Did a small South Carolina jail have to disclose the names of medications given to detainees under FOIA?

View original AG opinion (PDF)

Plain-English summary

Fairfield County asked in 2014 about a FOIA request for the names of drugs dispensed in its small jail. The county could remove detainees' names, but worried that outsiders who knew the detainees might infer a person's medical condition from a drug list. The Attorney General did not order release or withholding. It said protection as a medical record depended on whether information could identify a particular patient, and whether the state FOIA privacy exemption applied was a factual question for a court.

The office also examined HIPAA's rules for protected health information. It described permitted disclosure of properly de-identified information unless a covered entity had actual knowledge that remaining information, alone or with other records, could identify someone. It predicted that state public records law would likely control a conflict with HIPAA, but treated the relationship as unsettled. For guidance on privacy under FOIA, it discussed federal decisions, including a D.C. Circuit ruling that rejected withholding based on mere speculation about a person's medical condition.

Currency note

This opinion was issued in 2014. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Did removing detainees' names automatically make the drug list public?
A: No. The opinion asked whether the remaining information could still be tied to an individual, including when combined with other known information.

Q: Could the jail withhold the list because someone might guess a medical condition?
A: The office described a possible privacy exemption and discussed a D.C. Circuit ruling that rejected withholding based on mere speculation about a person's medical condition. It said the facts of this request required a court's determination.

Q: Did HIPAA itself resolve the FOIA request?
A: The opinion analyzed HIPAA's de-identification rules and predicted that South Carolina FOIA would likely govern if the laws appeared to conflict. It did not make a final disclosure determination.

Background and legal framework

The opinion began with FOIA's presumption of access to public records and examined exclusions for records closed by law and an exemption for unreasonable invasions of personal privacy. It then compared the state standard with federal privacy cases and HIPAA's actual-knowledge test for de-identified data. The county raised the facility's small population as a concern. The office said whether the information could identify a person was a factual question it could not resolve.

Citations and references

The opinion discussed the privacy and legal-exemption provisions of S.C. Code Ann. § 30-4-40 and HIPAA's privacy regulations.

Official title

Regarding a Freedom of Information Act request that was received by the Fairfield County Detention Facility.

Requester

John E. James, III, County Attorney for Fairfield County.

Source

• Landing page: https://www.scag.gov/opinions/opinions-archive/december-4-2014/
• Original PDF: https://www.scag.gov/wp-content/uploads/2014/12/James-J.-OS-9757-FINAL-Opinion-12-4-2014-Crosswell-00504360xD2C78.pdf

Original opinion text

Alan Wilson
Attorney General

December 4, 2014
Mr. John E. James, III
County Attorney for Fairfield County

Post Office Drawer 329

.

Winnsboro, SC 29180
Thank you for your letter dated March 19, 2014 requesting an opinion of this Office concerning a Freedom of Information Act request that was received by the Fairfield County Detention Facility. Specifically, you state the following: Fairfield County has a somewhat small detention facility that has received a Freedom

of

Information

Act

request

concerning

the

drug

names

of

pharmaceuticals dispensed to detainees in the facility. While we can certainly redact the names of the detainees in providing this information, the concern raised

is that while the information disseminated would not identify detainees, because the population of the facility is generally small, it could conceivably provide

health information to outsiders with a general knowledge of an inmate's condition through the process of elimination.

In other words, if a person wants to know

what medicine a detainee is taking and is aware or believes that he or she has a certain condition, a review of the medicine received and given out as a whole through the Freedom of Information request could lead one to narrow down the possibilities enough to pinpoint a certain detainee's private medical condition.

In essence, while no individually identifiable medical information would intentionally be disclosed, it could be possible that a broad disclosure, as requested in our case, could provide an inadvertent release. Your assistance and counsel on this question would be appreciated.

While office policy prevents us from reaching a conclusion relating to any questions of fact that arise from your inquiry, we will summarize the law on the subject and provide our opinion of how a court may rule on the matter. See Op. S.C. Att'y Gen.. 2006 WL 2849809 (Sept. 14, 2006) ("[investigations and determinations of facts are beyond the scope of an opinion of this Office and are better resolved by a court."). Law / Analysis

L

'

General Application of the FOIA

The Freedom of Information Act ("the FOIA" or "the Act") provides any person the

"right to inspect or copy any public record of a public body, except as otherwise provided by §

Rembert C. Dennis Building

»

Post Office Box 11549
w

•

Columbu
<?r oqo i i i^q
COLUMBIA, SC 29211-1549

•

-p
Telephone 803-734-3970

•

Facsimile 803-253-^

Mr. John E. James, III
Page 2
December 4, 2014

30-4-40." S.C. Code Ann. § 30-4-30 (2007) (emphasis added).

