Kevin E. Taugher v. South Hadley, Town of - Fire District (SPR 20211302)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records June 9, 2021 SPR21/1302 Terie B. Fleury Primary Records Access Officer South Hadley Fire District No. 1 144 Newton Street South Hadley, MA 01075 Dear Ms. Fleury: I have received the petition of Kevin E. Taugher appealing the response of the South Hadley Fire District (District) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On January 29, 2021, Mr. Taugher requested “the detailed health/dental/life insurance spreadsheet, in Excel format for the current FY 2021 for all District employees and retirees. This file includes the names of the individuals, and is identical to the Excel file maintained and updated by previous Clerk/Treasurers.” On February 4, 2021, the District provided Mr. Taugher with redacted copies of responsive records. Previous Appeals This case was the subject of previous appeals. See SPR21/0887 Determination of the Supervisor of Records (April 16, 2021); SPR21/0887 Determination of the Supervisor of Records (Reconsideration) (May 3, 2021). In my April 16th determination, I closed SPR21/0887 based on the District providing Mr. Taugher the opportunity to view the records he is seeking. In my May 3rd reconsideration of the same case, I ordered the District to respond to Mr. Taugher, advising the District “that a records custodian is required to not only cite an exemption, but to specifically explain the applicability of the exemption to the requested records.” Subsequently, the District responded on May 13, 2021. Unsatisfied with the District’s response, Mr. Taugher again appealed, and this case was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Terie B. Fleury SPR21/1302 Page 2 June 9, 2021 form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. Current Appeal In his appeal petition Mr. Taugher asserts that “he is not asking for any medical records, medical information or plans protected by HIPAA. [He is] asking for financial records of the Fire District.” He further contends that “[i]f there are any plans qualifying for exemption from disclosure under the public records law, they would likely be between the Hampshire County Group Insurance Trust and the insurance companies, not the Fire District.” Mr. Taugher also states that the District “has failed to cite the exemption [it] asserts, in accordance with G. L. c. 4, § 7(26).” The District’s May 13th Response In its May 13, 2021 response, the District explains that “the HIPAA Privacy Rule protects individuals’ medical records, information and health plans. Health plan is further defined by the HHS Agency as: ‘Health plan means an individual or group plan that provides, or pays the cost of, medical care.’” The District further explains that “[i]t is . . . the position of this Clerk/Treasurer that the names cannot be distributed with the ‘Plan.’” The District claims it is complying with the Federal Health Insurance Portability and Accountability Act of 1996 (HIPAA). Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute. G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977).

Terie B. Fleury SPR21/1302 Page 3 June 9, 2021 This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.” The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. In this case, the District explains that “[t]he Privacy Rule is located at 45 CFR Part 160 and Subparts A and E of Part 164.” The District also notes that “Health plan means an individual or group plan that provides, or pays the cost of, medical care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-91(a)(2)).” The applicable regulation is part of the implementation of HIPAA, and provides in relevant part: Definitions. . . . Covered entity means: (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. . . . Health plan means an individual or group plan that provides, or pays the cost of, medical care. . . . (2) Protected health information excludes individually identifiable health information: . . . (iii) In employment records held by a covered entity in its role as employer 45 C.F.R. § 160.103 HIPAA sets forth rules and regulations for the use and disclosure of protected health information by covered entities. However, the Privacy Rule in HIPAA does not apply to employers when they are acting in their roles as either employers or as group plan sponsors. See 45 C.F.R. § 160.103(2)(iii); see also 67 Fed. Reg. 53,192 (August 14, 2002) (the plan sponsor is not the covered entity under HIPAA, thus, information will not be protected when held by a plan sponsor). Consequently, the Privacy Rule does not preclude employers, acting as employers or plan sponsors, from disclosing information contained in “employment records,” such as identity

Terie B. Fleury SPR21/1302 Page 4 June 9, 2021 of the employed individual, the individual’s choice of plan, or whether the individual is an active employee or retired. See 45 C.F.R. § 160.103(2)(iii); see also 67 Fed. Reg. 53,192. The District must clarify how it is a covered entity as defined by HIPAA. Conclusion Accordingly, the District is ordered to provide Mr. Taugher with a response to his request, provided in a manner consistent with this order, the Public Records Law, and its Regulations within ten business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. Sincerely, Rebecca S. Murray Supervisor of Records cc: Kevin E. Taugher