Can a Delaware FOIA requester obtain public-health investigation records about an outbreak at an assisted-living facility?

Official title

19-IB32 6/24/2019 FOIA Opinion Letter to Dr. Edward Montz re: FOIA Complaint Concerning the Delaware Department of Health and Social Services

Plain-English summary

Edward Montz asked the Delaware Division of Public Health (DPH) for records concerning a gastrointestinal illness cluster at Brandywine Assisted Living at Fenwick Island. His request covered notes, emails, laboratory and environmental tests, and other materials, including materials that might be prepared later. DPH denied it under Delaware FOIA’s medical-file and statutory confidentiality exemptions, citing HIPAA and 16 Del. C. § 1210.

Montz said he wanted procedures and regulatory actions rather than personal information. He argued that identifiers could be removed and that a 2017 report from another division showed a report without patient information was possible. DHSS responded that DPH was the only division believed to have responsive records, that outbreak information could identify individuals despite redaction, and that the remaining documents would be meaningless after privacy redactions.

The AG found no FOIA violation. It accepted DHSS counsel’s representations about where records were held and what its review found. It said FOIA did not require DHSS to create the report Montz envisioned, and that the AG did not have to inspect withheld records itself. On this record, it found DHSS had supplied sufficient reasons for the exemptions it invoked. The opinion does not independently publish a redacted version of the files or determine what facts about the outbreak were safe to disclose.

Currency note

This opinion was issued in 2019. Check current Delaware FOIA and health privacy law before relying on its treatment of similar records.

Common questions

Why did DHSS rely on medical privacy rules?

DPH cited FOIA’s medical-file exemption, 29 Del. C. § 10002(l)(1), and its exemption for information protected by other statutes, § 10002(l)(6). It identified HIPAA and 16 Del. C. § 1210 as the underlying health privacy rules. The opinion says DPH was subject to HIPAA for its programs, including infectious disease epidemiology.

Did the AG independently decide that redacted details would identify patients?

The opinion reports DHSS’s determination that the size of the outbreak gave it a reasonable basis to believe the requested information could reveal identities. Footnote 18 quotes § 1210’s standard, which includes information usable alone or with information reasonably available to predictable recipients. The AG accepted counsel’s account of DHSS’s review; it did not inspect the withheld records itself.

Did the earlier 2017 inspection report require DPH to write a similar report?

No. DHSS said that report came from the Division of Health Care Quality, which it described as outside HIPAA’s covered-entity category. The AG said DHSS had not indicated that a comparable DPH report already existed, and FOIA did not require creating one.

What about information left after medical details are removed?

Montz argued that meaningful nonmedical material should be released. DHSS said its review found the remaining documents would be meaningless after the redactions needed under state and federal law. The AG accepted that representation and found DHSS had given sufficient reasons for withholding on this record.

Could Montz ask narrower questions or obtain family medical records another way?

The opinion says FOIA does not require an agency to answer questions, but suggests he could submit more specific records requests to DHSS. It also reports DPH’s statement that his parents’ medical records would be available to him as a power of attorney; the AG did not decide that separate access process.

Background and statutory framework

The public body bears the burden of justifying a denial under 29 Del. C. § 10005(c). The AG accepted counsel’s factual representations about the existence and review of records, citing earlier opinions. It also relied on the rule that FOIA does not require the AG to investigate or review withheld records in every petition; the question here was whether DHSS’s stated reasons satisfied its burden. The separate concern about the facility’s cleanup fell outside the FOIA petition process.

