McDonald, Daniel v. Suffolk County Sheriff's Department (SPR 20260216)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records February 5, 2026 SPR26/0216 Brigid Finnegan Executive Assistant to the General Counsel Office of the General Counsel Suffolk County Sheriff’s Department 200 Nashua Street Boston, MA 02114 Dear Ms. Finnegan: I have received the petition of Lucas Uhl, Esq., of the Boston Globe, appealing the response of the Suffolk County Sheriff’s Department (Department) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On December 3, 2025, Daniel McDonald, of the Boston Globe, requested, “[a]ny incident reports from the Suffolk Sheriff’s office produced for EMS/ ambulance trips for inmates at Nashua Street jail or South Bay house of correction during this calendar year. We are looking for any reports that detail the reason for the medical transport.” Prior Appeal This request was the subject of a prior appeal. See SPR26/0046 Determination of Supervisor of Records (January 21, 2026). In my January 21st determination, I found that it was unclear whether the Department had provided a response, and ordered the Department to provide a response to Mr. McDonald’s request. The Department provided a response on January 6, 2026. Unsatisfied with the Department’s response, Attorney Uhl petitioned this office and this appeal, SPR26/0216, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Brigid Finnegan SPR26/0216 Page 2 February 5, 2026 It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. Current Appeal In his appeal, Attorney Uhl asserts, “SCSD is not obligated to disclose, nor does Mr. McDonald seek, the names or other personally identifiable information contained in the requested records. Nevertheless, the Public Records Law requires SCSD to disclose the records after appropriate redactions. As the Supreme Judicial Court has made clear, records that do not contain personally identifiable information are outside the scope of Exemption (c).” The Department’s January 6th Response In its January 6, 2026 response, the Department cited the Health Insurance Portability and Accountability Act (HIPAA), as it operates through Exemption (a), and Exemption (c) of the Public Records Law to withhold the requested records. Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Att’y Gen. v. Collector of Lynn, 377 Mass. 151, 154 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.”

Brigid Finnegan SPR26/0216 Page 3 February 5, 2026 The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. Health Insurance Portability and Accountability Act (HIPAA) HIPAA sets forth rules and regulations for the use and disclosure of protected information by covered entities. The applicable regulation is part of the implementation of HIPAA, and provides in relevant part: Definitions … Covered entity means: … (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. … Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual … Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and

Brigid Finnegan SPR26/0216 Page 4 February 5, 2026 (iv) Regarding a person who has been deceased for more than 50 years. 45 C.F.R. § 160.103. In its response the Department states, “[r]eports for EMT/Ambulance Trips are generated by a medical contractor and are therefore protected by HIPAA.” Based on the Department’s response, it is unclear how the Department is a covered entity as defined by HIPAA. Also, it is not clear how the withheld records constitutes protected health information as contemplated by HIPAA and its associated regulations. It is additionally uncertain how individually identifiable health information cannot be redacted from the records so that segregable portions can be provided. The Department must clarify these matters. Exemption (c) Exemption (c) applies to: personnel and medical files or information and any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy; provided, however, that this subclause shall not apply to records related to a law enforcement misconduct investigation G. L. c. 4, § 7(26)(c). First Clause – Medical Information Medical information that is of a personal nature and relates to a specifically named individual is exempt from disclosure. Brogan v. Sch. Comm. of Westport, 401 Mass. 306, 308 (1987); Globe Newspaper Co. v. Boston Ret. Bd., 388 Mass. 427, 438 (1983). Generally, medical information is sufficiently personal to warrant exemption. Id. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person’s body. Globe Newspaper Co. v. Chief Med. Exam’r, 404 Mass. 132, 135 (1987). Second Clause – Privacy Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Att’y Gen., 391 Mass. 1, 9 (1984); Att’y Gen. v. Assistant Comm’r of Real Prop. Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case-by-case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal

Brigid Finnegan SPR26/0216 Page 5 February 5, 2026 nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415, 427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292. In its response the Department states, “G.L. c. 4, §7(26)(c) bars disclosure of the medical information and data that may constitute an unwarranted invasion of privacy.” Based on the Department’s response, it is not certain how the records constitutes medical information of a specifically identifiable individual. Also, based on the Department’s response, it is unclear what types of records it possesses that are responsive to the request and how the records contain intimate details of a highly personal nature. It is additionally uncertain how disclosure of the records would result in personal embarrassment to an individual of normal sensibilities and whether the information is available from other sources. Also, the Department did not provide information with respect to the balancing test, which examines whether the public interest in obtaining the requested information outweighs the seriousness of any invasion of privacy. PETA, 477 Mass. at 292. Further, it is unclear why the records may be withheld in their entirety. It should be noted that any non-exempt, segregable portion of a public record is subject to mandatory disclosure. G. L. c. 66, § 10(a). See Reinstein v. Police Comm’r of Boston, 378 Mass. 281, 289-90 (1979) (the statutory exemptions are narrowly construed and are not blanket in nature). The Department must clarify these matters. Conclusion Accordingly, the Department is ordered to provide Attorney Uhl with a response to his request, provided in a manner consistent with this order, the Public Records Law, and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Attorney Uhl may appeal the substantive nature of the Department’s response within ninety (90) days. See 950 C.M.R. 32.08(1).

Brigid Finnegan SPR26/0216 Page 6 February 5, 2026 Sincerely, Manza Arthur Supervisor of Records cc: Lucas Uhl, Esq. Daniel McDonald