If a newspaper files a Public Information Act request for a Maryland fire department's ambulance dispatch record, does the medical information in that record have to be released, and can a parent whose parental rights were legally terminated authorize its release?
Apply this to your situation
This page answers the general question as of 2005. Ezel answers yours: what it means for your facts, under current Maryland law, with citations.
Plain-English summary
Baltimore County's attorneys asked the Attorney General how much of a Fire Department "event report," the record created when the department dispatches an ambulance, could be disclosed in response to a Public Information Act (PIA) request from a newspaper reporter. The County had already redacted medical information and a "patient identifier" from a dispatch record before releasing it, and the newspaper questioned whether that redaction was proper. The County had also asked whether a mother whose parental rights had been terminated by a court could authorize release of her child's information in such a record.
The opinion agreed with the County's bottom-line conclusion, medical information should stay confidential, but reached it differently. Where the County had argued the dispatch record itself qualified as a "medical record" under Maryland's Confidentiality of Medical Records Act, the opinion concluded it did not, because the record is not "entered into the record of a patient" the way a hospital chart or an ambulance run sheet would be. Instead, the opinion found that a separate PIA exception, covering "medical or psychological information about an individual" in any public record, independently required redaction of medical details, while the identity of the person transported was not exempt and could be disclosed. On the parental rights question, the opinion agreed with the County: a mother whose parental rights have been terminated by court order is no longer a "person in interest" who can authorize release of a child's medical information, either under the Medical Records Law or the PIA.
Currency note
This opinion was issued in 2005. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, exception, or definition mentioned here, particularly since the Public Information Act has since been recodified into the General Provisions Article.
Common questions
Could a newspaper get a full, unredacted copy of a 911 ambulance dispatch record under Maryland's open records law?
No, according to the opinion. It concluded that even though a dispatch record is a "public record" generally subject to PIA inspection, any medical or psychological information about an individual within it, such as reported symptoms or medical history, had to be redacted under the PIA's medical-information exception, separate and apart from whether the record counted as a formal "medical record."
Did redacting a person's name from the dispatch record mean the medical information no longer counted as "about an individual"?
No. The opinion rejected the argument that removing a direct identifier was enough, reasoning that if the accompanying information (like a specific date and address for the ambulance run) could still reasonably narrow the information down to one person, the medical details remained "medical information about an individual" and had to stay redacted.
Could a mother whose parental rights had been legally terminated give a newspaper permission to see her child's ambulance dispatch record?
No. The opinion agreed with the County that once a court terminates a parent's rights, that parent is no longer a "person in interest" under either the Medical Records Law or the PIA, so her authorization could not unlock access to the child's medical information; the department of social services with custody of the child was the party positioned to authorize disclosure.
Background and statutory framework
Baltimore County Fire Department "event reports," commonly called ambulance or fire dispatch records, capture basic information about every incident the department responds to, including the units dispatched, response times, and, when relevant, medical information about the person needing assistance, kept for up to six months and used to feed aggregate data into the National Fire Incident Reporting System. This differs from the more detailed "ambulance run sheet" (the MAIS form) that becomes part of a patient's chart at the receiving hospital.
The opinion applied Maryland's Public Information Act, SG §10-611 et seq., under which a dispatch record is a "public record" generally open for inspection under SG §10-612(a) unless another law or a PIA exception applies. It analyzed the Medical Records Law's definitions of "health care provider" (HG §4-301(h)) and "medical record" (HG §4-301(g)(1)) to conclude a dispatch record did not meet that definition, then applied the separate PIA exception for "medical or psychological information about an individual" under SG §10-617(b), which is not limited to formal medical records. On the parental rights question, it applied the Medical Records Law's definition of "person in interest" (HG §4-301(k)), which excludes a parent whose authority to consent to medical treatment has been limited by court order, and the parallel PIA definition of "person in interest" under SG §10-611(e).