Citations

• 29 Del. C. § 10002(l)(1)
• 29 Del. C. § 10002(l)(6)
• 29 Del. C. § 10005(c)
• 16 Del. C. § 1210
• Del. Op. Att’y Gen. 18-IB34, 2018 WL 3947262, at *2 (July 20, 2018)
• Del. Op. Att’y Gen. 18-IB04, 2018 WL 1061272, at *3 (Jan. 23, 2018)

Source

• Landing page: https://attorneygeneral.delaware.gov/2019/06/24/19-ib32-6-24-2019-foia-opinion-letter-to-dr-edward-montz-re-foia-complaint-concerning-the-delaware-department-of-health-and-social-services/
• Original PDF: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2019/07/Attorney-General-Opinion-No.-19-IB32.pdf

Original opinion text

CIVIL DIVISION (302) 577-8400
FAX: (302) 577-6630
DEPARTMENT OF JUSTICE CRIMINAL DIVISION (302) 577-8500
NEW CASTLE COUNTY
FAX: (302) 577-2496
KATHLEEN JENNINGS 820 NORTH FRENCH STREET FRAUD DIVISION (302) 577-8600
ATTORNEY GENERAL WILMINGTON, DELAWARE 19801 FAX: (302) 577-6499

OFFICE OF THE ATTORNEY GENERAL OF THE STATE OF DELAWARE

Attorney General Opinion No. 19-IB32

June 24, 2019

VIA EMAIL

W. Edward Montz, Jr., Ph.D.
[email protected]

RE: FOIA Petition Regarding the Delaware Department of Health and Social Services

Dear Dr. Montz:

We write in response to your correspondence alleging that the Delaware Department of Health and Social Services (“DHSS”) violated the Delaware Freedom of Information Act, 29 Del. C. §§ 10001-10007 (“FOIA”) with regard to your records request. We treat your correspondence as a Petition for a determination pursuant to 29 Del. C. § 10005(e) regarding whether a violation of FOIA has occurred or is about to occur. For the reasons set forth below, it is our determination that DHSS has not violated FOIA as alleged.

BACKGROUND

On April 17, 2019, you submitted a request to the Division of Public Health (“DPH”) of DHSS for records pertaining to an outbreak of infectious disease at the assisted living facility, Brandywine Assisted Living at Fenwick Island. DPH is subject to the federal Health Information Portability and Accountability Act (“HIPAA”) and is considered a “HIPAA Covered Entity,” meaning that DPH must comply with HIPAA regulations for all of its programs, including the Office of Infectious Disease Epidemiology.1 Your FOIA request sought the following records:

Blanket request for any and all records, notes, documents, phone logs, emails, lab tests, environmental tests and any other materials related to the Brandywine Assisted Living at Fenwick Island GI cluster. Please consider this as a request for any similar materials currently being prepared or planned for future preparation, at such time as these materials are completed. The timeframe of the cluster is early March to the present time. I cannot be more specific in my request because I do not know the extent of the State's involvement 1
Response.

in this matter and am relying on the State to fully disclose all requested/related materials. Please consider this a request for information from ALL DHSS departments and personnel involved in this outbreak.2

After extending the time for their response on May 9, 2019 and again on May 24, 2019, DPH denied your request, citing two exemptions from the definition of “public record.” DPH cited 29 Del. C. § 10002(l)(1), which exempts medical files, the disclosure of which would constitute an invasion of personal privacy, and 29 Del. C. § 10002(l)(6), which exempts information protected from disclosure by statute. In support of the latter exemption, DPH cited the HIPAA and 16 Del. C. § 1210, which defines and prohibits the disclosure of protected health information, except in limited designated circumstances.3 This Petition followed.

The Petition alleges two overall issues: 1) that “this is not a legitimate denial;” and 2) that “[you] have little confidence that a proper cleanup of the facility was performed so that threats to the residents and the public exist even today.”4 Specifically, you argue that disease cluster investigations can be made public without compromising privacy and that while another DHSS division issued an inspection report on the same facility in 2017, DPH and no other division of DHSS responded to your FOIA request.5 You also question how DPH can rely on the privacy exemption when it was able to release this 2017 report containing information from medical files. Finally, you submitted a list of questions to clarify your initial request, explaining you never intended to request “personal information,” but instead sought “procedures and regulatory actions taken against the facility.”6 Finally, citing to your numerous stakeholder interests, you “request that DHSS be ordered to release the material immediately . . . .”7

DHSS’s counsel responded to the Petition on DPH’s behalf on June 7, 2019 (“Response”).
DPH contends that it was the only respondent because no other division in DHSS has responsive records and that as a HIPAA Covered Entity, it must protect extensive identifying data, including patients’ residences and dates of an outbreak, and would thus have to redact the documents it has so heavily that they would be “meaningless.”8 DPH further argued that the number of individuals in the outbreak created a “reasonable basis” to believe that the data requested could be used to 2 Petition.
3
Id.
4
Id.
5
Id.
6
Id.
7
Id.
8
Response.

