Altin Berxhiku v. Middlesex County Sheriff's Office (SPR 20251751)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records July 1, 2025 SPR25/1751 Megan J. McLatchey, Esq. Associate Legal Counsel Middlesex Sherriff’s Office 12 Gill Street, Suite 4700 Woburn, MA 01801 Dear Attorney McLatchey: I have received the petition of Altin Berxhiku appealing the response of the Middlesex Sherriff’s Office (Office/MSO) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On May 3, 2025, Mr. Berxhiku requested “… [his] blood pressure readings and any related medical documentation taken by your facility’s medical staff on July 24, 2023, at or about 2:00 AM, during [his] intake at the Middlesex House of Correction, for one overnight stay.” Previous Appeal This request was the subject of a previous appeal. See SPR25/1405 Determination of the Supervisor of Records (June 3, 2025). In my June 3rd determination, I ordered the Office to clarify whether the requested records existed. The Office responded on June 17, 2025. Unsatisfied with the Office’s response, Mr. Berxhiku petitioned this office and this appeal, SPR25/1751, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Megan J. McLatchey, Esq. SPR25/1751 Page 2 July 1, 2025 Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. Status of the Requestor; Reason for the Request Please note that the reason for which a requestor seeks access to or a copy of a public record does not afford any greater right of access to the requested information than other persons in the general public. The Public Records Law does not distinguish between requestors. Access to a record pursuant to the Public Records Law rests on the content of the record and not the circumstances of the requestor. See G. L. c. 66, § 10(a); see also Bougas v. Chief of Police of Lexington, 371 Mass. 59, 64 (1976). Accordingly, Mr. Berxhiku’s interest in obtaining the records shall have no bearing on the public status of the responsive records. It is unclear if Mr. Berxhiku may have a greater right of access to the responsive records outside the Public Records Law. The parties are encouraged to communicate to determine if there is another means affording Mr. Berxhiku a greater right of access to the responsive records. The Office’s June 17th Response In its June 17, 2025 response, the Office provided Mr. Berxhiku with two release authorization forms that were previously provided to Mr. Berxhiku on May 16, 2025. The Office also clarified, “[t]he requested records exist and are in the possession, custody, and control of the MSO.” Additionally, in support of requiring the release authorization forms, the Office cited G. L. c. 111, § 70, the Health Insurance Portability and Accountability Act (HIPAA) and the Criminal Offender Record Information (CORI) Act, as they operate through Exemption (a) of the Public Records Law. Current Appeal In his appeal petition, Mr. Berxhiku objects to signing the release authorization forms and argues the Office’s response is deficient for the following reasons: [1] The response is legally deficient and intentionally misleading… [2] The underlying criminal case was dismissed … and formally sealed under G. L. c. 276, § 100C…

Megan J. McLatchey, Esq. SPR25/1751 Page 3 July 1, 2025 [3] [The] attempt to impose CORI and HIPAA waivers, and … reliance on statutory exemptions that apply only to active or unsealed criminal matters is a complete legal failure… [4] The word “inmate” [is] an ongoing defamation and legal falsity… Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, §7 (26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Att’y Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.” The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. Records of Hospitals or Clinics G. L. c. 111, § 70 provides in pertinent part: Hospitals or clinics subject to licensure by the department of public health or supported in whole or in part by the commonwealth, shall keep records of the treatment of the cases under their care including the medical history and nurses’ notes and, in the case of a patient brought to a hospital by an ambulance service licensed pursuant to chapter 111C, a copy of the call summary set forth in paragraph (15) of subsection (b) of section 3 of said chapter 111C. ... Such records shall be in the custody of the hospital or clinic. Section ten of chapter sixty-six shall not apply to such records[.] G. L. c. 111, § 70.

Megan J. McLatchey, Esq. SPR25/1751 Page 4 July 1, 2025 Health Insurance Portability and Accountability Act (HIPAA) HIPAA sets forth rules and regulations for the use and disclosure of protected information by covered entities. The applicable regulation is part of the implementation of HIPAA, and provides the following definitions: Definitions … Covered entity means: … (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. … Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual … Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years. 45 C.F.R. § 160.103.