Citations and references
Statutes:
- SG §10-611(e), (f), and (g), defining "person in interest," "personal information," and "public record" under the PIA
- SG §10-612(a)-(b), the PIA's general rule of access and liberal-construction-favoring-disclosure standard, tempered by unwarranted invasion of privacy
- SG §10-613(a)(1), requiring inspection of public records except as otherwise provided by law
- SG §10-614(b)(3) and (b)(3)(iii), requiring notice of redaction and disclosure of reasonably severable non-exempt portions
- SG §10-615 through §10-618, the PIA's confidentiality exceptions, including §10-617(a)-(b), the medical and psychological information exception, and §10-617(b)(2), permitting disclosure to a person in interest
- SG §10-624(a) and (e), defining "personal record" and the research-access provision
- HG §4-301(f), (g)(1), (h)(1)-(2), and (k), (k)(3), (k)(5)(i)-(ii), the Medical Records Law's definitions of "health care," "medical record," "health care provider," and "person in interest"
- HG §4-302(a), (b)(1), and (d), the Medical Records Law's general confidentiality rule, exclusion for facility-administration records, and redisclosure restriction
- HG §4-303 and §4-303(a), authorizing disclosure with a person in interest's written authorization
- HG §4-304(a), governing the scope of a person in interest's inspection rights
- HG §4-305 and §4-305(b)(7), permitting disclosure without authorization in specified circumstances, including to immediate family
- HG §4-306 and §4-306(b)(6)(ii), additional disclosure-without-authorization circumstances
- HG §4-307, the Medical Records Law's special restrictions on mental health records
- ED §13-516, governing licensure of emergency medical dispatchers and technicians
- 44 CFR §152.4 and §152.7, the National Fire Incident Reporting System regulations
- 45 CFR §160.103 and §164.514(a)-(b), (b)(2)(i)(B), the federal HIPAA "covered entity" and de-identification regulations discussed as not directly applicable but consistent in result
- 42 CFR §2.11, federal drug and alcohol treatment confidentiality regulations defining "patient-identifying information"
- COMAR 30.03.04.04, governing ambulance run sheet (MAIS form) recordkeeping
- Chapter 480, Preamble, Laws of Maryland 1990, the Medical Records Law's enacting legislation
Cases:
- Warner v. Lerner, 115 Md. App. 428, 693 A.2d 394 (1997), rev'd on other grounds, 348 Md. 733, 705 A.2d 1169 (1998), on the Medical Records Law's purpose of protecting patient privacy and provider-patient trust
- In re Adoption/Guardianship T00032005, 141 Md. App. 570 (2001), holding termination of parental rights severs all legal ties between parent and child
Source
- Landing page: https://oag.maryland.gov/resources-info/Pages/attorney-general%E2%80%99s-opinions.aspx
- Original PDF: https://oag.maryland.gov/resources-info/Documents/pdfs/Opinions/2005/90oag45.pdf
Original opinion text
Gen. 45] 45
PUBLIC INFORMATION ACT
M EDICAL R ECORDS - E MERGENCY M EDICAL S ERVICES -
M EDICAL I NFORMATION A BOUT AN I NDIVIDUAL T HAT
A PPEARS IN A MBULANCE D ISPATCH R ECORD M AY N OT BE
D ISCLOSED IN R ESPONSE TO PIA R EQUEST E VEN T HOUGH
R ECORD IS N OT A "M EDICAL R ECORD"
February 7, 2005
Jay L. Liner, County Attorney
Amanda S. Conn, Assistant County Attorney
Baltimore County Office of Law
You have asked for our opinion about the extent to which an
"event report" created by the Baltimore County Fire Department to
record the dispatch of an ambulance is disclosable in response to a
request under the Public Information Act. You are primarily
concerned with medical information and "patient identifiers" that
may appear in that record. In addition, you ask whether the privacy
rights of a minor transported by ambulance may be waived by the
child's mother, if the mother's parental rights have been terminated
by a court.
