Noah Bombard v. Department of Public Health (SPR 20211573)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records July 9, 2021 SPR21/1573 Helen Rush-Lloyd Records Access Officer Department of Public Health 250 Washington Street Boston, MA 01208 Dear Ms. Rush-Lloyd: I have received the petition of Noah Bombard of MassLive appealing the response of the Department of Public Health (Department) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). Mr. Bombard requested “. . . suppressed [COVID vaccination] data, which would include all age groups for all communities.” Previous appeal This request was the subject of a previous appeal. See SPR21/1283 Determination of the Supervisor of Records (June 7, 2021). In my June 7th determination, I found that the Department had not met its burden to withhold responsive records from disclosure. Accordingly, the Department was ordered to provide Mr. Bombard with a response. The Department provided Mr. Bombard with a response on June 24, 2021. Unsatisfied with the Department’s response, Mr. Bombard petitioned this office and this appeal, SPR21/1573, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Helen Rush-Lloyd SPR21/1573 Page 2 July 9, 2021 must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Department’s June 24th response In its June 24, 2021 response, the Department asserts that the records are exempt from disclosure under Exemptions (a) and (c) of the Public Records Law. Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Att’y Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.” The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. Under Exemption (a), the Department states that “[t]he suppressed values . . . are exempt from disclosure because they constitute data that could re-identify individuals and reveal their personal data which is protected from disclosure pursuant to G.L. c. 66A, the Massachusetts Fair Information Practices Act (‘FIPA’). . . . See also 801 CMR 3.00 (regulating dissemination of personal data under FIPA).” The Department further explains that “. . . providers who administer vaccinations in Massachusetts are mandated to then report individual level, identifiable information to the Department. G.L. c 111 §24M, 105 CMR 222. . . . The information so

Helen Rush-Lloyd SPR21/1573 Page 3 July 9, 2021 reported is confidential and may only be disclosed as provided in statute. Section 24M of chapter 111 of the General Laws provides ‘(i)nformation contained in the immunization registry shall be confidential, shall not constitute a public record and shall not otherwise be disclosed except in accordance with this section.’” The Department contends that it would be liable for damages under G. L. c. 214, § 3B and 801 C.M.R. 3.00 should the information be disclosed. Fair Information Practices Act (FIPA) The Department is reminded that FIPA and the Public Records Law are to be construed to work together consistent with the legislative purpose. 32 Op. Att’y Gen. Mass. 157, 160 (May 18, 1977). FIPA cannot provide a basis for withholding the requested information unless the records fall within a statutory exemption to the definition of public records. See Allen v. Holyoke Hosp., 398 Mass. 372, 379 (1986) (stating that “determining whether the record sought is protected by FIPA depends on whether the record is a public record pursuant to G. L. c. 4, § 7 Twenty-sixth, and subject to the disclosure provisions of G. L. c. 66A”). FIPA, by itself, cannot justify withholding information. A custodian must first specifically explain how the withheld information is exempt from the Public Records Law. Once a record is found to be exempt from the definition of public records, FIPA may also operate to restrict disclosure. Based on the Department’s response, it is unclear how the number of vaccinated individuals constitute personal data. G. L. c. 111, § 24M provides in relevant part: The department shall establish, maintain and operate a computerized immunization registry. The immunization registry shall record immunizations and immunization history with identifying information and shall include appropriate controls to protect the security of the system and the privacy of the information. . . Information contained in the immunization registry shall be confidential, shall not constitute a public record and shall not otherwise be disclosed except in accordance with this section. Such confidential information shall not be subject to subpoena or court order, and shall not be admissible as evidence in any action of any kind before a court, tribunal, agency, board or person. . . . G. L. c. 111, § 24M. Based on the Department’s response, it is unclear how the number of individuals who have been vaccinated constitutes identifying information recorded in the computerized immunization registry. It is additionally uncertain how the statute permits the Department to withhold these numbers from disclosure.

Helen Rush-Lloyd SPR21/1573 Page 4 July 9, 2021 Exemption (c) Exemption (c) permits the withholding of: personnel and medical files or information and any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy; provided, however, that this subclause shall not apply to records related to a law enforcement misconduct investigation. G. L. c. 4, § 7(26)(c). Analysis under Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Att’y Gen., 391 Mass. 1, 9 (1984); Att’y Gen. v. Assistant Comm’r of Real Prop. Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case by case basis. Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. School Comm. of Westport, 401 Mass. 306, 308 (1987); Globe Newspaper Co., 388 Mass. at 438. Generally, medical information is sufficiently personal to warrant exemption. Id., at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person’s body. Globe Newspaper Co. v. Chief Medical Examiner, 404 Mass. 132, 135 (1987). This exemption does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415, 427 (1988) ---------------------------- (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This exemption requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292. Under Exemption (c), the Department explains that “. . . this information is exempt . . . as vaccination status is medical information which is categorically exempt, or private information,

Helen Rush-Lloyd SPR21/1573 Page 5 July 9, 2021 the disclosure of which may constitute an unwarranted invasion of personal privacy. The private information is of a highly personal nature and contains specific details, which may identify individuals. The individuals’ privacy interests outweigh the public’s interest in disclosure.” Based on the Department’s response, it is unclear how the number of vaccinated individuals constitutes medical information that can be withheld under Exemption (c). Further, it is uncertain how this information constitutes intimate details of a highly personal nature or how disclosure would result in personal embarrassment to an individual of normal sensibilities. Additionally, it is not clear from the Department’s response, whether this information is available from other sources or how disclosure of this information would lead to the identification of individuals. The Department must clarify these issues. Conclusion Accordingly, the Department is ordered to provide Mr. Bombard with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. Sincerely, Rebecca S. Murray Supervisor of Records cc: Noah Bombard