The Legislature has identified

that the purpose of the Act is to ensure "public business be performed in an open and public manner so that citizens shall be advised of the performance of public officials and of the

decisions that are reached in public activity and in the formulation of public policy." S.C. Code Ann. § 30-4-15 (2007).

In other words, as our Supreme Court has clarified, "[t]he essential

purpose of the FOIA is to protect the public from secret government activity." Lambries v.

Saluda County Council. 409 S.C. 1, 8-9, 760 S.E.2d 785, 789 (2014) (citing Wiedemann v. Town of Hilton Head Island. 330 S.C. 532, 500 S.E.2d 783 (1998)).

The Supreme Court has also

instructed that the "FOIA is remedial in nature and should be liberally construed to carry out the purpose mandated by the legislature." Quality Towing. Inc. v. City of Myrtle Beach. 345 S.C.

156, 161, 547 S.E.2d 862, 864-65 (2001) (citations omitted). As noted above, the FOIA applies to a "public body," which is defined as: any department of the State, a majority of directors or their representatives of

departments within the executive branch of state government as outlined in Section 1-30-10, any state board, commission, agency, and authority, any public or governmental body or political subdivision of the State, including counties,

municipalities, townships, school districts, and special purpose districts, or any organization, corporation, or agency supported in whole or in part by public funds or expending public funds ....

S.C. Code Ann. § 30-4-20(a) (2007). In prior opinions of this Office we have concluded that "a jail or detention center would be considered a 'public body' for purposes of FOIA." Op. S.C. Att'v Gen.. 201 1 WL 2648720 (June 21, 201 1) (quoting On. S.C. Att'v Gen.. 2010 WL 3048335 (July 19, 2010)).

We drew support for this conclusion from Burton v. York County Sheriffs

Dep't 358 S.C. 339, 594 S.E.2d 888 (Ct. App. 2004), which held a sheriffs office is deemed a "public body" as defined by the FOIA. Op. S.C. Att'v Gen.. 2010 WL 3048335 at *2 (July 19,

2010).

We also looked to Florence Morning News. Inc. v. Building Comm'n of the City and County of Florence. 265 S.C. 389, 218 S.E.2d 881 (1975), where the Supreme Court affirmed that a jail book was a public record within the meaning of the FOIA and that any interested person had a statutory right to inspect a copy of the original jail book rather than a copy of the daily entries. Op. S.C. Att'v Gen.. 2010 WL 3048335 at *2 (July 19, 2010).

If classified as a "public body," the FOIA requires disclosure, upon request, of "any public record" unless an exception applies. S.C. Code Ann. § 30-4-30(a) (2007). The FOIA

defines the term "public record" as "all books, papers, maps, photographs, cards, tapes, recordings, or other documentary materials regardless of physical form or characteristics prepared, owned, used, in the possession of, or retained by a public body." S.C. Code Ann. § 304-20(c) (2007). However, the definition of "public record" also contains the following provision categorizing certain information which by law is "closed to the public" and thus "not considered to be made open to the public under the provisions of this act:"
[rjecords such as income tax returns, medical records, hospital medical staff reports, scholastic records, adoption records, records related to registration, and circulation

of library materials which contain names

or

other personally

Mr. John E. James, III

Page 3
December 4, 2014

identifying details regarding the users of public, private, school, college, technical

college, university, and state institutional libraries and library systems, supported in whole or in part by public funds or expending public funds, or records which reveal the identity of the library patron checking out or requesting an item from the library or using other library services, except nonidentifying administrative

and statistical reports of registration and circulation, and other records which by law are required to be closed to the public are not considered to be made open to

the public under the provisions ofthis act.
Id. (emphasis added).

Several categories of information are also identified as exempt from disclosure under the FOIA. See S.C. Code Ann. § 30-4-40 (2007 & Supp. 2013).

Such matters include, but are not

limited to, personal information that would constitute an unreasonable invasion of personal privacy if disclosed; trade secrets; law enforcement records obtained in the process of an investigation; privileged communications, protected information, or a protected identity as

defined by Section 23-50-45; certain contractual and proprietary data; and matters specifically exempted from disclosure by statute or law. Id However, the FOIA exemptions do not provide a blanket prohibition of disclosure of the entire record containing exempted material. See Beattie v. Aiken County of Social Services. 319 S.C. 449, 453, 462 S.E.2d 276, 279 (1995) (citations

omitted).

The Legislature has made clear that any nonexempt information should be separated

from exempt material and made available to the requesting party. See S.C. Code Ann. § 30-440(b) (2007).

Thus, in summary of the above information, analysis of the FOIA's application turns on whether the information requested (1) is held by an entity that classifies as a "public body;" (2) falls under the definition of a "public record;" and (3) is not exempt from disclosure. Based on prior opinions of this office, we continue to opine that a detention facility would constitute as a

public body pursuant to S.C. Code Ann. §.30-4-20(a) (2007). See Op. S.C. Attv. Gen.. 2006 WL 2849807 (September 29. 20061 ("This Office[ ] recognizes a long-standing rule that we will not

overrule a prior opinion unless it is clearly erroneous or a change occurred in the applicable law.").