Consistent with our guidelines for opinion requests from local
governments, you provided your own well researched opinion on
these questions. In that opinion, you concluded that the Maryland
Confidentiality of Medical Records Law ("Medical Records Law")
bars the release of medical information, as well as patient
identifiers, in an event report when the record is associated with the
dispatch of an ambulance to a particular address. You argued that,
when a dispatch record is associated with a particular address,
medical information that appears in the record could readily be
linked to the individual transported by the ambulance. You
reasoned that it would therefore be a "medical record" subject to the
restrictions on disclosure set forth in the Medical Records Law.
You also concluded that, when a mother's parental rights have been
terminated with respect to a child, she is no longer a "person in
interest" for purposes of the Medical Records Law, and therefore
may not waive privacy rights of the child under that law.
We agree that medical information about an individual that
appears in an event report should not be publicly disclosed except
to a person in interest, although we reach that conclusion by a
slightly different route. We do not believe that an event report fits
the definition of "medical record" in the Medical Records Law;
however, medical information about an individual that appears in an
event report must be withheld from disclosure under an exception
in the Public Information Act. The identity of the person who was
transported by ambulance may be disclosed if it appears in the
record.
We also agree with your conclusion that a mother whose
parental rights have been terminated is not a person in interest for
purposes of the Medical Records Law. Nor would she ordinarily be
a person in interest under the Public Information Act.
I
Background
A. Ambulance Dispatch Records
Your inquiry concerns disclosure of a type of record entitled
"Baltimore County Fire Department Events Report," which is also
often referred to as an ambulance or fire "dispatch record." These
forms, which exist in both electronic and paper formats, are used to
record basic information about every incident to which the County
Fire Department responds - e.g., fires, rescue calls, medical
emergencies.
For example, when a 911 call requires the dispatch of
emergency medical personnel, the event report will include basic
information about the 911 call, identify the units that were
dispatched in response to the call, and record the times of various
events involved in the response (e.g., dispatch, arrival at the scene,
arrival at a hospital, return to station, and similar events). The
dispatch record may contain medical information about an
individual in need of assistance, including the symptoms or
condition of an ill or injured individual. It may also include
information on the person's medical history or disease status. This
information will be used to determine the appropriate personnel and
equipment to send in response to the call.
Event reports are maintained electronically by the 911 call
center, and in paper form by various units of the Fire Department,
for up to six months. A copy printed out by a responding
emergency medical services unit is destroyed immediately after the
incident. Aggregate data from the reports are submitted to the State
and federal governments as part of the National Fire Incident
Reporting System program. See
44 CFR §§152.4, 152.7. We understand that individual event
reports are not otherwise disseminated.
The emergency medical services personnel assigned to an
ambulance also create an "ambulance run sheet" for each transport
conducted by the ambulance. The Maryland Institute for
Emergency Medical Services Systems ("MIEMSS") has approved
a form known as the MAIS ("Maryland Ambulance Information
System") form for this purpose. See User's Manual for Maryland
Ambulance Information System,
information concerning the itinerary of the ambulance during a
particular call, vital signs and other medical information about the
person transported, and the treatment provided to the patient. Id. at
p. 2. One copy of the form is sent to MIEMSS, and another copy is
left with the receiving hospital for inclusion in its records. Id. at
p.18; COMAR 30.03.04.04.[1]
B. Request for Dispatch Record
We understand that the Fire Department received a request
from a newspaper reporter for "any and all information" in its
possession concerning a 911 call for emergency ambulance service
at a particular address on a specified date during the past year. The
Fire Department provided a copy of the dispatch record for that
incident, but redacted portions of the record, including the part that
described information provided by the caller to the 911 operator as
well as a "patient identifier." The newspaper questioned whether
the material should have been redacted. This raised the issue of
what information on the dispatch record related to that call is
available for public inspection and what information, if any, must
be withheld.
