exempt from the definition of public records, FIPA may also operate to restrict disclosure. Exemption (c) Exemption (c) permits the withholding of: personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy G. L. c. 4, § 7(26)(c). First clause of Exemption (c) – medical Exemption (c) contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432-33 (1983). The first clause, relevant to this determination, creates a categorical exemption for personnel and medical information that relates to an identifiable individual and is of a “personal nature.” Id. at 434. Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. School Comm. of Westport, 401 Mass. 306, 308 (1987); Globe Newspaper Co., 388 Mass. at 438. Generally, medical information will be of a sufficiently personal nature to warrant exemption. Globe Newspaper Co., 338 Mass. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person’s body. Globe Newspaper Co. v. Chief Med. Examiner, 404 Mass. 132, 135 (1987).

Helen Rush-Lloyd SPR20/0609 Page 4 April 13, 2020 Second clause of Exemption (c) – privacy Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Attorney Gen., 391 Mass. 1, 9 (1984); Attorney Gen. v. Assistant Comm’r of Real Property Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case by case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; - se - e -al-so- -D-o-e -v.- R-e-g-is-tr-a-r -of- M--o-to-r -V-e-hi-c-le-s, 26 Mass. App. Ct. 415, 427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292. Indirect identification In its November 29th response the Department asserted “[i]n order to meet its obligations to protect personal data and intimate details of a highly personal nature (such as possible identification of an individual with a suspected or confirmed disease diagnosis), DPH employs the standard for deidentification of protected health information set forth in the HIPAA Privacy Rule at 45 CFR 164.514(b)(2). This is a well-established national regulatory standard which protects patient privacy and the confidentiality of protected health information.” You contended that “[a]ccordingly, all geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes must be withheld in order for data to be considered de-identified.” With respect to the possibility of providing certain responsive information, the Department explained “[t]he initial three digits of a zip code may remain in the information if, according to current publicly available data from the Bureau of the Census, the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and the initial three digits for all such geographic units containing 20,000 or fewer

Helen Rush-Lloyd SPR20/0609 Page 5 April 13, 2020 people is changed to 000. Accordingly, to operationalize this standard and balance the public interest in disclosure while ensuring patient confidentiality, DPH made county-level data concerning EEE cases publically available on its website.” In its March 5th response the Department asserts, in part, “[t]he Department uses the industry standard, well-tested, commonly accepted HIPAA Privacy Rule de-identification standard, 45 CFR 164.514(a)-(c), as the basis for de-identification of the medical or other confidential information it holds. Additionally, pursuant to G.L. c. 111, § 5, where proper, the Department may determine additional information should be made available as necessary to protect the public health.” The Department also addresses the issue of consistently applying this standard. You indicate that “[t]he Department has statutory authority to release information that would otherwise be kept confidential in order to protect public health – as is ‘proper.’ See G.L. c. 111, § 5 (‘The Department ... shall conduct ... investigations as to the causes of diseases, and especially of epidemics ... and shall disseminate such information relating thereto as it considers proper’); 105 CMR 300.120(A) (provides that DPH and local boards of health may not release individual identifiers without the written consent of the data subject, unless necessary for disease investigation, control, treatment and prevention purposes). In some instances, critical public health interests require the disclosure of information that otherwise would be confidential.” (emphasis in original). You also note “[c]ontrary to your assertion, the release of the towns where the victims live could be misleading about the location of elevated risks of EEE exposure and be harmful to the public interest - with people having both a false and unnecessary concern as well as a false and dangerous sense of reduced risk.” With respect to the issue of how disclosing the relevant municipality may identify the patient, the Department asserts, in part, “[t]his question is frequently addressed in academic and public health policy research. It has been repeatedly demonstrated that even data which are believed to be completely anonymized may sometimes be re-identified by reference to publicly available information such as voter rolls, census information or information reported in the news media.” In his appeal petition Mr. Shepard explains his objections to this response. For example, he references guidance the Department provided to municipalities regarding COVID-19 and asserts “[t]he Department of Public Health is admitting that cities and towns can release the number of cases in their communities. There is no difference between the information held by DPH or a local city and town. They admitted that this information can be released and, therefore, need to release this information in the best interest of the public and transparency.” Although the Department provides additional information in support of its argument to withhold the responsive names of municipalities, including by asserting that information “. . . may sometimes be re-identified by reference to publicly available information such as voter rolls, census information or information reported in the news media,” I find the Department must provide additional information regarding how disclosing the specific municipalities responsive to

Helen Rush-Lloyd SPR20/0609 Page 6 April 13, 2020 Mr. Shepard’s request would identify individuals. In particular, it remains unclear how combining the name of the responsive municipality with publicly available information would reveal the identity of an individual with the Eastern equine encephalitis virus infection in 2019, as requested by Mr. Shepard. Conclusion Accordingly, the Department is ordered to provide Mr. Shepard with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations as soon as practicable. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. Sincerely, Rebecca S. Murray Supervisor of Records cc: Cody Shepard