Therefore, any record prepared, owned, used, in the possession of, or retained by the

Fairfield County Detention Facility falling within the definition of a public record would be subject to disclosure to a requester unless such information falls within an exemption listed in S.C. Code Ann. § 30-4-40 (2007). This being the case, we turn our analysis to whether a court

would likely find "drug names of pharmaceuticals dispensed to detainees" to be a "public record" and if so, whether a court would likely find such information is exempted from disclosure under S.C. Code Ann. § 30-4-40 (2007). We presume records of drug names dispensed to detainees would classify as information "owned, used, in the possession of, or retained" by the Fairfield County Detention Facility and therefore would fit within the general definition of a public record.

However, whether such

information would be considered "medical records" and thus "by law" outside the scope of the public record definition is worthy of discussion. See S.C. Code Ann. § 30-4-20(c) (2007)

("Records such as . . . medical records . . . and other records which by law are required to be closed to the public and not considered to be made open to the public under the provisions of [the

Mr. John E. James, III

Page 4
December 4, 2014

FOIA].").
In Perry v. Bullock. 409 S.C. 137, 761 S.E.2d 251 (2014), our Supreme Court recently

addressed whether an autopsy report would be considered a "medical record" and therefore closed to the public pursuant to the FOIA's public record definition. In its analysis, the Court was bound to the "normal and customary" definition of "medical record" due to the absence of a definition within the statute. Id. at 253 (citations omitted).

Therefore, looking to the plain

meaning of medical record - defined by Merriam-Webster as " 'a record of a patient's medical

information (as medical history, care or treatments received, test results, diagnoses, and medications taken)' " - the Court concluded that the autopsy report "fit neatly within that general understanding of medical records." Id. Furthermore, the Court noted that "an autopsy, which is

performed by a medical doctor, is a thorough and invasive inquiry into the body of the decedent which reveals

extensive medical information,

such as the presence

medications and any evidence of treatments received

of any

diseases or

"Id. From the ordinary meaning of the

term "medical record" and the finding that an autopsy report reveals significant medical

information of a decedent, the Court concluded that the autopsy report in question was not a public record under the FOIA, and it was therefore not required to be disclosed to the requester. Id. at 254. Following this analysis, to classify as a "medical record" which would thereby put the information outside of the "public record" definition and exempt it from disclosure, it is our opinion that the information must identify a particular "patient's medical information." Justice Pleicones's dissenting opinion in Perrv v. Bullock also raises an important point

in relation to disclosure of medical records under the FOIA.

Specifically, he clarified that

records that are closed to the public within the FOIA's "public record" definition are "records which by law are required to be closed to the public." Id at 255 (emphasis added). Analogous with this construal, it appears the items listed within the public record definition which by law are closed to the public - i.e. "tax returns, medical records, hospital medical staff reports, scholastic records, adoption records, records related to registration, and circulation of library materials which contain names or other personally identifying details ...."- are statutorily

protected from disclosure outside of the FOIA by other areas of federal and South Carolina law.1 In addition, our State's FOIA exemptions include "[m]atters specifically exempted from

disclosure by statute or law." S.C. Code Ann. § 30-4-40(a)(4) (2007). As a result, we will turn our analysis to whether drug names of pharmaceuticals dispensed to detainees would likely classify as a record which by law is required to be closed to the public thereby exempting such information from disclosure.

Specifically, we will look to the federal Health Insurance

Portability and Accountability Act of 1996 (the "HIPAA") as it established a set of national standards for the protection of certain health information.

1 See, e.g.. 26 U.S.C.A. § 6103 (providing for the confidentiality and prohibition of disclosure of tax returns); Pub. L. No. 104 191, 1 10 Stat. 1936 (1996) (codified in scattered sections of 26, 29, and 42 U.S.C.) (establishing the federal Health Insurance Portability and Accountability Act of 1 996 which creates national standards for the protection of certain health information); S.C. Code Ann. § 44-22-100(A) (requiring the confidentiality of certain "[c]ertificates, applications, records, and reports made for the

purpose of this chapter. . . and directly or indirectly identifying a mentally ill or alcohol and drug abuse patient or former patient or individual whose commitment has been sought must be kept confidential and must not be disclosed

. . . ."); 20 U.S.C.A. §

1232g (containing the Family Educational Rights and Privacy Act which regulates the release of student records); S.C. Code Ann. § 63-9-780 (requiring confidentiality of hearings and records in adoption proceedings absent a showing of good cause); S.C. Code Ann. § 60-4-10 (establishing the confidentiality of certain library records).

Mr. John E. James, III
Page 5

December 4, 2014

II.