II
Disclosure of Dispatch Records
A. General Rule of Disclosure
The Public Information Act ("PIA") governs the disclosure of
records in the custody of a government entity such as a county fire
department. Annotated Code of Maryland, State Government
Article ("SG"), §10-611 et seq. There is no question that a dispatch
record falls within the PIA's broad definition of "public record." It
is "documentary material ... made by [the fire department] ... in
connection with the transaction of public business." SG §10-
611(g).
The PIA provides, as a general rule, that "[a]ll persons are
entitled to have access to information about the affairs of
government and the official acts of public officials and employees."
SG §10-612(a). The statute is to be construed liberally in favor of
permitting inspection of public records "unless an unwarranted
invasion of privacy" would result. SG §10-612(b). A government
agency is required by the PIA to permit inspection of any public
record at any reasonable time "[e]xcept as otherwise provided by
law." SG §10-613(a)(1). The PIA thus defers to other laws that
confer confidentiality on records, or parts of records. In addition,
various exceptions in the PIA itself forbid the disclosure of specific
types of records, forbid the disclosure of specific information, or
give the custodian of a record discretion to withhold certain types
of records, or part of a record, if that decision is in the public
interest. SG §10-615 through §10-618.
Thus, a fire dispatch record in the custody of a county fire
department is open to public inspection under the PIA, unless
another law or an exception in the PIA provides otherwise. Cf. 71
Opinions of the Attorney General 288 (1986) (recordings of 911
calls themselves are public records available for public inspection,
unless an exception to the general rule of disclosure applies). Two
provisions of State law may limit the disclosure of medical
information in the possession of a county fire department: (1) the
Maryland Confidentiality of Medical Records Act, Annotated Code
of Maryland, Health-General Article ("HG"), §4-301 et seq.; and
(2) the medical information exception in the PIA, SG §10-617(b).[2]
B. Medical Records Law
1. Limitations on Disclosure
The Maryland Confidentiality of Medical Records Act
("Medical Records Law") generally requires health care providers
and others to preserve the confidentiality of medical records. HG
§4-302(a). Special restrictions apply to mental health records. HG
§4-307. However, the restrictions do not apply to "information ...
not kept in the medical record of a patient ... that is related to the
administration of a health care facility...." HG §4-302(b)(1).
In certain circumstances, the Medical Records Law allows
disclosure of medical records with the written authorization or
stipulation of the patient or another "person in interest." HG §§4-
303, 4-306(b)(6)(ii). In addition to the patient, the term "person in
interest" in the Medical Records Law can include a health care
agent, a personal representative of a deceased person, a parent of a
minor in some circumstances, and an attorney for an individual who
would otherwise qualify as a "person in interest" himself or herself.
HG §4-301(k). There are also some circumstances, set forth in the
statute, in which a medical record may be disclosed without the
authorization of a person in interest. HG §§4-305, 4-306. Even
when the Medical Records Law allows disclosure of a medical
record it restricts redisclosure of the record by the person receiving
it. HG §4-302(d).
The evident purpose of the statute is "to bolster the privacy
rights of patients. The legislature recognized that, because of the
personal and sensitive nature of one's medical records, a patient
might experience emotional and financial harm if his medical
records are improperly used or disclosed. It was further desired that
the Act would enable health care providers to retain the full trust
and confidence of their patients." Warner v. Lerner, 115 Md. App.
428, 431-32, 693 A.2d 394 (1997), rev'd on other grounds, 348 Md.
733, 705 A.2d 1169 (1998); see also Chapter 480, Preamble, Laws
of Maryland 1990.
The Medical Records Law controls the dissemination of
"medical records" in the possession of "health care providers."
Thus, the definitions of those key terms determine the application
of the statute.
2. Provider
The Medical Records Law defines "health care provider" to
mean:
(i) A person who is licensed, certified,
or otherwise authorized under the Health
Occupations Article or §13-516 of the
Education Article to provide health care in
the ordinary course of business or practice of
a profession or in an approved education or
training program;
(ii) A facility where health care is
provided to patients ....
