Mary-Ellen Manning v. Department of Developmental Services (SPR 20230334)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records March 7, 2023 SPR23/0334 Gabriella Eisner, Esq. Assistant General Counsel Acting Records Access Officer Executive Office of Health and Human Services Department of Developmental Services 1000 Washington Street Boston, MA 02118 Dear Attorney Eisner: I have received the petition of Attorney Mary-Ellen Manning appealing the response of the Department of Developmental Services (Department/DDS) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On January 9, 2022, Attorney Manning requested, among other items, the following: (1) The total number of occupied Department ... group home beds located in the City of Peabody from 2017 to the present; ... (3) All correspondence including emails from the Department of Developmental Services to the City of Peabody and to the Department of Housing and Community Development conveying the total number of occupied Department ... group home beds located in the City of Peabody from 2017 to the present. Previous Appeal This request was the subject of a previous appeal. See SPR23/0150 Determination of the Supervisor of Records (February 6, 2023). In my February 6th determination, I ordered the Department to provide a supplemental response to Attorney Manning. Subsequently, the Department responded on February 17, 2023. Unsatisfied with the Department’s response, Attorney Manning appealed, and this case was opened as a result. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Gabriella Eisner, Esq. SPR23/0334 Page 2 March 7, 2023 The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Att’y for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. Current Appeal In her appeal petition, Attorney Manning addresses the Department’s arguments and contends that “DDS produced a series of emails showing that DDS communicated with [the Department of Housing and Community Development] about the number of group home beds in municipalities, but redacted the point of the communication, that is, the number of group home beds.” The Department’s February 17th Response In its February 17, 2023 response, the Department states the following: The Department withheld three excel spreadsheet records in connection with this PRR (‘Withheld Records’) which were attached to emails sent by DDS to the Massachusetts Department of Housing and Community Development (‘DHCD’). The Withheld Records contain the number of DDS group home sites and group home capacity per municipality in 2017, 2019 and 2021. The Department cites Exemptions (a) and (c) of the Public Records law for withholding the responsive records. See G. L. c. 4, § 7(26)(a) and (c). Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a).

Gabriella Eisner, Esq. SPR23/0334 Page 3 March 7, 2023 A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Att’y Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.” The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. Under Exemption (a), the Department cites the Health Insurance Portability and Accountability Act (“HIPAA”) and its regulations. See 42 U.S.C. § 1320d et seq.; see also 45 C.F.R. §§ 160, 164. HIPAA sets forth rules and regulations for the use and disclosure of protected health information by covered entities. The applicable regulation is part of the implementation of HIPAA, and provides the following definitions: Definitions. . . . Covered entity means: . . . (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. . . . Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as

Gabriella Eisner, Esq. SPR23/0334 Page 4 March 7, 2023 employer; and (iv) Regarding a person who has been deceased for more than 50 years. 45 C.F.R. § 160.103. Additionally, the applicable regulations implementing HIPAA provide the for the following concerning the de-identification of protected health information: (a) Standard: De-identification of protected health information. Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information. (b) Implementation specifications: Requirements for de-identification of protected health information. A covered entity may determine that health information is not individually identifiable health information only if: . . . (2)(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed: . . . (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes 45 C.F.R. § 164.514. Under HIPAA, the Department argues that “as a health care provider, DDS is a HIPAA covered entity and must comply with the provisions of HIPAA prohibiting the unauthorized disclosure of protected health information.” The Department goes on to argue that In order to be HIPAA compliant, when DDS produces documents in response to a [public records request], DDS redacts a group home address, including the town, whether or not there is a resident’s name in the document. Because the PRR in this case is limited to DDS group home units in a particular town, geographical information smaller than a state is incorporated into the request and responsive documents cannot be produced without violating 45 CFR 164.514(b)(2)(i)(B). The [request] is, in effect, asking the Department to confirm the existence of DDS group homes within a geographic subdivision smaller than a State and asking for details about group homes within a geographic subdivision smaller than a state. In this case, the Office’s response includes the spreadsheets discussed above, provided in redacted form, leaving intact the column headers which read “CityTown,” “Sites,” and “Capacity.” Based on the Office’s response, it is unclear how the number of group homes or the number of beds in a particular city would be used to identify an individual. The Department must clarify this.

Gabriella Eisner, Esq. SPR23/0334 Page 5 March 7, 2023 Exemption (c) Exemption (c) applies to: personnel and medical files or information and any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy; provided, however, that this subclause shall not apply to records related to a law enforcement misconduct investigation G. L. c. 4, § 7(26)(c). Medical information that is of a personal nature and relates to a specifically named individual may be exempt from disclosure. Brogan v. Sch. Comm. of Westport, 401 Mass. 306, 308 (1987); Globe Newspaper Co. v. Boston Ret. Bd., 388 Mass. 427, 438 (1983). Generally, medical information is sufficiently personal to warrant exemption. Globe Newspaper Co., 338 Mass. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person’s body. Globe Newspaper Co. v. Chief Med. Exam’r, 404 Mass. 132, 135 (1987). Analysis under Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Att’y Gen., 391 Mass. 1, 9 (1984); Att’y Gen. v. Assistant Comm’r of Real Prop. Dep’t., 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case by case basis. This exemption does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). When analyzing a privacy claim, there is a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law abiding and efficient manner. Id. at 292. Under Exemption (c), the Department argues that “the Withheld Records could also indirectly lead to the identification of residents and their confidential medical diagnosis. Indeed, for example, when inspecting other publicly available information in an attempt to identify DDS group homes in a specific town, knowing the specific number of group home units would undoubtedly be useful.” In its response, the Department also cites Hardiman v. Dep’t of Developmental Servs. et al., Suffolk Superior Ct. No. 2014-01561-H, (Mar. 3, 2016). Please note that Hardiman

Gabriella Eisner, Esq. SPR23/0334 Page 6 March 7, 2023 concerned a request for records of the addresses of group homes in a specific municipality, and not the total number of group homes in the municipality. In the present case, Attorney Manning is seeking only the total number of group homes and beds within the municipality, and not any specific addresses. Based on the Department’s response, it is unclear how the redacted information would reveal medical information of a personal nature that relates to a specifically named individual. The Department must clarify this. Conclusion Accordingly, the Department is ordered to provide Attorney Manning with a response to her request, provided in a manner consistent with this order, the Public Records Law, and its Regulations within ten business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Sincerely, Manza Arthur Supervisor of Records cc: Mary-Ellen Manning, Esq.