Did South Carolina FOIA require disclosure of deceased inmates’ names and causes of death?

Plain-English summary

In 2021, the South Carolina Attorney General advised that if the Department of Corrections possessed a list identifying inmates who died in custody and their causes of death, FOIA required disclosure of that information. The office believed a court would likely reject the medical-record and personal-privacy objections to releasing the requested list.

The opinion also addressed the department's possible status as a covered entity under HIPAA. It believed HIPAA permitted disclosure to the extent state law required it, and concluded that FOIA imposed that requirement for the requested information. Its answer concerned the names and causes of death described in the request, not unrestricted access to every inmate medical record.

Currency note

This opinion was issued in 2021. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Did the opinion say the department could withhold a list of inmate deaths as a medical record?
A: No. The office expected a court to reject that characterization for the names and causes of death at issue.

Q: Did inmate privacy exempt the requested death information?
A: The Attorney General said it did not believe the state FOIA privacy exemption covered the requested information.

Q: Did HIPAA prevent disclosure of the names and causes of death?
A: The opinion believed HIPAA allowed disclosure required by state law and advised that FOIA required disclosure if the department possessed the requested list.

Background and statutory framework

The opinion read South Carolina FOIA's disclosure policy, including S.C. Code Ann. § 30-4-15, alongside the statute requiring correctional facilities to record prisoner deaths and causes. It analyzed medical-record and privacy exceptions and then considered the federal HIPAA rule for disclosures required by law. Its conclusion was tied to the requested death information held by the department.

Citations and references

The cited legal authorities and the office's conclusions appear in the linked official opinion. Its analysis addressed the question presented in 2021.

Source

• Landing page: https://www.scag.gov/opinions/opinions-archive/may-14-2021/
• Original PDF: https://www.scag.gov/wp-content/uploads/2021/05/02584295.pdf

Original opinion text

ol

I

r»'

M
O

v

JJl^j ^

*

m;

SPSS

*v>

5P
SOUTH C

<¥
Alan Wilson
Attorney General

May 14, 2021

Bryan P. Stirling
Director

South Carolina Department of Corrections
Post Office Box 21787

Columbia, South Carolina 29221-1787
Dear Director Stirling:
We received your letter requesting an Attorney General's opinion as to "whether or not the South

Carolina Department of Corrections is required or authorized to release the names of inmates who have died in custody due to suicide, overdose, homicide, or any other reason, to the press or any other person pursuant to a general request or Freedom of Information Act ("FOIA") request." Law/Analysis A. South Carolina Freedom of Information Act

South Carolina's "Freedom of Information Act requires a public body to disclose public records that are not exempt pursuant to the Act." On. Att'v Gen.. 2014WL 7210767 (S.C.A.G. Dec. 4, 2014). The preamble to the South Carolina Freedom of Information Act ("FOIA") states: The General Assembly finds that it is vital in a democratic society that public business be performed in an open and public manner so that citizens shall be advised of the performance of public officials and of the decisions that are reached in public activity and in the formulation of public policy. Toward this end, provisions of this chapter must be construed so as to make it possible for citizens, or their representatives, to learn and report fully the activities of their public officials at a minimum cost or delay to the persons seeking access to public documents or meetings.

S.C. Code Ann. § 30-4-15 (2007). As our Court of Appeals remarked in Campbell v. Marion County Hospital District. 354 S.C. 274, 280, 580 S.E.2d 163, 166 (Ct. App. 2003), "[t]he essential purpose of the FOIA is to protect the public from secret government activity." The Supreme Court, Rembert C. Dennis Building

.

Post Office Box 11549

• Columbia, SC 2921 1-1549

. Telephone 803-734-3970

. Facsimile S03-253-62S3

Page 2

May 15, 2021

in New York Times Co. v. Spartanburg Ctv. Sch. Dist. No. 7. 374 S.C. 307, 311, 649 S.E.2d 28, 30 (2007), explained:

FOIA is remedial in nature and should be liberally construed to carry out the purpose mandated by the legislature.

Quality Towing. Inc. v. City of Myrtle

Beach. 345 S.C. 156, 161, 547 S.E.2d 862, 864-865 (2001).

FOIA must be

construed so as to make it possible for citizens to learn and report fully the activities of public officials. S.C. Code Ann. § 30-4-15 (Supp.2007). As such, FOIA must be liberally construed to carry out its broad purpose. Also, the exceptions to disclosure must be narrowly interpreted. Op. Atf v Gen.. 2006 WL 1574910 (S.C.A.G. May 19,

2006). Consistent with these principles, we have repeatedly advised, when in doubt, an agency should disclose. Op. Att'v Gen.. 2017 WL 1368244 (S.C.A.G. Apr. 15, 2017). Thus, all doubt must be resolved in favor of transparency. Pursuant to FOIA, "[a] person has a right to inspect, copy, or receive an electronic transmission of any public record of a public body," unless it is exempt pursuant to section 30-4-40 of the South

Carolina Code (2007 & Supp. 2020). S.C. Code Ann. § 30-4-30(A)(l) (Supp. 2020). Section 30-