HG §4-301(h)(1). The term also encompasses the agents and
employees of a provider. HG §4-301(h)(2).
You advise that all 911 operators and fire dispatchers in
Baltimore County are trained as emergency medical dispatchers
("EMDs") and licensed by MIEMSS under Annotated Code of
Maryland, Education Article ("ED"), §13-516. In addition, the Fire
Department, through its emergency medical technicians, who are
also licensed under ED §13-516, undoubtedly provides health care
to those transported by its ambulances. Without delving into the
question whether the dispatchers themselves "provide health care,"
we shall assume that the dispatch records are in the possession of a
"provider" for purposes of the Medical Records Law.[3]
3. Medical Record
For purposes of the Medical Records Law, "medical record"
is defined as:
any oral, written, or other transmission in
any form or medium of information that:
(1) is entered into the record of a patient ...;
(2) identifies or can readily be associated
with the identity of a patient ...; and
(3) relates to the health care of the patient ....
HG §4-301(g)(1). "Health care" in turn is broadly defined to
include "any care, treatment, or procedure by a health care provider
... to diagnose, evaluate, rehabilitate, manage, treat, or maintain the
physical or mental condition of a patient ... or that affects the
structure or any function of the human body." HG §4-301(f).
A dispatch record is clearly a "written ... transmission in any
form or medium of information." Depending on the precise
contents of a particular dispatch record, it may be identified with
particular individuals - i.e., the 911 caller and the person in need of
assistance.[4] It may, but does not always, contain information
relating to the health care of an individual. In some instances, the
caller may relate symptoms or other information about the medical
condition of the person in need of assistance. In other instances, the
caller may simply report an event - e.g., an automobile accident -
from which the need for medical assistance may be inferred.
To our knowledge, the dispatch record is not entered into "the
record of a patient." Rather, it is kept in a database of records
pertaining to a wide variety of incidents, including 911 calls and
other emergency assistance requests, many of which contain no
medical information. This database is ultimately used to report
aggregate data to a central database under a federal program. At
most, the dispatch record falls within a category of records "not
kept in the medical record of a patient ... that is related to the
administration of a health care facility ...." HG §4-302(b)(1). This
is in contrast to the ambulance run sheet, which contains
information that becomes part of the patient's record at the
receiving hospital.[5]
In our view, a dispatch record is not a "medical record" under
the Medical Records Law.
C. PIA Exception for Medical Information
One of the exceptions to the PIA's general rule of disclosure
concerns medical information relating to an individual. The statute
provides:
(a) Unless otherwise provided by law ...
(b)(1) Subject to paragraph (2) of this
subsection, a custodian shall deny inspection
of the part of a public record that contains
medical or psychological information about
an individual, other than an autopsy report of
a medical examiner.
(2) A custodian shall permit the
person in interest to inspect the public record
to the extent permitted under [HG] §4-
304(a)....
SG §10-617(a)-(b). Thus, regardless of whether medical
information about an individual is contained in a "medical record,"
a government entity may not disclose that information except to a
person in interest. To the extent that the medical information is
"reasonably severable" from the record, a custodian must allow
inspection of other portions of the record. SG §10-614(b)(3)(iii).
The purpose underlying the exception for "medical
information about an individual" in SG §10-617(b) is the same as
that underlying the Medical Records Law, and other laws that make
various health care records confidential - to preserve a zone of
privacy for an individual's medical condition and treatment. The
exception in SG §10-617(b) applies that policy in some contexts
that are not encompassed by the Medical Records Law.
In our opinion, much of the information in a dispatch record
will not fall within the "medical information" exception in SG §10-
617(b). In particular, the identity of the individual who called the
911 operator or of the person in need of assistance would not fall
within this exception or, to our knowledge, any other exception in
the PIA.[6] On the other hand, statements about an injured or ill
person's symptoms or condition that have been provided to a 911
operator and recorded on the ambulance dispatch record are
"medical information" that must be withheld under the PIA. See 71
Opinions of the Attorney General 288, 292 (1986). While the PIA
is generally to be construed liberally in favor of disclosure of
records, that policy is tempered when disclosure would result in "an
unwarranted invasion of privacy of a person in interest." SG §10-
612(b).
