Colman Herman v. Executive Office of Health & Human Services (SPR 20230657)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records April 20, 2023 SPR23/0657 Patricia M. Scanlan Records Access Officer Executive Office of Health and Human Services One Ashburton Place, Room 1109 Boston, MA 02108 Dear Ms. Scanlan: I have received the petition of Colman Herman appealing the response of the Executive Office of Health and human Services (Office) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On March 7, 2023, Mr. Herman requested “copies of any and all documents involving [a specified law firm] for the period January 1, 2020 to the present.” The Office responded on March 21, 2023, indicating it required additional time in order to respond. Following further correspondence, and unsatisfied with the Office’s response, Mr. Herman appealed, and this case was opened as a result. Subsequent to the opening of this appeal, the Office provided a supplemental response to Mr. Herman on April 13, 2023, including records in redacted form, and citing Exemptions (a), (c), and (n) of the Public Records Law for redacting the records. See G. L. c. 4, § 7(26)(a), (c), and (n). The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Att’y for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Patricia M. Scanlan SPR23/0657 Page 2 April 20, 2023 must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. Current Appeal In an email to this office subsequent to the opening of this appeal, Mr. Herman contends that the Office’s “claims of exemptions and other laws for redacting records lack specificity.” Additionally, in his appeal petition, and in subsequent emails to this office, Mr. Herman contends that the Office has “produced some, but not all, of the responsive records.” The Office’s April 13th Response In its April 13, 2023 response, the Office provides numerous responsive emails and attachments in redacted form and cites exemptions (a), (c), and (n) of the Public Records law for redacting the records. See G. L. c. 4, § 7(26)(a), (c), and (n). Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Att’y Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.” The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. Under Exemption (a), the Office states that it has redacted individual medical information and argues the following:

Patricia M. Scanlan SPR23/0657 Page 3 April 20, 2023 [The Office] is prohibited from disclosing this information because it constitutes protected health information pursuant to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, 42 U.S.C. 1320d, et seq., and its implementing regulations, 45 CFR Parts 160 and 164. This information also constitutes personal data protected from disclosure pursuant to G.L. c. 66A, the Massachusetts Fair Information Practices Act (FIPA). Health Insurance Portability and Accountability Act (HIPAA) Under Exemption (a), the Office cites the Health Insurance Portability and Accountability Act and its regulations. See 42 U.S.C. § 1320d et seq.; see also 45 C.F.R. §§ 160, 164. HIPAA sets forth rules and regulations for the use and disclosure of protected health information by covered entities. The applicable regulation is part of the implementation of HIPAA, and provides the following definitions: Definitions. . . . Covered entity means: . . . (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. . . . Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years. 45 C.F.R. § 160.103. Fair Information Practices Act (FIPA) FIPA and the Public Records Law are to be construed to work together consistent with

Patricia M. Scanlan SPR23/0657 Page 4 April 20, 2023 the legislative purpose. 32 Op. Att’y Gen. Mass. 157, 160 (May 18, 1977). FIPA cannot provide a basis for withholding the requested information unless the records fall within a statutory exemption to the definition of public records. See Allen v. Holyoke Hosp., 398 Mass. 372, 379 (1986) (“determining whether the record sought is protected by FIPA depends on whether the record is a public record pursuant to G. L. c. 4, § 7 Twenty-sixth, and subject to the disclosure provisions of G. L. c. 66A”). FIPA, by itself, cannot justify withholding information. A custodian must first specifically explain how the withheld information is exempt from the Public Records Law. Once a record is found to be exempt from the definition of public records, FIPA may also operate to restrict disclosure. Exemption (c) Exemption (c) applies to: personnel and medical files or information and any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy; provided, however, that this subclause shall not apply to records related to a law enforcement misconduct investigation G. L. c. 4, § 7(26)(c). Medical information that is of a personal nature and relates to a specifically named individual may be exempt from disclosure. Brogan v. Sch. Comm. of Westport, 401 Mass. 306, 308 (1987); Globe Newspaper Co. v. Boston Ret. Bd., 388 Mass. 427, 438 (1983). Generally, medical information is sufficiently personal to warrant exemption. Globe Newspaper Co., 338 Mass. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person’s body. Globe Newspaper Co. v. Chief Med. Exam’r, 404 Mass. 132, 135 (1987). Analysis under Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Att’y Gen., 391 Mass. 1, 9 (1984); Att’y Gen. v. Assistant Comm’r of Real Prop. Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case by case basis. This exemption does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). When analyzing a privacy claim, there is a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477

Patricia M. Scanlan SPR23/0657 Page 5 April 20, 2023 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law abiding and efficient manner. Id. at 292. Under Exemption (c), the Office explains that it “has redacted individuals’ medical information,” and argues that “the information is of a highly personal nature, containing specific details which may identify individuals, and release of such information would constitute an unwarranted invasion of an individual’s privacy interests. The individuals’ privacy interests outweigh the public’s interest in disclosure.” Additionally, the Office states that it “has redacted personal email addresses pursuant to Exemption (c)’s general privacy protections.” Based on the Office’s response, to the extent the Office has redacted medical information and personal email addresses, the Office may permissibly withhold such information from disclosure pursuant to Exemption (c) of the Public Records Law. Where the Office has met its burden to redact medical information and personal email addresses pursuant to Exemption (c), I decline to address the Office’s claim to withhold this information pursuant to Exemption (a) and HIPAA. Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the

Patricia M. Scanlan SPR23/0657 Page 6 April 20, 2023 reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, at 290. In its April 13th response, the Office argues the following: [The Office] has redacted video conference links and telephone conference lines and passcodes because this information is exempt from disclosure pursuant to G. L. c. 4, § 7 (26)(n), as it relates to “the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian…, is likely to jeopardize public safety or cyber security.” Based on the Office’s response, it is unclear how the video conference links, telephone conference lines, and related passcodes resemble the types of records listed as examples in Exemption (n). Further, the Office has not demonstrated how disclosure of this information is “likely to jeopardize public safety,” as required under the second prong of the PETA analysis cited above. The Office must clarify these matters. Timeline for Providing Responsive Records The Office is advised that G. L. c. 66, § 10(b) provides, in pertinent part, that if the magnitude or difficulty of a request unduly burdens the other responsibilities of the agency or municipality such that the agency or municipality cannot provide records within 10 business days, the agency or municipality must inform the requestor in writing within 10 business days. With respect to the timeframe to produce responsive records, the written response shall: identify a reasonable timeframe in which the agency or municipality shall produce the public records sought; provided, that for an agency, the timeframe shall not exceed 15 business days following the initial receipt of the request for public records ... and provided further, that the requestor may voluntarily agree to a response date beyond the timeframes set forth herein. G. L. c. 66, § 10(b)(vi). In its April 13th response, the Office states that it “will supplement its response to [Mr. Herman’s] PRR in the next two weeks.” Where Mr. Herman submitted his request on March 7, 2023, and the Office has not yet provided all responsive records, I find the Office has not met its burden in responding to this

Patricia M. Scanlan SPR23/0657 Page 7 April 20, 2023 request in accordance with G. L. c. 66, § 10(a)–(b) (records must be provided without unreasonable delay). To the extent possible, the Office must provide responsive records on a rolling basis. Conclusion Accordingly, the Office is ordered to provide Mr. Herman with a response to his request, provided in a manner consistent with this order, the Public Records Law, and its Regulations within ten business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Sincerely, Manza Arthur Supervisor of Records cc: Colman Herman