John Trask v. Department of Mental Health (SPR 20243154)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records December 5, 2024 SPR24/3154 Misael Garcia Records Access Officer Department of Mental Health 25 Staniford Street Boston, MA 02114 Dear Mr. Garcia: I have received the petition of John Trask appealing the response of the Department of Mental Health (Department) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On November 6, 2024, Mr. Trask requested “[a]nonymized data showing the distribution of durations of mechanical restraints within state psychiatric hospitals … from January 2020 to the present[.]” Mr. Trask sought a further breakdown of the data for adolescent units (excluding months where policy prohibited use of mechanical restraints in adolescent units), adult continuing care units, and adult court evaluation units. The Department provided a response on November 21, 2024. Unsatisfied with the Department’s response, Mr. Trask petitioned this office and this appeal, SPR24/3154, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Att’y for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Misael Garcia SPR24/3154 Page 2 December 5, 2024 If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. Current Appeal In his November 21, 2024 petition to this office, Mr. Trask objects to the redaction of the responsive records. Mr. Trask contends that the aggregated, anonymized data which he requested is not protected under the Health Insurance Portability and Accountability Act (HIPAA) and does not implicate privacy concerns under Exemption (c). Further, Mr. Trask contends that the significant public interest in disclosure outweighs privacy concerns, and that the suppression of small data values is unnecessary to prevent re-identification. The Department’s November 21st Response In its November 21, 2024 response, the Department provided Mr. Trask with responsive records, redacted under Exemptions (a) and (c) of the Public Records Law. Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute. G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Att’y Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.” The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities.

Misael Garcia SPR24/3154 Page 3 December 5, 2024 In its November 21, 2024 response, the Department cites HIPAA and its regulations. See 42 U.S.C. § 1320d et seq.; see also 45 C.F.R. §§ 160, 164. Specifically, the Department states: DMH has suppressed the cells that contain restraint data values one through ten and/or related complementary data fields pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) de-identification Safe Harbor, 42 CFR § 164.514(b)(2), and the DMH data suppression guidelines, to avoid possible reidentification of patients. Non-zero data elements under 11, when considered alone or combined with additional information, could reveal the identity of the associated with the count and thereby their Protected Health Information … The Health Insurance Portability and Accountability Act (HIPAA) prohibits disclosure of PHI except as required or permitted by HIPAA, specifically subpart E of part 164 or subpart C of part 160 of 45 CFR subchapter C. (See 45 CFR 164.502.) The release of PHI pursuant to a public records request is not a permitted disclosure under HIPAA. Health Insurance Portability and Accountability Act (HIPAA) HIPAA sets forth rules and regulations for the use and disclosure of protected information by covered entities. The applicable regulation is part of the implementation of HIPAA, and provides the following definitions: Definitions … Covered entity means: … (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. … Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual …

Misael Garcia SPR24/3154 Page 4 December 5, 2024 Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years. 45 C.F.R. § 160.103. Additionally, the applicable regulations implementing HIPAA provide for the following concerning de-identification of protected health information: (a) Standard: De-identification of protected health information. Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information. (b) Implementation specifications: Requirements for de-identification of protected health information. A covered entity may determine that health information is not individually identifiable health information only if: … (2)(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed: (A) Names; … (R) Any other unique identifying number, characteristic, or code … 45 C.F.R. § 164.514. Based on the Department’s response, it is unclear how the number of mechanical restraints employed at state psychiatric hospitals in the specified time period could be used to identify an individual. Consequently, it is unclear how the redacted information constitutes protected health information as contemplated by HIPAA and its associated regulations. The Department must clarify this matter.

Misael Garcia SPR24/3154 Page 5 December 5, 2024 Exemption (c) Exemption (c) permits the withholding of: personnel and medical files or information and any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy; provided, however, that this subclause shall not apply to records related to a law enforcement misconduct investigation. G. L. c. 4, § 7(26)(c). Analysis under Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Att’y Gen., 391 Mass. 1, 9 (1984); Att’y Gen. v. Assistant Comm’r of Real Prop. Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case-by-case basis. Medical information that is of a personal nature and relates to a specifically named individual may be exempt from disclosure. Brogan v. Sch. Comm. of Westport, 401 Mass. 306, 308 (1987); Globe Newspaper Co. v. Boston Ret. Bd., 388 Mass. 427, 438 (1983). Generally, medical information is sufficiently personal to warrant exemption. Globe Newspaper Co., 338 Mass. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person’s body. Globe Newspaper Co. v. Chief Med. Exam’r, 404 Mass. 132, 135 (1987). This exemption does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). When analyzing a privacy claim, there is a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law abiding and efficient manner. Id. at 292. In its November 21, 2024 response, the Department states: M.G.L. c. 4, §7(26) (c) specifically provides that medical files or information are not public records. (See Globe Newspaper Company v. Chief Medical Examiner, 404 Mass. 132, 135 (1989) (“The Legislature has made such medical files or information absolutely exempt.”) Even if this information was not categorically exempt, DMH redacts these records under Exemption (c)’s general privacy protections, as the information is of a highly personal nature, containing specific

Misael Garcia SPR24/3154 Page 6 December 5, 2024 details which may identify individuals, and release of such information would constitute an unwarranted invasion of an individual’s privacy interests. The individuals’ privacy interests outweigh the public’s interest in disclosure. Based on the Department’s response, it is unclear how disclosure of the redacted information would reveal medical information relating to a specifically named individual. Further, it is unclear how the redacted information constitutes intimate details of a highly personal nature or how disclosure would result in personal embarrassment to an individual of normal sensibilities. It is additionally uncertain whether the information is available from other sources. PETA, 477 Mass. at 292. The Department also has not met its burden to prove that the public interest in obtaining the requested information is substantially outweighed by the seriousness of any invasion of privacy. The Department must clarify these matters. Additionally, based on the Department’s response, it is unclear whether it possesses records which show the distribution of durations of mechanical restraints in state psychiatric hospitals for the specified time period. The duty to comply with requests for records extends to those that exist and are in the possession, custody, or control of the custodian of records at the time of the request. See G. L. c. 66, § 10(a)(ii). The Department must clarify this matter. Conclusion Accordingly, the Department is ordered to provide Mr. Trask with a response to the request, provided in a manner consistent with this order, the Public Records Law, and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Mr. Trask may appeal the substantive nature of the Department’s response within ninety (90) days. See 950 C.M.R. 32.08(1). Sincerely, Manza Arthur Supervisor of Records cc: John Trask