General Application of the HIPAA
The HIPAA and the regulations the Department of Health and Human Services ("HHS")

have promulgated to implement the HIPAA - the regulations are collectively known as the Privacy Rule - prevent

"covered

entities"

from

using or disclosing "protected health

information" unless an exception applies. 45 C.F.R. 164.502(a).

Classification as a "covered

entity" extends to a health plan, a health care clearinghouse, or a health care provider that

transmits any health information in electronic form in connection with a transaction covered by HIPAA.

45

C.F.R.

§

160.103.

Such "covered entities" are prevented from disclosing

"individually identifiably health information, held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral." U.S. Dep't of Health and Human Services, Office for Civil Rights, Summary Of The HIPAA Privacy Rule 3

(2003),

available

at

http://www.hhs.gov/ocr/privacysummary.pdf;

45

C.F.R.

§

164.502.

Furthermore, individually identifiable health information is defined as:

information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and

(i) That identifies the individual; or
(ii) With respect to which there is a reasonable basis to believe the information

can be used to identify the individual.
45 C.F.R. § 106.103. The Privacy Rule calls this information "protected health information" or "PHI." U.S. Dep't of Health and Human Services, Office for Civil Rights, Summary Of The

HIPAA Privacy Rule 3 (2003), available at http://www.hhs.gov/ocr/privacysummary.pdf. While covered entities cannot disclose PHI without authorization of the individual unless an exception applies,

the regulations distinguish that there are no restrictions on the use or

2 Exceptions include compliance with a court order, subpoena, or summons; when responding to an administrative subpoena, investigative demand, or other administrative request; for a proceeding before a health oversight agency; for law enforcement

purposes; covered entities can share PHI in order to provide treatment, refer patients for treatment, coordinate patient care, for payment purposes, for use in a facility directory that can be used to let others know if a person is in the facility and the person's general condition, and as necessary to identify or locate family members or others responsible for an individual's care; providers can share PHI to prevent imminent and serious threats to public health and safety; and if a covered entity is a party in a lawsuit, PHI can be disclosed as part of its health care operations. In all instances, the HIPAA sets our specific requirements regarding the information that can be disclosed and to whom it can be disclosed.

Information, in some cases, must be limited as much as

possible for disclosure purposes. See 45 C.F.R. § 164.512.

3 Additionally, the HIPAA defines the term "correctional institution" ("any penal or correctional facility, jail, reformatory, detention center, work farm, halfway house, or residential community program" operated by or under contract to federal, state, municipal, or Native American tribal government") and "inmate" ("any person incarcerated in or otherwise confined to a correctional institution")

and includes instances when a covered entity can disclose PHI to a correctional institution or law

enforcement official. These instances include the provision of health care to inmates, the health and safety of inmates, the health

and safety of staff at the correctional institution, the health and safety of persons responsible for the transporting of inmates from one institution, facility, or setting to another, for law enforcement on the premises of the correctional institution, and for the

Mr. John E. James, III
Page 6

December 4, 2014

disclosure of de-identified health information that neither identifies nor provides a reasonable basis to identity an individual. 45 C.F.R. § 164.502(d); § 164.514. Two methods exist to deidentify information and include a formal determination by a qualified statistician or the removal

of specific identifiers4 of the individual and of the individual's relatives, household members, and employers. 45 C.F.R. 164.514(b). The later method is only adequate if "[t]he covered entity

does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information." 45 C.F.R. 164.514(b)(2)(ii). In application of the above information, for a detention facility to be covered by HIPAA, it must fall within one of the three categories of a "covered entity." See 45 C.F.R. § 160.103. Presumably outside of the definition of a "heath care cleaning house" or a "health plan," we look to the third category being a health care provider performing one of the electronic standard transactions.

See id

If the detention facility electronically transmits standard

transactions or if it has a contract or other agreement with a health care provider that transmits

health care information electronically, it presumably will be required to abide by the HIPAA regulations. This is a question of fact to be considered on a case-by-case basis and is therefore outside of the scope of this opinion. If it is determined that the detention facility is governed by the HIPAA, it would generally be prohibited from disclosure of PHI unless an exception applies. See U.S. Dep't of Health and Human Services, Office for Civil Rights, Summary Of The HIPAA Privacy Rule 3 (2003), available at http://www.hhs.gov/ocr/privacysummary.pdf; 45 C.F.R. § 164.502; 45 C.F.R. § 164.512 (listing exceptions);

45 C.F.R. 164.512(k)(5) (listing exceptions

specific to "inmates" confined in a "correctional institution"). However, a formal determination that the information has been de-identified by a qualified statistician or properly redacted de-

identified information, so long as the covered entity does not have actual knowledge that the remaining information could be used alone or with other information to identify the individual,

can be disclosed. 45 C.F.R. 164.514(b)(2)(ii).

