Sara Hincapie v. Department of Public Health (SPR 20252256)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records August 13, 2025 SPR25/2256 Helen Rush-Lloyd Records Access Officer Department of Public Health 250 Washington Street, Second Floor Boston, MA 02108 Dear Ms. Rush-Lloyd: I have received the petition of Sara Hincapie appealing the response of the Department of Public Health (Department) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On July 3, 2025, Ms. Hincapie made three requests for: Request #1 [1] From March 1, 2025 to Present – Please provide: Any new emails, correspondence (virtual or printed/mailed), timelines, meeting notes, memos, internal actions, internal notes, or legal documents (including complaints, investigative reports, disciplinary records, administrative actions, or legal correspondence) referencing me. Please also include records that reference name variations, misspellings, formatting inconsistencies, initials, redactions, redacted identifiers, anonymized references or potential obfuscations, including but not limited to variations such as: . . . ect. Any persons named ‘Sara’ or ‘Sarah appearing in related investigations, complaints, or board communications Any communications mentioning me in connection with [three identified individuals] or any variants and variations of those names. Third-party references to Hincapie’s involvement in matters concerning [three identified individuals]. Redacted or anonymized entries clearly linked to other individuals in this request Any references to incarceration, ankle monitoring, or legal status possibly attributed to me Policies or internal guidelines used to evaluate complaints or correspondence submitted by members of the public, One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Helen Rush-Lloyd SPR25/2256 Page 2 August 13, 2025 including whistleblowers like myself[.] [2] From July 1, 2023 to Present – Please provide any email attachments, timelines, meeting notes, memos, internal actions, internal notes, or legal documents (including complaints, investigative reports, disciplinary records, administrative actions, or legal correspondence) related to: [three identified individuals and] . . . (or any referenced variants) Please also include any records that reference or involve name variations, misspellings, formatting inconsistencies, initials, redactions, redacted identifiers, anonymized references or potential obfuscations, including but not limited to variations such as: . . . ect. Any persons named ‘Sara’ or ‘Sarah’ appearing in relevant investigations or board communications Third-party references involving Hincapie in matters concerning or in relation to [three identified individuals]. Redacted or anonymized entries that clearly refer to my identity based on content, chronology, or context Any communications mentioning me in connection with [three identified individuals] Redacted or anonymized entries clearly linked to other individuals in this request Any references to incarceration, ankle monitoring, or legal status possibly attributed to me [3] Additionally, please include any emails, email attachments, timelines, meeting notes, memos, internal actions, internal notes, documents or legal documents (including complaints, investigative reports, disciplinary records, administrative actions, or legal correspondence) referencing: Incarceration, detention, court supervision, ankle bracelet monitoring, or release conditions of . . .—or anyone believed to be me, including under anonymized references. Request #2 [1] From March 1, 2025 to Present – Please provide: Any emails, correspondence (virtual or printed/mailed), timelines, meeting notes, memos, internal actions, internal notes, or legal documents (including complaints, investigative reports, disciplinary records, administrative actions, or legal correspondence) involving or mentioning [an identified individual], including: [four identified email addresses] Please also include records that reference name variations, misspellings, formatting inconsistencies, initials, redactions, redacted identifiers, anonymized references or potential obfuscations, including but not limited to variations such as: [an identified individual] Redacted or anonymized entries connected to her identity, including aliases or

Helen Rush-Lloyd SPR25/2256 Page 3 August 13, 2025 third-party references involving [three identified individuals] or . . . including any name variations, misspellings, formatting inconsistencies, initials, redactions, redacted identifiers, anonymized references or potential obfuscations. Please include any decisions, determinations, or notes regarding jurisdictional review or investigatory dismissal. Request #3: [1] From March 1, 2025 to Present – Please provide: Any emails and attachments, correspondence (virtual or printed/mailed), timelines, meeting notes, memos, internal actions, internal notes, or legal documents (including complaints, investigative reports, disciplinary records, administrative actions, or legal correspondence) involving or mentioning [an identified individual], including: [an identified individual’s email address] Redacted or anonymized entries connected to her identity, including aliases or third-party references involving [three identified individuals] or . . . including any name variations, misspellings, formatting inconsistencies, initials, redactions, redacted identifiers, anonymized references or potential obfuscations. Records indicating her supervisory or reporting role over interns or unlicensed staff[.] Any complaints, investigative notes, disciplinary actions, or official memoranda referencing her or her role[.] Please include any decisions, determinations, or notes regarding jurisdictional review or investigatory dismissal. On July 9, 2025, Ms. Hincapie provided a modification to the three requests. Specifically, Ms. Hincapie stated: Additionally, to narrow the scope, instead of receiving all emails, please ensure production of any memos, administrative notes, timelines, legal documents, complaints, or investigation summaries that were circulated among your staff regarding myself, . . . [two identified individuals]. These are clearly covered under the scope of my original requests and are not exempt under M.G.L. c. 66. Limiting to these files, instead of the emails, should help narrow the scope. I also ask that you provide any emails or attachments exchanged between any agency or board and [two identified individuals] directly. These are critical to understanding any disclosures, responses, or potential misrepresentations made to the state boards, and should be limited in volume. Please also include any Subpoenas, if any, related to or mentioning . . . [and two identified individuals]. Just realized I did not give a timeline for the emails to and from [two identified

