S. Howey v. Boston Public Health Commission (SPR 20201273)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records August 12, 2020 SPR20/1273 Batool Raza, Esq. Assistant General Counsel Office of the General Counsel Boston Public Health Commission 1010 Massachusetts Avenue Boston, MA 02118 ` Dear Attorney Raza: I have received the petition of S. Howey appealing the response of the Boston Public Health Commission (Commission) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). Specifically, on July 15, 2020, S. Howey requested: “…all Computer Aided Dispatch Transcripts (CADs); all incident reports; Calls for Service [r]eports; all incident reports; all documents; all audio files for 911 calls; all digital files; all log book entries; all 911 documents pertaining to [an identified address] …from Jan. 8, 2020 to July 15, 2020.” In its July 29, 2020 response the Commission informed S. Howey it is withholding the responsive records under the Health Insurance Portability and Accountability Act (HIPAA) and its regulations as they operate through Exemption (a), and under Exemption (c) of the Public Records Law. As a result, S. Howey petitioned the Supervisor of Records (Supervisor), and this appeal was opened. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv) (written response must “identify any records, categories of records or portions of records that the agency or municipality intends to withhold, and provide the specific reasons for such withholding, including the specific One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Batool Raza, Esq. SPR20/1273 Page 2 August 12, 2020 exemption or exemptions upon which the withholding is based…”); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). The July 29, 2020 response In the July 29th response, the Commission asserts, “[a]ny time Boston EMS responds to an incident the following records are created: a Computer-Aided Dispatch (CAD) sheet, a Patient Care Report (PCR), and 911 recordings.” The CAD sheet is created to track EMS responses. It includes the fields needed to coordinate and document dispatch operations including but not limited to, date, time added, time dispatched, time arrived, time closed, call taker ID, event ID, caller name, caller phone number, caller location, location information, and event type. The Commission further states that “[t]he PCR is an electronic medical record to document the treatment EMS staff provides to the patient when it responds to calls. This contains several drop-down fields and narrative sections used to document patient care. Finally, EMS also has in its possession audio recording of the 911 calls. Like the CAD sheets and the PCRs, the calls include a description of the patient’s current or past medical condition, date of birth, his/her location, and additional identifying information. These reports and recordings are confidential because they contain medical reports protected by law.” On August 11, 2020, the Commission provided a further response expounding on its HIPAA, G. L. c. 66, § 10B and Exemption (c) claims to withhold the requested records. Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public's right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.”

Batool Raza, Esq. SPR20/1273 Page 3 August 12, 2020 The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. Under its Exemption (a) claim, the Commission posits that because it is a covered entity under HIPAA, it is prohibited from disclosing protected health information (PHI) without a valid patient authorization form or court order. The Commission indicates that “[u]nder HIPAA, the definition of PHI means individually identifiable health information transmitted or maintained in any form or medium. See 45 CFR 160.103.” The Commission explains that “[i]ndividually identifiable health information includes demographic information that is created or received by a health care provider and that which relates to the individual's past, present, or future physical or mental health or condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe the information can be used to identify the individual (emphasis added). Id.” The Commission states that “PHI includes many common identifiers, including, but not limited to, an individual's name, address, birth date, Social Security Number and medical record number when combined with health information.” The Commission states, “….even a redaction of a health record document could still compromise patient confidentiality where any portion of the record could be used, in connection with other publicly available information, to identify the patient.” Furthermore, in its July 29th response, the Commission asserts, “[it] has reason to believe that, because of the particularly sensitive information and the amount of information about the incident(s) at this [identified address] made available on the Internet, disclosure of any portion would almost certainly violate [f]ederal law.” In its August 11th response, the Commission explains that, “…the time and date of the call, the reason for the call, and the nature of the call, and the outcome of the call are all presumed by federal law to constitute information that can potentially be used to identify a patient and therefore are subject to protection.” See 45 C.F.R. 160.103 (defining personally identifying information under privacy rule in HIPAA). G. L. c. 66, § 10B In its August 11th response, the Commission adds G. L. c. 66, § 10B as it operates through Exemption (a) as applicable to withhold information pertaining to the Emergency Medical Technicians (EMTs) who responded to the 911 calls and/or calls for medical service responsive to S. Howey’s request, and during the time period of January 8, 2020 to July 15, 2020.