Whether a covered entity has such actual

knowledge in reference to redacted de-identified information is also a question of fact that can only be determined by a court. III.

Circular Reference Between the HIPAA and the FOIA

Even if information is considered protected under the HIPAA, what has been referred to as "circular reference" between the HIPAA and state public records laws creates ambiguity in

which law prevails. See State Cincinnati Enquirer v. Daniels. 108 Ohio St.3d 518, 524, 844 N.E.2d 1181, 1187 (Ohio 2006) ("[W]e are confronted here with a problem of circular reference because the Ohio Public Records Act requires disclosure of information unless prohibited by federal law, while federal law allows disclosure of protected health information if required by state law."). Our State's FOIA protects information from disclosure that is exempted from disclosure by statute or law. See S.C. Code Ann. § 30-4-20(c) (2007); S.C. Code Ann. § 30-440(a)(4). This suggests that if a document is protected from disclosure under the HIPAA, the

protection would stand despite an alternate conclusion reached under the FOIA.

On the other

hand, the Privacy Rule allows for disclosure of identifiable medical records if "disclosure is administration and maintenance of the safety, security, and good order of the correctional institution. 45 C.F.R. 164.512(k)(5); 45 C.F.R. 164.501 (defining correctional institution and inmate).

4 "Identifiers" are listed in 45 C.F.R. 164.514(b)(2)(i)(A)-(R).

Mr. John E. James, III
Page 7

December 4, 2014

required' by law and the use or disclosure complies with and is limited to the relevant requirements of such law." 45 C.F.R. § 164.512(a)(1).

Thus, this Privacy Rule provision

implementing the HIPAA seems to defer to the FOIA for records covered by it. This conclusion is strengthened by the preamble of the Privacy Rule where the HHS indicated its intention in creating the Privacy Rule was to "preserve access to information considered important enough by state or federal authorities to require its disclosure by law," that HHS did not "believe that Congress intended to preempt each such law," and that the Privacy Rule was intended to "avoid any obstruction to the health plan or covered health care provider's ability to comply with its

existing legal obligations."

65 Fed. Reg. 82462, 82667-68.

We have found two state courts faced with the issue of a conflict between HIPAA and FOIA, both of which concluded that their state's public information law controlled whether access to the record at issue was permitted. See, ^g., Abbot v. Texas Dept. of Mental Health and Mental Retardation. 212 S.W.Sd 648 (Tex. App. 2006) (holding that even assuming the records

at issue constituted protected health information under the HIPAA and the Privacy Rule, the information was subject to disclosure under Texas' Public Information Act as federal privacy regulations permitted disclosure of protected health information if "required by law" as long as the disclosure comported with the requirements of that law, no law rendered the statistical

information confidential within the meaning of the Public Information Act's confidentiality exception, and no other exception to disclosure in the Act applied); State Cincinnati Enquirer v.

Daniels. 108 Ohio St. 3d 518, 844 N.E.2d 1181 (Ohio 2006) (holding that "even if the records did contain protected health information, they would still be subject to release [under Ohio's FOIA] in accordance with the 'required by law' exception to HIPAA.").

Several Attorney General Opinions written on the subject of conflicts between state public information laws and the HIPAA have also reached the conclusion that their public

information law would ultimately control access to the records at issue. See Op. Kv. Att'v Gen.. 2008 WL 3865859 (Aug. 13, 2008); On. Neb. A'ttv Gen.. 2004 WL 908403 (April 20, 2004);

On. Tex. Att'v Gen.. 2004 WL 292160 (Feb, 13, 2004); (concluding, in all three opinions, that the "required by law" language of the HIPAA deferred to their state's open records law).

While to our knowledge South Carolina courts have not addressed the "circular reference" issue between the FOIA and the HIPAA, the rulings of other state courts, the preamble of the Privacy Rule, the conclusions reached by Attorney General opinions of other states, and our state's favoritism of disclosure under the FOIA indicate the likelihood that a South Carolina court would find that to the extent disclosure is required by our state's Freedom of Information Act, covered entities would be required to disclose health information under the "required by law" exception to the HIPAA.

IV.

The FOIA Privacy Exemption

Pursuant to the analysis of the HIPAA's "required by law" exception, we turn back to the FOIA to discuss whether records of prescriptions distributed to detainees would likely be subject

to disclosure under the FOIA. Again, the FOIA requires a public body to disclose public records unless an exception applies. See S.C. Code Ann. § 30-4-30(a) (2007). Our courts have explained

Mr. John E. James, III

Page 8
December 4, 2014

that "[t]he determination of whether documents or portions thereof are exempt from the FOIA must be made on a case-by-case basis." City of Columbia v. ACLU of South Carolina. Inc.. 323 S.C. 384, 387, 475 S.E.2d 747, 749 (1996) (citation omitted). Furthermore, "[t]he exemptions to FOIA should be narrowly construed to ensure public access to documents." Seago v. Horry County. 378 S.C. 414, 423, 663 S.E.2d 38, 42 (2008) (citation omitted). It has also been clarified that "[t]he exemptions impose no duty not to disclose but simply allow the public agency the

discretion to withhold exempted material from disclosure." S.C. Tax CormrTn v. Gaston Cooper Recycling Com.. 316 S.C. 163, 169, 447 S.E.2d 843, 846 (1994). The FOIA exemptions are enumerated in S.C. Code Ann. § 30-4-40 (2007 & Supp. 2013).