Thus, to the extent that there is specific information in the
record concerning an individual's medical history or condition, it
should be redacted before the record is disclosed.[7] 71 Opinions of
the Attorney General 288, 292 (1986). Of course, the individual
who has requested the record must be advised of the fact of
redaction and the reason and statutory basis for withholding the
information. SG §10-614(b)(3).
We understand that the newspaper that made the PIA request
has suggested that the Fire Department could redact identifying
information about the patient and otherwise disclose medical
information in the fire dispatch record without running afoul of the
PIA. It argues that, because more than one person likely resided at
the address to which the ambulance was summoned, the medical
information in the dispatch record could not be precisely identified
to one individual. However, we do not believe that a record with
medical information need name or identify an individual with
precision to fit within the exception. Even when a name or other
direct identifier is redacted, medical information might still be
"about an individual" if the unredacted information sharply narrows
the class of individuals to whom the medical information might
apply. The PIA request in question sought information concerning
an ambulance run to a specific address on a specific date. Even if
information that named the person transported were withheld, any
medical information in the record would remain "medical
information about an individual" and, given the specification of date
and address in the request, could likely be matched to a particular
individual. The PIA itself recognizes that an address is an item of
"personal information" that can identify a person with reasonable
certainty. See SG §§10-611(f), 10-624(a).[8] In our opinion, a
custodian applying the medical information exception may draw the
same inference that the PIA itself does.
In sum, information in the dispatch record about the identity
of the person who called 911 and the person who was transported
by ambulance should be disclosed. Medical information concerning
the individual transported in the ambulance should be redacted
pursuant to SG §10-617(b).
Finally, in some circumstances, the PIA allows a custodian
discretion to grant access to otherwise confidential information for
research purposes under circumstances that protect the identities of
the individuals to whom the records pertain. SG §10-624(e).[9] The
legislative history of this section indicates that it was intended to
allow access to medical information. See Governor's Information
Practices Commission, Final Report 544-46 (1982). However, the
event report was not sought under this provision and, given that the
PIA request cited in your inquiry was directed to a specific 911 call,
the research provision of the PIA would not pertain.
III
Person in Interest: Effect of Termination of Parental Rights
You advise that the County received a letter from the mother
of the child who is the subject of the dispatch record. In that letter,
the mother authorized the release of the child's medical records,
including the ambulance dispatch record, to two newspaper
reporters. However, the County determined that the mother's
parental rights with respect to this child had been terminated by
court order three years earlier and that the child was in the custody
of a local department of social services at the time of the ambulance
call.[10]
In your letter, you analyzed the validity of the mother's
authorization as follows:
The State medical records law requires a
health care provider to disclose a medical
record "on the authorization of a person in
interest." HG §4-303(a). Thus, the question
that must be answered is whether a parent
whose rights have been terminated is a
"person in interest" under the State medical
records law. "Person in interest" is defined
as a "parent of a minor, except if the parent's
authority to consent to medical treatment for
the minor has been specifically limited by a
court order" or "a person authorized to
consent to health care for the minor consistent
with the authority granted." HG §4-
301(k)(5)(i) and (ii).
In our view, since the mother's parental
rights concerning the child were terminated in
2001, the mother is not a "person in interest"
under the State medical records law.
Certainly, the court order terminating the
mother's parental rights to the child who is
the subject of the fire dispatch record is an
order that limited the "parent's authority to
consent to medical treatment." HG §4-
301(k)(5)(i). Moreover, it is well established
that the termination of parental rights ends all
rights that a parent may have concerning a
child, including the right of a parent to
disclose a child's medical records. See In re
Adoption/Guardianship T00032005, 141 Md.