Batool Raza, Esq. SPR20/1273 Page 4 August 12, 2020 G. L. c. 66, § 10B states in pertinent part: " ... The home address, telephone number, personal email address or place of employment or education….of persons providing or training in family planning services ... shall not be public records ... " G. L. c. 66, § 10B. In its August 11th response, the Commission asserts it, “…cannot reveal the names, badge numbers, or any other identifying information of the EMT(s) who provided treatment to any individuals who may or may not have been transported from this [identified address].” Furthermore, the Commission states, “[i]t is the Commission’s position that EMT(s) providing care to individuals transported from [the identified address] are considered ‘persons providing family planning services’ because they provide that level of care to individuals who they transfer from such [locations]. Therefore, their private information is protected per the statute.” It is the Commissions’ contention that withholding the name, badge number and/or other identifying information of the EMT(s) is the only way to shield identifying information of individuals who provide family planning services, pursuant to the statute. The Commission further contends that, “…if the Commission does not withhold the name of the EMT(s), the fact that this individual(s) provided family planning services will be exposed, in contravention of the purpose of G. L. c. 66, § 10B.” It is my understanding that disclosure of the information pertaining to the EMT(s) who provided medical assistance for the calls of service would reveal the place of employment of those who provided family planning services to individuals, which is restricted under G. L. c. 66, § 10B. Based on the Commission’s August 11th response pertaining to certain of the information pertaining to the Boston EMT(s) calls for service, I find that the Commission has met its burden to withhold the names, badge numbers and other identifying information of the EMT(s) that responded to 911 calls and other medical calls for service to or from the identified address under G. L. c. 66, § 10B, as it operates through Exemption (a). Exemption (c) Exemption (c) of the Public Records Law permits the withholding of: personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy G. L. c. 4, § 7(26)(c). Exemption (c) contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432-33 (1983).

Batool Raza, Esq. SPR20/1273 Page 5 August 12, 2020 First clause of Exemption (c) - medical The first clause, relevant to this determination, creates a categorical exemption for personnel and medical information that relates to an identifiable individual and is of a “personal nature.” Id. at 434. Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. School Comm. of Westport, 401 Mass. 306,308 (1987); Globe Newspaper Co., 388 Mass. at 438. Generally, medical information will be of a sufficiently personal nature to warrant exemption. Globe Newspaper Co., 338 Mass. at 432- 434. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person's body. Globe Newspaper Co. v. Chief Med. Examiner, 404 Mass. 132, 135 (1987). Under the first clause of Exemption (c), the Commission indicates that the requested documents are exempt from disclosure because such documents constitute, “medical files or information” and “materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy.” See G. L. c. 4, § 7 (26)(c). Second clause of (c) - privacy Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Attorney Gen., 391 Mass. 1, 9 (1984); Attorney Gen. v. Assistant Comm'r of Real Property Dep’t 380 Mass. 623,625 (1980). Therefore, determinations must be made on a case by case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep't of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. ---------------------------- App. Ct. 415,427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292.

Batool Raza, Esq. SPR20/1273 Page 6 August 12, 2020 In its July 29th response, the Commission asserts that the responsive records are exempt from disclosure because the documents are “medical files or information.” The Commission has also detailed that in addition to the records being medical records, the Commission posits that it cannot redact the records in such a way to protect the subject of those records. Its response states, “….even a redaction of a health record document could still compromise patient confidentiality where any portion of the record could be used, in connection with other publicly available information, to identify the patient.” The Commission informed this office that even redacting the names, medical condition and street number of their location, there is still enough pertinent information to identify the individual, including the precise location of the call, the date, and the time of the call. In its August 11th response, the Commission reasserts that the responsive records are medical records that are “absolutely exempt without need for further inquiry as to whether their disclosure constitutes ‘a clearly unwarranted invasion of personal privacy.’” Citing, Globe Newspaper Co., 404 Mass. 132, 135. The Commission also cites the Wakefield and Logan decisions as additional support to withhold the records in their entirety. See Wakefield Teachers Ass’n v. School Comm., 431 Mass. 792, 798 (2000); see also Logan v. Comm’n of Dept. of ------------------------ Indus. Accidents, 68 Mass. App. Ct 533, 536 (2007) (redaction of identifiers in independent medical examination report still creates ‘grave risk’ of indirect identification). The Commission explains that even, “[i]f, for example, the Commission were to redact the individuals’ names, their medical condition, and the street number of their location, there is still enough pertinent information to identify the individual, including the precise location of the call and the date and time the call was made.” The Commission posits, “[h]ere, the information sought contains ‘intimate details,’ about the individuals because it is directly related to the medical care and treatment they received. Furthermore, this information could reveal the identity of these individuals and their protected past and present medical information.” Based on the Commission’s July 29th and August 11th responses, I find the Commission has met its burden to withhold the responsive records pertaining to the subjects’ medical records or medical information under the first clause of Exemption (c). See Globe Newspaper Co., 388 Mass. at 438 (identifying information is considered not only from the, viewpoint of the public, but also from the vantage of those who are familiar with the individual). Consequently, I decline to opine upon the applicability of the specified provision of HIPAA as it operates under Exemption (a) of the Public Records Law. Based on the Commission’s August 11th response, I find that the Commission did meet its burden of withholding any information that may identify the EMT(s) who provided family planning medical services of individuals transported to and from the identified address under G. L. c. 66, § 10B, as it operates through Exemption (a).

Batool Raza, Esq. SPR20/1273 Page 7 August 12, 2020 Conclusion Accordingly, I find that the Commission met its burden of withholding records under Exemption (c) and G. L. c. 66, § 10B as it operates through Exemption (a) of the Public Records Law. Therefore, I consider this administrative appeal closed. If S. Howey is not satisfied with the resolution of this administrative appeal, please be advised that this office shares jurisdiction with the Superior Court of the Commonwealth, G. L. c. 66, § 10(b) pursuing administrative appeal does not limit availability of applicable judicial remedies). Sincerely, Rebecca S. Murray Supervisor of Records cc: S. Howey