In addition to the exemption for "[m]atters specifically exempted from disclosure by

statute or law" discussed above, we believe the "privacy exemption" is also relevant to the issues discussed herein. Specifically, the privacy exemption states that a public body may exempt from

disclosure:

information of a personal nature where the public disclosure thereof would constitute unreasonable invasion of personal privacy. Information of a personal nature shall include, but not be limited to, information as to gross receipts contained in applications for business licenses and information relating to public

records which include the name, address, and telephone number or other such information of an individual or individuals who are handicapped or disabled when the information is requested for person-to-person commercial solicitation of

handicapped persons solely by virtue of their handicap. This provision must not be interpreted to restrict access by the public and press to information contained

in public records.
S.C. Code Ann. § 30-4-40(2) (2007). We have previously opined on the privacy exemption. See On. S.C. A'ttv Gen.. 2011 WL 6959371 (Dec. 5, 2011).

In that opinion, we noted that

"[bjecause the statute does not otherwise specifically identify or describe the types of materials encompassed by the so-called 'privacy exemption,' we look to general privacy principles for guidance." Id. at *3 (citing Burton v. York County Sheriffs Dept., 358 S.C. 339, 352, 594

S.E.2d 888, 895 (Ct. App. 2004)). We went on to note that "[o]ur Supreme Court has defined the right to privacy as the right of a person to be let alone and free from unwarranted publicity." Id. (citing Sloan v. S.C. Dent. Pub. Safety. 355 S.C. 321, 325, 586 S.E.2d 108, 110 (2003)). "One of the primary limitations placed on the right to privacy is that it does not prohibit the publication of matter which is of a legitimate public or general interest." Id (quoting Society of Prof 1 Journalists v. Sexton. 283 S.C. 563, 566, 324 S.E. 2d 313, 315 (1984)).

"A balancing

test is used to determine whether the 'public's need to know' outweighs the individual's privacy interest in nondisclosure." Id (citing Burton. 358 S.C. at 352, 594 S.E.2d at 896; Meetze v.

Associated Press. 230 S.C. 330, 336-37, 95 S.E.2d at 606, 609 (1956)).

In addition, for the

purpose of distinguishing the class that was the subject of the opinion, we noted that patients are in a class generally identified by the courts as having significant privacy rights. Id at *4 (citing Hollman v. Woolfson. 384 S.C. 571, 578, 683 S.E.2d 495, 499 (2009) (stating that "[b]oth the State and Federal Government have recognized the importance of the privacy rights of patients," and that the nonparty patients in the case "ha[d] a valid and legitimate expectation that their

Mr. John E. James, III
Page 9
December 4, 2014

medical information will remain confidential"). For purposes of this opinion, we point out that the United State Supreme Court has held that convicted inmates and pretrial detainees alike are subject to curtailed constitutional privacy rights while detained. See Bell v. Wolfish. 441 U.S. 520, 99 S.Ct. 1861 (1979). This is exemplified within the HIPAA in that an inmate is entitled to

slightly different privacy rights in comparison to other individuals. See 45 C.F.R. 164.512(k)(5). As we are unaware of any cases specifically addressing the privacy interest with regards

to the information in question under South Carolina's FOIA, we will look to Federal case law for guidance. See Op. S.C. A'ttv Gen.. 2011 WL 6959371

(Dec. 5, 2011) (noting that "we

occasionally look to similar federal case law interpreting the Federal FOIA to interpret our State's FOIA where a purported privacy interest is involved"). Exemption Six under the Federal FOIA exempts from disclosure "personnel and medical files and similar files the disclosure of

which would constitute a clearly unwarranted invasion of personal privacy." 5 U.S.C. § 552(b)(6). In McCann v. U.S. Dept. Health and Human Services. 828 F.Supp.2d 317, 322 (D.D.C. 2011) the court explained that analysis under Exemption Six rests on the following criteria: (1) the information must be contained within personnel and medical files and similar

files;5 (2) the disclosure of the information would constitute a clearly unwarranted invasion of personal privacy; and (3) if the first two requirements are met, the privacy interest must be weighed against the public interest in disclosure. Id.

In McCann. the court found that witness

interview summaries containing personal information about individuals interviewed by HHS as part of an investigation into alleged HIPAA violations were protected under Exemption Six

because disclosure of what the court deemed to be personnel, medical, or similar files would have resulted in an invasion of personal privacy where individuals interviewed were applicant's co-workers making them easily identifiable. Id.