2

identify those individuals, and there was no applicable exemption to provide the information under Delaware’s privacy law.9 In response to your assertion that a report was previously published regarding another outbreak, DPH notes that the division publishing that report, the Division of Health Care Quality, is not a HIPAA Covered Entity.10 DPH argues that its records are exempt from disclosure by 29 Del. C. § 10002(l)(1), which exempts medical files which constitute an invasion of personal privacy. Finally, DPH notes that you have spoken with staff on several occasions about this matter and DPH is willing to speak again about your concerns; additionally, your parents’ medical records would be available to you as a power of attorney.

In your reply submitted on June 12, 2019 (“Reply”), you agree that medical information with personal identifiers should not be released nor should DHSS be required to release information in violation of state or federal law. However, you argue that identifiers in the requested records could be removed and that certain information from the investigation “could, or should” be in DHSS’s files that does not include patients’ information subject to HIPAA, such as the name of the bacteria causing the outbreak, the source of contamination, and how it was cleaned. You further challenge DHSS’s reliance on 16 Del. C. § 1210, asserting that DHSS has only alleged a mere possibility that identities could be revealed using information purged of identifiers and that is not enough to meet the statutory threshold that a “reasonable basis” exists to believe identification would be possible.11 Also, you allege that DHSS’s assessment that the documents, after redacting the information subject to HIPAA, would be rendered meaningless, “is not a valid argument against releasing redacted information.”12 You propose a test to prove that re- identification of patients would be impossible.

In summary, you state that the “point is that information exists (or may exist), which is neither associated with personal medical information and/or may be released, subject to removal of all personal identifiers, without violating either state or federal laws.” Further, you reiterate your four requests for action by this Office: 1) “any and all information contained in DHSS investigation files of Brandywine Assisted Living be release[d] immediately, subject to compliance with applicable laws;” 2) you “request all that all DHSS files, modified in any way to comply with privacy laws, be reviewed independently by DOJ, before release, to ensure that no information is unnecessarily redacted due to overreach;” 3) you “reject the offer to have telephone conversations in lieu of written documents” as you will not “bargain down” your FOIA rights; and 4) if your requests are denied in whole or in part, you request for “all information which does not contain medical information” be released.

9
Id.
10
Id.
11
Reply.
12
Id.

3

DISCUSSION

Under FOIA, a public body carries the burden of proof to justify denial of a request for records.13 Your request seeks medical information about a disease outbreak. DHSS denied access to these medical records pursuant to 29 Del. C. § 10002(l)(1) and 29 Del. C. § 10002(l)(6). You allege that DHSS’s response was improper primarily due to three reasons: 1) DPH was the only responding division of DHSS; 2) you believe the disease cluster investigations can publicized without compromising privacy; and 3) you believe that DHSS has information not subject to the state and federal laws that should be released, including any information remaining in the heavily redacted materials. 14

First, with regard to your allegation that other divisions within DHSS were not required to response, DHSS’s counsel has confirmed in its Response that DPH is only division believed to have responsive records.15 Consistent with this Office’s practice, we accept those representations and find that DHSS appropriately supported its designation of DPH as the appropriate location to search for responsive records.16

Second, you suggest that DHSS’s release of the 2017 report indicates that it is possible for DHSS to create a report without using personal medical information. However, DHSS has not indicated that any such report exists in the fashion you contemplate and FOIA does not require creation of a document. If, in your opinion, other laws outside of FOIA require otherwise, DHSS does not have an obligation under FOIA to create a report.17