Helen Rush-Lloyd SPR25/2256 Page 4 August 13, 2025 individuals]. That would be from July 1, 2023 to the present, please. The Department responded on July 31, 2025, providing a record responsive to the request with a redaction. Unsatisfied with the Department’s response, Ms. Hincapie appealed, and this case, SPR25/2256, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Att’y for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Department’s July 31st response In its July 31, 2025 response, the Department provided a redacted record responsive to the request. In its response, the Department states: In several email exchanges with me on and around July 9, 2025, you agreed to modify the email portions of all three requests to the following: ‘any emails or attachments exchanged between any agency or board and [two identified individuals] directly for the past two years.’ Enclosed [is] one page of records that may be responsive to your request, the production of which completes DPH’s response to your request. DPH is prohibited from disclosing and has redacted email addresses. This information is exempt from disclosure pursuant to G.L. c. 4, § 7(26)(c) … The redacted information is of a highly personal nature, containing specific details which may identify individuals, and its disclosure may constitute an unwarranted invasion of personal privacy. The individuals’ privacy interests outweigh the public’s interest in disclosure. Accordingly, this information is exempt from

Helen Rush-Lloyd SPR25/2256 Page 5 August 13, 2025 disclosure pursuant to the second clause of G.L. c. 4, § 7(26)(c). This information also constitutes personal data, which is protected from disclosure by the Fair Information Practices Act, G.L. c. 66A (‘FIPA’). If DPH disclosed such information, it may be liable for damages under G.L. c. 214, § 3B…. Therefore, this information is also exempt pursuant to G.L. c. 4, §7(26)(a) because it is exempt by statute or necessary implication thereof, including FIPA and G.L. c. 4, § 7(26)(c), as outlined above. Regarding other items in your request, we had no responsive records any new documents regarding the above items. Additionally, any legal documents or communications are withheld from production because they are subject to an exemption pursuant to … the attorney-client privilege afforded to government agencies by Suffolk Construction Co. v. Division of Capital Asset Management, 449 Mass. 444 (2007). Current Appeal In her appeal to this office, Ms. Hincapie stated: I specifically reiterated my request for attachments referenced in the March 2025 email production. These include internal memos and notes circulated among DPH staff and directly tied to the investigation of [an identified individual]. These attachments were not produced and no legal exemption was cited to justify their omission… DPH produced only a single internal message. There were no emails to/from [an identified individual] or her legal representatives — despite the agency previously acknowledging her involvement and being provided with specific email addresses. The failure to return a single record raises red flags regarding the thoroughness of the search… My request explicitly asked for any subpoenas related to [two identified individual]. The July 31 response failed to address this entirely, with no confirmation of existence or exemption. Common law attorney-client privilege A records custodian claiming the attorney-client privilege under the Public Records Law has the burden of not only proving the existence of an attorney-client relationship, but also (1) that the communications were received from a client during the course of the client’s search for legal advice from the attorney in his or her capacity as such; (2) that the communications were made in confidence; and (3) that the privilege as to these communications has not been waived. See Suffolk Constr. Co., Inc. v. Div. of Capital Asset Mmgt., 449 Mass. 444, 450 n.9 (2007); see also Hanover Ins. Co. v. Rapo & Jepsen Ins. Servs., 449 Mass. 609, 619 (2007) (stating that the party seeking the attorney-client privilege has the burden to show the privilege applies). Records