Furthermore, the court found the requestor's

desire to determine the diligence of the agency's investigations did not present a public interest

to trigger the balancing requirement. Id at 323.
In Richardson v. U.S. Dep't of Justice. 730 F.Supp.2d 225, 239 (D.D.C. 2010), the court held that the Executive Office for the United States Attorneys ("EOUSA") properly withheld records described as "medical records of a third party individual," under the Federal FOIA's Exemption Six.

While the requestor indicated he only sought a description of the third party's

wounds as was contained in the record and that he had no objection to the redaction of all

personal information, the Court determined that he failed to explain how the EOUSA could release the requested information without revealing not only the identity of the third party whose

privacy interest was at stake but also the third party's personal medical information. Id Furthermore, the Court found that there was no "dispute that this third party has a recognized

privacy interest in avoiding disclosure of personal information." Id (citing Judicial Watch. Inc. v. FDA. 449 F.3d 141, 152-53 (D.C. Cir. 2006)). The case we have discovered with the closest fact pattern to the one you have described in your correspondence is Arieff v. U.S. Dep't of the Naw. 712 F.2d 1462, 229 U.S. App. D.C.

5 "The Supreme Court has read Exemption 6 broadly, concluding that propriety of an agency's decision to withhold information does not 'turn upon the label of the file which contains the damaging information.'" Judicial Watch. Inc. v. FDA.

449 F.3d 141, 152 (D.C. Cir. 2006) (quoting U.S. Dent, of State v. Wash. Post Co.. 456 U.S. 595, 601, 102 S.Ct. 1957, 1957 (1982)).

Furthermore, all information that "applies to a particular individual" meets the threshold requirement for Exemption 6

protection. U.S. Dept. of State v. Wash. Post Co.. 456 U.S. 595, 602, 102 S.Ct. 1957, 1957 (1982).

Mr. John E. James, III
Page 10
December 4, 2014

430 (D.C. Cir. 1983). With Justice Scalia, then D.C. Circuit Court of Appeals Judge, writing for the majority, the Court reversed the District Court's finding that the Navy was authorized to withhold from disclosure under a FOIA request certain inventory control documents containing the names and amounts of prescription drugs shipped to the Office of Attending Physicians to the

United States Congress (OAP) by the National Naval Medical Center (NNMC). Id. at 1469, 229 U.S. App. D.C. at 437.

The D.C. Circuit disagreed with the District Court's finding that

disclosure would constitute a clearly unwarranted invasion of personal privacy under the FOIA's

Exemption Six being that the identification of certain drugs would enable identification of the medical

conditions

of particular individuals.

Id.

at

1466, 229 U.S. App. D.C.

at 434.

Alternatively, the D.C. Circuit reasoned that the invocation of Exemption Six "requires threats to privacy interests more palpable than mere possibilities." Id. at 1467, 229 U.S. App. D.C. at 435 (citing Dep't of the Air Force v. Rose. 425 U.S. 352, 380 n. 19, 96 S.Ct. 1592, 1608 n.19

(1976)).

The Court went on to state that "even if each of the drugs listed was prescribable for

only a single disease, that alone would not establish any more than a possibility that the presence

of the drug on the inventory would be. . . the missing link for a person with fragmented knowledge to identify the disease suffered by a particular beneficiary." Id. at 1467, 229 U.S. App. D.C. at 435 (internal quotations omitted).

The Court also distinguished Exemption Six from the standard applicable to another exemption, noting that Exemption Six requires a showing that disclosure would constitute a clearly unwarranted invasion of personal privacy. Id at 1467, 229 U.S. App. D.C. at 435.

It

stated that it need not go into "how probable identification of the subject need be in order to

establish a mere possibility to render Exemption 6 applicable" reasoning that "if language has any meaning, merely being one of 600 persons who are entitled to use pharmacological services

that have probably prescribed a particular drug that is exclusively used for a single ailment is not enough." Id at 1467-68, 229 U.S. App. D.C. at 435-36. The D.C. Circuit also rejected the District Court's alternate holding that even absent any

likelihood of identifying the medical condition of a particular individual, the mere speculation concerning individuals' medical conditions that the release of records would produce would constitute a clearly unwarranted invasion of privacy. Id at 1468, 229 U.S. App. D.C. at 436. In support of its rejection of the District Court's alternate holding, the Court stated that the statute makes clear that "it is the very 'production' of the documents which must 'constitute a clearly

unwarranted invasion of personal privacy.' Obviously, that can only occur when the documents disclose information attributable to the individual." Id (citing 5 U.S.C. § 552(b)(6)). In regards to the public interest supported by disclosure of the information, the Court noted Appellant's "relatively strong" position to the public "knowing, among other things, the

quantities of prescription drugs made available cost-free to Beneficiaries; the extent to which OAP prescribed name brand drugs as opposed to less costly "generic" drugs; and whether OAP

prescribes drugs which the Food and Drug Administration had found to lack evidence of effectiveness for the recommended use." Id at 1468, 229 U.S. App. D.C. at 436. In response to the Appellant's argument, the Court reiterated that "[providing information 'material for

monitoring the Government's activities' is the 'core purpose' of the FOIA." Id (citing Ditlow v. Shuitz. 517 F.2d 166, 172 & n.24 (D.C. Cir. 1975)).

