Mary Jirmanus Saba v. Department of Public Health (SPR 20241677)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records June 18, 2024 SPR24/1677 Helen Rush-Lloyd Records Access Officer Department of Public Health 250 Washington Street Boston, MA 02108 Dear Ms. Rush-Lloyd: I have received the petition of Mary Jirmanus Saba appealing the response of the Department of Public Health (Department) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On May 1, 2023, Ms. Saba requested: [1] Correspondence between [two identified individuals] with anyone in Health and Human Services or the MA DPH regarding masks in healthcare and pre- procedure COVID testing in healthcare during February and March 2023; and [2] Meeting minutes of the Healthcare Associated Infection Technical Advisory Board Meeting, during the month of March 2023. In an email to the Department on August 14, 2023, Ms. Saba modified the scope of Part 1 of the request to include “emails from February 1- May 31 between [three individuals]” and a set of 16 Department employees. Previous Appeals This request was the subject of previous appeals. See SPR23/1025 Determination of the Supervisor of Records (May 25, 2023); SPR23/1123 Determination of the Supervisor of Records (June 12, 2023); SPR23/2017 Determination of the Supervisor of Records (September 11, 2023); SPR23/2433 Determination of the Supervisor of Records (October 26, 2023) and SPR24/1677 Determination of the Supervisor of Records (May 6, 2024). In my May 6th determination, I found that the Department had not met its burden in responding to the request, and ordered the Department to provide records on a rolling basis to the extent possible. Subsequently, the Department responded on May 6, 2024. Unsatisfied with the Department’s response, Ms. Saba further appealed, and this case was opened as a result. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Helen Rush-Lloyd SPR24/1677 Page 2 June 18, 2024 The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Department’s May 6th Response In its May 6, 2024 response, the Department provides “204 records,” and states that numerous records have been redacted, and others withheld, pursuant to Exemption (n) of the Public Records Law. See G. L. c. 4, § 7(26)(n). Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically,

Helen Rush-Lloyd SPR24/1677 Page 3 June 18, 2024 the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, at 290. In its May 6th response, under Exemption (n), the Department argues the following: The Department has redacted information from the enclosed records regarding how to access conference calls and internal computer file pathways pursuant to G. L. c. 4, § 7(26)(n) ... Public disclosure of passwords and file pathways that may allow members of the public to access the Commonwealth’s internal communications regarding the response to the COVID-19 pandemic and other work of the Department, in the reasonable judgment of the Department, would be likely to jeopardize public safety or cyber security. The Department has also withheld documents concerning special pathogen planning pursuant to Exemption (n). Public disclosure of plans and planning activities related to special pathogens, which may include biological agents that may be included in the Federal Select Agent Program (see, 7 CFR Part 331, 9 CFR Part 121, and 42 CFR Part 73), in the reasonable judgment of the Department, would be likely to jeopardize public safety. Where the Department has redacted passwords and file pathways for accessing internal communications, I find that the Department may properly redact such information pursuant to Exemption (n) of the Public Records Law. However, based on the Department’s response, it is unclear how the “withheld documents concerning special pathogen planning” resemble the records listed as examples in the statute. See PETA, 477 Mass. at 289. Particularly, it is not clear how the records resemble “blueprints, plans, policies, procedures and schematic drawings” that relate to security measures. It is also uncertain how the records are the type that “a terrorist would find useful to maximize damage” as required under Exemption (n). Where the requested records bear a minimal resemblance to the categories listed in Exemption (n), the burden on the custodian to prove its “reasonable judgment” that

Helen Rush-Lloyd SPR24/1677 Page 4 June 18, 2024 disclosure is likely to jeopardize public safety is greatest. See id. at 290 (noting “inverse correlation” between the two prongs of Exemption (n) inquiry). Further, the Department did not provide factual heft to support the withholding of the requested records pursuant to Exemption (n). Specifically, the Department has not sufficiently explained how disclosure of the records is likely to jeopardize public safety or cyber security. See PETA, at 289-90. The Department must clarify these matters. Conclusion Accordingly, the Department is ordered to provide Ms. Saba with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Sincerely, Manza Arthur Supervisor of Records cc: Mary Jirmanus Saba