Megan J. McLatchey, Esq. SPR25/1751 Page 5 July 1, 2025 Additionally, the applicable regulations implementing HIPAA provide for the following concerning de-identification of protected health information: (a) Standard: De-identification of protected health information. Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information. (b) Implementation specifications: Requirements for de-identification of protected health information. A covered entity may determine that health information is not individually identifiable health information only if: … (2)(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed: (A) Names; … (R) Any other unique identifying number, characteristic, or code … 45 C.F.R. § 164.514. Under G. L. c. 111, § 70 and HIPAA, the Office states: The MSO objects to the disclosure of the requested records as they are exempt from disclosure under federal and state statutes protecting the confidentiality of medical records… The requested records were created by MSO nursing staff, who are licensed healthcare providers within the meaning of [G. L. c. 111, § 70]. These requested records reflect protected medical information including the patient’s medical history, health conditions, and clinical assessments. In accordance with state and federal statutes, the MSO withholds the requested records to safeguard the patient’s right to privacy and to avoid unlawful disclosure. Without valid legal authorization or verified identity from the individual to whom the records pertain, disclosure would subject the MSO to potential penalties and liability. Accordingly, the requested records are exempt from public disclosure due to the protections afforded by federal HIPAA regulations, state statutory confidentiality under M.G.L. c. 111, § 70, and the implementing regulations at 105 CMR 205… Based on the Office’s response, it is unclear how the responsive records may be withheld under G. L. c. 111, § 70. Specifically, the Office has not established whether it is a “hospital or clinic subject to licensure by the department of public health or supported in whole or in part by the commonwealth,” as required by the statute. The Office must clarify this matter. It is also unclear how HIPAA, specifically or by necessary implication, permits the Office to withhold the responsive records. In this case, the Office has not established how the responsive records constitute protected health information as contemplated by HIPAA and its

Megan J. McLatchey, Esq. SPR25/1751 Page 6 July 1, 2025 associated regulations. The Office has also not demonstrated whether it is a covered entity within the meaning of the statute. Specifically, it is unclear whether the Office is “a health care provider who transmits any health information in electronic form in connection with a transaction covered by [the statute].” The Office must clarify these matters. Criminal Offender Record Information The current definition of CORI is as follows: “Criminal offender record information,” records and data in any communicable form compiled by a Massachusetts criminal justice agency which concern an identifiable individual and relate to the nature or disposition of a criminal charge, an arrest, a pre-trial proceeding, other judicial proceedings, previous hearings conducted pursuant to section 58A of chapter 276 where the defendant was detained prior to trial or released with conditions under subsection (2) of section 58A of chapter 276, sentencing, incarceration, rehabilitation, or release. Such information shall be restricted to information recorded in criminal proceedings that are not dismissed before arraignment. Criminal offender record information shall not include evaluative information, statistical and analytical reports and files in which individuals are not directly or indirectly identifiable, or intelligence information. Criminal offender record information shall be limited to information concerning persons who have attained the age of 18 and shall not include any information concerning criminal offenses or acts of delinquency committed by any person before he attained the age of 18; provided, however, that if a person under the age of 18 was adjudicated as an adult in superior court or adjudicated as an adult after transfer of a case from a juvenile session to another trial court department, information relating to such criminal offense shall be criminal offender record information. Criminal offender record information shall not include information concerning any offenses which are not punishable by incarceration. G. L. c. 6, § 167. Under CORI, the Office states: [Under] CORI laws … the requested records are informational records compiled by the MSO, a criminal justice agency and concern an identifiable individual’s medical history while in MSO custody. These requested records identify an individual, relate to and document their placement in MSO custody, and detail their release from MSO custody… Based on the Office’s response, I find that the Office has not demonstrated how the responsive records fall within the definition of CORI. Specifically, it is not clear how the records constitute “information recorded in criminal proceedings that are not dismissed before arraignment.” See G. L. c. 6, § 167. Consequently, the Office has not met its burden to withhold

Megan J. McLatchey, Esq. SPR25/1751 Page 7 July 1, 2025 the responsive records under the CORI Act. See G. L. c. 66, § 10(a); Reinstein v. Police Comm’r of Boston, 378 Mass. 281, 289-90 (1979) (the statutory exemptions are narrowly construed and are not blanket in nature). Any non-exempt, segregable portion of a public record is subject to mandatory disclosure. G. L. c. 66, § 10(a). Conclusion Accordingly, the Office is ordered to provide Mr. Berxhiku with a response to the request, provided in a manner consistent with this order, the Public Records Law, and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Mr. Berxhiku may appeal the substantive nature of the Office’s response within ninety (90) days. See 950 C.M.R. 32.08(1). Sincerely, Manza Arthur Supervisor of Records cc: Altin Berxhiku