App. 570, 582 (2001) (termination of parental
rights severs all legal ties between the parent
and the child). Thus, since the child was in
the custody of the [department of social
services] at the time of the ambulance call, it
is our conclusion that we could only disclose
the redacted portions of the record after
authorization from the [department of social
services], which would be the "person
authorized to consent to health care for the
minor consistent with the authority granted."
HG §14-301(k)(5)(ii).
We agree with your analysis and conclusion with respect to the
Medical Records Law.[11] Cf. 90 Opinions of the Attorney General
3 (2005) (in a determination whether to consent to organ donation,
guardian of decedent has priority over parent whose parental rights
have been terminated).
The same conclusion pertains with respect to the PIA. Under
SG §10-617(b)(2), the custodian of a record containing medical
information is to permit inspection by a person in interest[12] to the
extent permitted by the Medical Records Law, i.e., HG §4-304(a).
Given that a mother whose parental rights have been terminated no
longer has access to a child's records as a "person in interest" under
the Medical Records Law, she is not entitled to access under the
PIA.
IV
Conclusion
In our opinion, when a request for a Fire Department event
report is made under the PIA, any medical information about an
individual that appears in the report must be redacted, unless the
report is being provided to a person in interest. Although a Fire
Department event report is not a medical record for purposes of the
Medical Records Law, the PIA exception for "medical information
about an individual" applies when the report is associated with an
ambulance run to a specific address. The identity of the individual
transported is disclosable. Finally, a mother is not a person in
interest with respect to a child if her parental rights with respect to
that child have been terminated by a court order.
J. Joseph Curran, Jr.
Attorney General
Robert N. McDonald
Chief Counsel
Opinions & Advice
[1] This use of run sheets is typical of ambulance services. See, e.g.,
United States v. Freitag, 230 F.3d 1019, 1021 n.4 (7th Cir. 2000); see also
Ohio Op. Atty. Gen. 2001-041, 2001 WL 1246071 at *3 (ambulance run
sheets typically are incorporated in receiving hospital's chart for patient
to ensure, for example, that medications are not duplicated).
[2] A federal law also could potentially govern disclosure of records
related to ambulance runs. However, that law apparently does not apply
to the Fire Department.
Regulations issued under the federal Health Insurance Portability
and Accountability Act of 1996 ("HIPAA"), established national standards
for the protection of health information in the custody of "covered
entities." See 88 Opinions of the Attorney General 205 (2003). A
"covered entity" includes a health care provider that transmits health
information in electronic form in connection with a transaction. 45 CFR
§160.103. A "transaction" is defined as the "transmission of information
between two parties to carry out financial or administrative activities
related to health care." Id.
You have explained that, while the Fire Department provides health
care to individuals in connection with emergency services, it does not bill
for those services or transmit health information in electronic form in
connection with those services. Accordingly, we agree with your
conclusion that the HIPAA regulations do not apply in this context.
Compare Tex. Atty. Gen. Op. ORD 681, 2004 WL 292160 (municipal
EMS provider that transmits health information electronically is "covered
entity" under HIPAA).
[3] The Medical Records Law does not apply to medical records held
by the County Fire Department other than in its capacity as a "provider"
of medical care. See 71 Opinions of the Attorney General 297, 301 n.6
(1986).
[4] We understand that only the name of the 911 caller appears in the
dispatch record that is the subject of your request, although some
descriptive information about the individual in need of assistance also
appears in the record.
[5] An ambulance run sheet may fit the definition of a "medical
record," particularly if it records information concerning the patient's vital
signs and any treatment administered by ambulance personnel and if it is
intended to be included in the receiving hospital's chart. See 2001 Ohio
Op. Atty. Gen. No. 041, 2001 WL 1246071 (ambulance run sheet may be
a medical record exempt from disclosure under Ohio public records law).
