X

Thank you for sharing!

Your article was successfully shared with the contacts you provided.
Click here for the full text of this decision FACTS:A reporter filed a Public Information Act request with the Department of Mental Health and Mental Retardation asking for five years’ worth of information on 1. statistics regarding alleged incidents of sexual assault and patient-client abuse at state hospitals and Department facilities; 2. statistics concerning any subsequent investigation of the allegations; 3. the names of the facilities in which the incidents allegedly occurred; 4. the dates the events allegedly occurred; and 5. the disposition of any investigations. The department released the statistical information related to 1. and 2., but refused to disclose the information, saying disclosure was prohibited by the Health Insurance Portability and Accountability Act of 1996. The department asked the Attorney General for an opinion on whether the information could be released under the PIA, and the AG concluded that it could. The AG further found that the so-called “privacy rule” of HIPAA allows disclosure of health information if it is required by law and if the disclosure complies with the requirements of that law. The department then filed suit to contest the AG’s interpretation, and the trial court granted the department’s motion for summary judgment. HOLDING:Reversed and rendered. The court extensively reviews the provisions of the PIA, HIPAA and the privacy rule. The court allows that the PIA allows records that would be confidential by other law to be withheld from disclosure in a PIA request. HIPAA was passed in part to improve efficiency in the health care system, and the privacy rule includes a “mandatory floor” for protection of consumer health information by government entities. The court adds that the privacy rule has exceptions to the general rule that covered entities may not disclose protected health information, such as when the information is “de-identified” (such as the elimination of specific identifiers or the statistical compilation of data) before it is released. Another exception includes disclosure that is required by law. The court finds that the information the newspaper requested “does not seem to fall into the definitions of”protected health information’ given in either HIPAA or the privacy rule.” The information does not seem to relate to issues regarding health or condition in general, and “certainly” does not relate to the health or condition of an individual. Neither party “sufficiently briefs” this point, however, the court observes. Consequently, the court assumes that the information sought is protected health information to continue its analysis. The court addresses the AG’s argument that the “required by law” exception to the privacy rule’s nondisclosure general rule applies to this situation; the department counters that the PIA does not qualify as such a law under the privacy rule. The court agrees with the AG, noting that the PIA’s emphasis on providing information on governmental activities to citizens, public information requests made to agencies providing health care services may in certain cases involve the disclosure of health information, yet nothing in the definition of “public information” expressly exempts health information. The court adds that though the list in the privacy rule of types of laws that might be qualify under it does not include public information laws, the court finds the list exists to show a range of contexts, not to supply an exhaustive list of qualifying laws. The court next turns to address the department’s counterargument that even if the PIA is a law that qualifies under the privacy rule’s “required by law” exemption, that the privacy rule generally prohibits disclosure of protected health information, and protected health information is confidential under the PIA. The court disagrees with the department’s interpretation of how HIPAA, the privacy rule and the PIA interact with one another. The court calls the department’s logic circular: “Under the Department’s interpretation, governmental bodies contemplating disclosure under the Public Information Act are required to refer back to HIPAA and the privacy rule; it argues that, because HIPAA and the privacy rule prohibit the disclosure of protected health information, health information is considered confidential by law and, therefore, not subject to disclosure under the Act.” The court, instead, concludes that covered entities faced with a request for disclosure involving potentially protected health information have to examine the information in light of HIPAA and the privacy rule to determine if the information is protected health information that is general not subject to disclosure. “If the request does not involve protected health information, then HIPAA and the Privacy Rule do not prohibit disclosure of the information. If the request asks for information that is protected health information, then the agency must ascertain if any exception to non-disclosure in the Privacy Rule applies. If no exception applies, the agency may release the information if potential identifiers are redacted or if a statistician determines that release of the information cannot be used to identify any individual. . . . If an exception to non-disclosure does apply, the agency must release the information. For example, if the request is made under the authority of a statute that requires disclosure, then the exception found in �164.512(a) applies, and the agency must disclose the information as long as the disclosure complies with all relevant requirements of the statute compelling disclosure. “If a request for protected health information is made under the Public Information Act, then the exception to non-disclosure found in �164.512(a) of the Privacy Rule applies, and the agency must determine whether the Act compels the disclosure or whether the information is excepted from disclosure under the Act.” The court says there are several reason why its interpretation strikes the correct balance between the need for privacy under HIPAA and the privacy rule, and the need for public disclosure under the PIA. The overall behind the PIA is that government information is presumed to be subject to disclosure absent and exception. The state policy is to disclose information relating to the abuse and neglect of mentally ill or mentally retarded patients. And other states facing the same conundrum have concluded likewise. “Accordingly, we conclude that the information requested in this case was subject to disclosure. Section 164.512(a) of the Privacy Rule permits disclosure of protected health information if required by law, as long as the disclosure comports with the requirements of that law. . . . The Public Information Act requires disclosure of public information unless an exception applies. . . . No exception to disclosure in the Public Information Act applies to the release of statistical information regarding abuse at individual government facilities. . . . The confidentiality exception listed in �552.101 does not apply because no law renders the information confidential, and the Department has not referred us to any case, and we have found none, holding that aggregate statistical information of the type requested in this case is confidential.” The court adds that because the department can comply with both the privacy rule and the PIA, there is no conflict and there is no federal preemption. OPINION:Puryear, J.; Law, C.J., Patterson and Puryear, J.J.

Want to continue reading?
Become a Free ALM Digital Reader.

Benefits of a Digital Membership:

  • Free access to 1 article* every 30 days
  • Access to the entire ALM network of websites
  • Unlimited access to the ALM suite of newsletters
  • Build custom alerts on any search topic of your choosing
  • Search by a wide range of topics

*May exclude premium content
Already have an account?

 
 

ALM Legal Publication Newsletters

Sign Up Today and Never Miss Another Story.

As part of your digital membership, you can sign up for an unlimited number of a wide range of complimentary newsletters. Visit your My Account page to make your selections. Get the timely legal news and critical analysis you cannot afford to miss. Tailored just for you. In your inbox. Every day.

Copyright © 2021 ALM Media Properties, LLC. All Rights Reserved.