Mr. John E. James, HI
Page 1 1
December 4, 2014

Important to note is that while the Court set aside the District Court's grant of summary

judgment that was in favor of the Navy, it remanded the case on the basis that it was "conceivable that, as to some segregable portions of the records, [the Navy could] establish more than a 'mere possibility' that the medical condition of a particular individual will be disclosed." Id. at 1469, 229 U.S. App. D.C. at 437. But, the Court reiterated that establishing a particular

drug is used exclusively for the treatment of single disease would not alone suffice. Id. Conclusion The Freedom of Information Act requires a public body to disclose public records that are not exempt pursuant to the Act.

The Act excludes from the definition of "public record" any

record closed to the public by law, such as medical records, and similarly provides an exemption for matters specifically exempted from disclosure by statute or law. Our Supreme Court's interpretation of the term "medical record" as used in the public record definition as an example of items closed to the public and not required to be disclosed under the FOIA, leads to the conclusion that classification as a medical record would, in our

opinion, require that the medical information identify a particular individual. As our Supreme Court looked to the plain meaning of the term medical record - defined as "a patient's medical

information (as medical history, care or treatments received, test results, diagnoses, and medications taken)" it follows that the "patient's medical information" would have to be

identifiable to be afforded protection as a "medical record." Furthermore, we looked to the HIPAA as law that could possibly exempt a document

revealing the prescriptions given to detainees from disclosure. Under the HIPAA's protection of personally identifiable health care information, covered entities are prohibited from disclosure of

PHI unless an exception applies. However, covered entities can disclose de-identified PHI formally approved by a statistician or redacted so long as the covered entity does not have actual

knowledge that the information alone or together with other records would reveal the identity of an individual.

Although the HIPAA affords these protections, the preamble of the regulations

the HHS promulgated to effectuate the HIPAA make clear that the Act's purpose was not to interfere with state public records laws.

Attorney General Opinions and state courts we have

discovered that have addressed whether a state's public record law or the HIPAA should control in the event of a conflict have concluded that their state's public record laws control. Given the

guidance of the preamble of the Privacy Rule as well as the precedent of other jurisdictions, it is likely a South Carolina court would reach the same conclusion if faced with the issue of circular reference between the HIPAA and the FOIA.

Thus, looking back to South Carolina's Freedom of Information Act, a public record of a public body must be disclosed unless an exemption applies.

The so-called privacy exemption

under our State's FOIA protects information of a personal nature where public disclosure would constitute an unreasonable invasion of personal privacy. Using case law interpreting the Federal

FOIA's Exemption Six for guidance in interpreting our own privacy exemption for purposes of the questions you raised in your opinion request, it appears courts give great deference to privacy of health care information identifying a particular individual.

However, at least in the view of

the D.C. Circuit Court of Appeals, Exemption Six protection requires more than a "mere

Mr. John E. James, III
Page 12

December 4, 2014

possibility" that the medical conditions of a particular individual will be disclosed.

Whether

information can be attributable to a certain individual and therefore afforded protection under

FOIA's privacy exemption is ultimately a factual determination that can only be resolved by our courts.

We also note that even if judicial interpretation of our State's FOIA concluded that the

HIPAA's privacy rules should govern, de-identified PHI that has been redacted can be disclosed unless the covered entity has "actual knowledge" that the information itself or coupled with other records would reveal the identity of an individual who is a subject of the information.

In that

regard, analysis under the HIPAA also requires a factual determination of whether the records to be disclosed contain information that identifies or could be used with other documents to identify a specific individual.

Again, only a court can decide whether the information requested of the Fairfield County Detention Facility is subject to disclosure under South Carolina's FOIA.

However, consistent

with our State's mandate of liberal construction of the FOIA in favor of disclosure and that the

law imposes no duty on public entities to withhold exempted materials, we have consistently advised public bodies concerning FOIA requests that, "when in doubt, disclose the information

to the public." See,

On. S.C.Atfv Gen.. 201 1 WL 1740747 (April 29, 201 1).

If we can be of further assistance, please do not hesitate to contact our office.

Very truly yours,

Anne Marie Crosswell
Assistant Attorney General
REVIEWED AND APPROVED BY:

Tobert D. Coo
Solicitor General