Third, you allege that DHSS must have certain responsive records that are not precluded from disclosure under state and federal law and should be produced to you, even if heavily redacted. One reason is that you challenge DHSS’s application of 16 Del. C. § 1210, arguing that there is no reasonable basis to assert that individuals can be identified using the information which would be produced to you and other reasonably available information. The other reason is that you believe other records without personal medical information must, or should, exist, and the 13 29 Del. C. § 10005(c).
14
Your Petition also alleges that you “have little confidence” that the clean-up was properly performed, which is a matter outside of FOIA that is not within our authority to address through the petition process. 15 Response (“Based upon information and belief, no other Division within the Department has any responsive records.”).
16
Del. Op. Att’y Gen. 17-IB59, 2017 WL 6348853, at FN12 (Nov. 20, 2017) (citing to the Delaware Lawyers’ Rules of Professional Conduct and determining that the factual representations made by the public body’s counsel “serve to satisfy [its] burden.”). 17 Del. Op. Att’y Gen. 18-IB34, 2018 WL 3947262, at 2 (July 20, 2018) (“FOIA does not require a public body to create a new document in response to a records request.”).

4

information remaining, even after heavy redactions, should be produced. DHSS represents that it has reviewed the requested records in light of 16 Del. C. § 1210 and determined that due to the size of the outbreak, DHSS believes that there is reasonable basis that releasing the information that you have requested would potentially reveal the identities of individuals.18 Further, DHSS has reviewed the records and found that the remaining responsive documents would be meaningless after the needed redactions. DHSS also points to 29 Del. C. § 10002(l)(1), noting that the requested records in this case are medical records concerning infectious diseases of individuals at a facility.

This Office accepts the representations of a public body’s counsel to determine whether requested records exist.19 Despite the Petition’s assertion that other records might exist or the heavily redacted documents are meaningful, DHSS’s counsel responds that DHSS’s review of the records reveals that the only remaining information would be meaningless due to the heavy redactions required by state and federal law. In addition, this Office previously determined that FOIA does not require this Office to conduct an investigation or a review of records that a public body has withheld in response to a FOIA request.20 Rather, “FOIA only requires a determination of whether the City provided sufficient reasons for withholding the redacted information to satisfy its burden of proof.”21 In these circumstances, we are satisfied that DHSS demonstrated that it asserted both FOIA exemptions, 29 Del. C. § 10002(l)(1) and 29 Del. C. § 10002(l)(6) and its underlying state and federal statutes, with a clear understanding of their meanings.

Finally, we note that your Petition includes a list of questions and issues that you expected to be addressed by the documents released to you. FOIA does not require a public body to answer questions, but to the extent you would like to submit more specific FOIA requests to DHSS incorporating the questions you posed to this Office, you may wish to do so.22

18
See 16 Del. C. § 1210 (including information “about which there is a reasonable basis to believe such information could be utilized (either alone or with other information that is or should reasonably be known to be available to predictable recipients of such information) to reveal the identity of that individual.”). 19 See Del. Op. Att’y Gen. 15-IB14, 2015 WL 9701645, at FN 14 ( (“It has been our historical practice to accept such representations from an attorney for the custodian of public records to determine that such documents do not exist for purposes of FOIA.”).” 20 Del. Op. Att’y Gen. 18-IB04, 2018 WL 1061272, at 3 (Jan. 23, 2018).
21
Id. (emphasis in original).
22
See, e.g. Del. Op. Att’y Gen. 17-IB05, 2017 WL 1317847, at 3 (Mar. 10, 2017); Del. Op.
Att’y Gen. 17-IB04, 2017 WL 1317846, at 2 (Mar. 8, 2017); Del. Op. Att'y Gen. 08-IB05, 2008 WL 1727613, at 1 (Feb. 22, 2008); Del. Op. Att'y Gen. 00-IB08, 2000 WL 1092967, at 2 (May 24, 2000); Del. Op. Att'y Gen. 97-IB06, 1997 WL 606408, at *5 (Mar. 17, 1997).

5

CONCLUSION

It is our determination that DHSS has not violated FOIA as alleged.

Very truly yours,

/s/ Alexander S. Mackler
_____
Alexander S. Mackler
Chief Deputy Attorney General

cc: Joanna S. Suder, Deputy Attorney General Dorey L. Cole, Deputy Attorney General

6