Helen Rush-Lloyd SPR25/2256 Page 6 August 13, 2025 custodians seeking to invoke the common law attorney-client privilege “are required to produce detailed indices to support their claims of privilege.” Suffolk, 449 Mass. at 460. Pursuant to the Public Records Law, in assessing whether a records custodian has properly withheld records based on the claim of attorney-client privilege, the Supervisor of Records “shall not inspect the record but shall require, as part of the decision making process, that the agency or municipality provide a detailed description of the record, including the names of the author and recipients, the date, the substance of such record, and the grounds upon which the attorney-client privilege is being claimed.” G. L. c. 66, § 10A(a). Under the attorney-client privilege, the Department stated, “any legal documents or communications are withheld from production because they are subject to an exemption pursuant to … the attorney-client privilege…” Based on its July 31st response, I find the Department has not met its burden in responding to this request. Specifically, the Department must provide an index comprised of a detailed description of each record withheld pursuant to the attorney-client privilege, including the names of the author and recipients, the date, the substance of each record, and the grounds upon which the privilege is being claimed. See G. L. c. 66, § 10A(a). Further, the Department must clarify whether the communications were made during the client’s search for legal advice from an attorney in his or her capacity as such, whether the communications were made in confidence, and whether the privilege as to the communications has been waived. Further, the Department did not identify the records in its possession that it intends to withhold from disclosure. To deny access to a record or portion of a record under the Public Records Law, a records access officer must identify the record, categories of records, or portions of the record it intends to withhold. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3)(c)(4). The Department must clarify these matters. Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute. G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Att’y Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes

Helen Rush-Lloyd SPR25/2256 Page 7 August 13, 2025 records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.” The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. In its July 31, 2025 response, the Department stated, “[t]his information also constitutes personal data, which is protected from disclosure by the Fair Information Practices Act, G.L. c. 66A (‘FIPA’). If DPH disclosed such information, it may be liable for damages under G.L. c. 214, § 3B….” Fair Information Practices Act (FIPA) The Department is advised that FIPA and the Public Records Law are to be construed to work together, consistent with the legislative purpose. 32 Op. Att’y Gen. 157, 160 (May 18, 1977). FIPA cannot provide a basis for withholding the requested information unless the records fall within a statutory exemption to the definition of public records. See Allen v. Holyoke Hosp., 398 Mass. 372, 379 (1986) (stating that “determining whether the record sought is protected by FIPA depends on whether the record is a public record pursuant to G. L. c. 4, § 7 Twenty-sixth, and subject to the disclosure provisions of G. L. c. 66A”). FIPA, by itself, cannot justify withholding information. A custodian must first specifically explain how the withheld information is exempt from the Public Records Law. Once a record is found to be exempt from the definition of public records, FIPA may also operate to restrict disclosure. Based on the Department’s response, it is unclear how the cited statute specifically or by necessary implication permits the Department to withhold the redacted email address. Please be advised that for Exemption (a) to apply, said statute or regulation must either expressly state that the withheld record is not subject to disclosure under the Public Records Law, or limit dissemination of said information to a defined group or individuals or entities. The Department must clarify this matter. Exemption (c) Exemption (c) applies to: personnel and medical files or information and any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy; provided, however, that this subclause shall not apply to records related to a law enforcement misconduct investigation G. L. c. 4, § 7(26)(c).

Helen Rush-Lloyd SPR25/2256 Page 8 August 13, 2025 Second clause Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Att’y Gen., 391 Mass. 1, 9 (1984); Att’y Gen. v. Assistant Comm’r of Real Prop. Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case-by-case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415, 427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292. Based on the Department’s response, it is unclear whether the redacted email address was used for Department business. The Department must clarify this matter. Possession, Custody, or Control The Department is advised that the duty to comply with requests for records extends to those records that exist and are in the possession, custody, or control of the custodian of records at the time of the request. See G. L. c. 66, § 10(a)(ii). Additionally, under the Public Records Law, a public employee is not required to answer questions, or do research, or create documents in response to questions. See G. L. c. 66, § 10(a); 32 Op. Att’y Gen. 157, 165 (May 18, 1977). However, in accordance with the Public Records Law, custodians are expected to use their superior knowledge of the records in their custody to assist requestors in obtaining the desired information. See 950 C.M.R. 32.04(5). Based on the information provided in Ms. Hincapie’s appeal petition, it is unclear whether the Department possesses additional responsive records. The Department must clarify this.

Helen Rush-Lloyd SPR25/2256 Page 9 August 13, 2025 Conclusion Accordingly, the Department is ordered to provide Ms. Hincapie with a response to her request, provided in a manner consistent with this order, the Public Records Law, and its Regulations within ten business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Sincerely, Manza Arthur Supervisor of Records cc: Sara Hincapie