[6] Compare 22 Kan. Op. Atty. Gen. 37, 1988 WL 429767 (identities
of persons transported by an emergency medical services vehicle are
subject to disclosure under Kansas open records law); with Neb. Atty.
Gen. Op. 116, 1985 WL 168601 (name and treatment afforded patient in
county-run ambulance should be redacted from response to public records
request).
[7] In the situation that prompted your request, we have not had
access to the redacted information - and properly so, if it is indeed
medical information about an individual. Therefore, we do not assess the
merits of the claimed exemption in this particular case. If the matter were
litigated, a court could review the redacted information in camera to
determine the merits of the asserted exemption.
[8] Although the federal HIPAA regulations on medical record
privacy are not directly applicable here, see footnote 2 above, they would
lead to the same conclusion. Those regulations anticipate that medical
information concerning a patient could be disclosed in certain
circumstances when the information is adequately "de-identified" - i.e.,
the medical information is sufficiently removed from any patient-
identifying information that it becomes impossible to associate the
medical information with a particular patient. See 45 CFR §164.514(a)-
(b). Under those regulations, a record including a street address would not
be adequately de-identified. 45 CFR §164.514(b)(2)(i)(B). Similarly,
federal regulations governing the confidentiality of patient records related
to drug and alcohol abuse programs define "patient-identifying
information" to include an address. 42 CFR §2.11.
[9] That provision reads:
The official custodian may permit inspection of
personal records for which inspection otherwise is
not authorized by a person who is engaged in a
research project if:
(1) the researcher submits to the official
custodian a written request that:
(i) describes the purpose of the research
project;
(ii) describes the intent, if any, to publish
the findings;
(iii) describes the nature of the requested
personal records;
(iv) describes the safeguards that the
researcher would take to protect the identity of the
persons in interest; and
(v) states that persons in interest will not
be contacted unless the official custodian
approves and monitors the contact;
(2) the official custodian is satisfied that the
proposed safeguards will prevent the disclosure of
the identity of the persons in interest; and
(3) the researcher makes an agreement with
the unit or instrumentality that:
(i) defines the scope of the research
project;
(ii) sets out the safeguards for protecting
the identity of the persons in interest; and
(iii) states that a breach of any condition
of the agreement is a breach of contract.
SG §10-624(e). For these purposes, "personal record" is defined as a
record that names an individual or, "with reasonable certainty," identifies
the individual by an address, description, finger or voice print, number, or
picture. SG §10-624(a).
[10] You indicated that the child who was the subject of the record
is now deceased.
[11] We make two additional observations concerning the Medical
Records Law. First, the definition of "person in interest" in the Medical
Records Law also includes a "duly appointed personal representative of
a deceased person." HG §4-301(k)(3). If a mother whose parental rights
had been terminated somehow gained appointment as the personal
representative of a deceased child, she would be a person in interest in that
capacity.
Second, apart from the authority granted to a person in interest, the
Medical Records Law also allows for disclosure of medical records to the
immediate family of a patient, unless the patient has instructed to the
contrary, if the disclosure is "made in accordance with good medical or
other professional practice." HG §4-305(b)(7). However, even if a
mother whose parental rights had been terminated could still have access
to a child's medical records as an "immediate family member" under this
provision, rather than as a "person in interest," she would be prohibited
from redisclosing the records to others, except in very limited
circumstances. HG §4-302(d).
[12] The definition of "person in interest" in the PIA differs slightly
from the definition in the Medical Records Law. The PIA provides, in
pertinent part:
"Person in interest" means:
(1) a person or governmental unit that is the
subject of public record or a designee of the
person or governmental unit;
(2) if the person has a legal disability, the parent
or legal representative of the person....
SG §10-611(e). However, we do not believe that this difference enlarges
the category of persons who would have access to a medical record or
medical information.
Get today's answer for your situation
You just read a 2005 opinion on this question. Ezel checks the current Maryland statutes and case law and answers your specific situation, with citations.
Opens in Ezel Pro. Every answer cites the law it relies on.