4-20(a) (2007) provides a "public body" includes "any department of the State." Because the Department of Corrections (the "Department") is a department of the State, it is a public body for purposes of FOIA. See also Op. Atfv Gen.. 1979 WL 43200 (S.C.A.G. Dec. 6, 1979) (applying FOIA to the Department). As a public body, the Department must thus comply with requests for public records under FOIA. "Public records" include "all books, papers, maps, photographs, cards, tapes, recordings, or other

documentary materials regardless of physical form or characteristics prepared, owned, used, in the possession of, or retained by a public body." S.C. Code Ann. § 30-4-20(c) (2007). Pursuant to section 24-9-35 of the South Carolina Code (Supp. 2020), the Jail and Prison Inspection Division

of the Department of Corrections is required to retain a permanent record of deaths and the

circumstances surrounding such deaths of persons incarcerated or in the custody of a municipal, county, multijurisdictional jail, county prison camp, or state correctional facility. Accordingly, we believe a list of the inmates who have died in custody and their causes of death is likely something the Department would possess or maintain for purposes of FOIA. Further, in requiring such records be kept or maintained, the Legislature could easily have required they be confidential or not open to disclosure. Yet, even though section 24-9-35 has been amended on several occasions, the Legislature did not expressly require such records be confidential.

Section 30-4-20(c) lists records that are not open to the public pursuant to FOIA, including "[rjecords such as . . . medical records . . . and other records which by law are required to be closed to the public . . . ." We understand from your letter you are particularly concerned as to whether information pertaining to inmate deaths is a medical record which would be closed to the public. Our Supreme Court addressed the medical record exemption under FOIA in Society of Professional Journalists v. Sexton. 283 S.C. 563, 566, 324 S.E.2d 313, 314 (1984), finding: "It is

Page 3

May 15, 2021

true that death certificates contain a medical certification of the cause of death. However, they are not medical records in the normal sense but are statements of conclusion by persons required by law to make such findings after the death of a citizen of the state." In Perry v. Bullock. 409 S.C. 137, 761 S.E.2d 251 (2014), the Court considered whether an autopsy

report is a medical record exempt from disclosure pursuant to FOIA. Id Finding FOIA did not

define "medical record," the Court followed the rules of statutory interpretation and turned to the normal and customary meaning of the term.

The Court stated: "Merriam-Webster defines a

medical record as 'a record of a patient's medical information (as medical history, care or

treatments received, test results, diagnoses, and medications taken).' Merriam-Webster Online, http://www.merriam-webster.com/medical/medical% 20records. Thus, plainly stated, medical records are those records containing medical information." Id at 141, 761 S.E.2d at 253. The Court determined an autopsy report falls within the definition of a medical record, reasoning the medical information gained from the autopsy and indicated in the report is

not confined to how the decedent died. Instead, an autopsy, which is performed by a medical doctor, is a thorough and invasive inquiry into the body of the decedent which reveals extensive medical information, such as the presence of any diseases or medications and any evidence of treatments received, regardless of whether that information pertained to the cause of death. Id. at 142, 761 S.E.2d at 253 (emphasis added). The Court in Perry differentiated between autopsy reports and death certificates, which it previously ruled are not medical records "simply because they contain medical information." Id

at 143, 761 S.E.2d at 254 (citing to Society of Professional Journalists. 283 S.C. at 563, 324 S.E.2d at 313). The Court explained: A death certificate includes no more than the cause of death, if known.

In

contrast an autopsy is a comprehensive medical examination of a body designed to reveal not only the cause of death, but also the decedent's general medical condition at the time of death including information unrelated to the cause of death. This is the type of information that would necessarily be contained in

medical records when a person is alive. We decline to allow a person's death to change the nature of the record into one subject to disclosure under the FOIA. Id.

Based on the Court's reasoning in Society of Professional Journalists and Perry, we do not believe a court would find a list of names of inmates and their causes of death constitute medical records. Like a death certificate, such a list would include no more than the cause of death. Furthermore, from your description, the list, unlike an autopsy, would not involve details of the decedent's

Page 4
May 15, 2021

general medical conditions. Accordingly, we do not believe the list you describe is a medical record, which would be closed to the public. We also understand there is some concern that releasing inmate names and causes of death may result in an unreasonable invasion of the inmate's privacy. Section 30-4-40 of the South Carolina Code (2007 & Supp. 2020) lists matters exempt from disclosure under FOIA, including an exemption for "[information of a personal nature where the public disclosure thereof would constitute unreasonable invasion of personal privacy." S.C. Code Ann. § 30-4-40(a)(2). Because section 30-4-40(a)(2) does not list or define what types of records are exempt from disclosure due to privacy, our courts balance "the interest of the individual in privacy on the one hand against the interest of the public's need to know on the other." Burton v. York Ctv. Sheriffs Den't. 358 S.C. 339, 352, 594 S.E.2d 888, 895 (Ct. App. 2004). Our Supreme Court, in Meetze v. Associated Press. 230 S.C. 330, 337, 95 S.E.2d 606, 609 (1956), recognized the right of privacy is restricted by matters of public interest.

In Meetze. the Court

stated the following:

One of the primary limitations placed on the right of privacy is that it does not prohibit the publication of matter which is of legitimate public or general interest. 'At some point, the public interest in obtaining information becomes dominant over the individual's desire for privacy. It has been said that the truth may be spoken, written, or printed about all matters of a public nature, as well as matters of a private nature in which the public has a legitimate interest. However, the phrase 'public or general interest', in this connection does not mean mere curiosity.' 41 Am.Jur., Privacy. Section 14. And we may add that newsworthiness is not necessarily the test. Id at 337, 95 S.E.2dat609. Balancing the right to privacy against the public's right to know most certainly involves the

determination of facts, which we recognize is beyond the scope of an opinion of this Office. See Op. Att'v Gen.. 1991 WL 632976 (S.C.A.G. Apr. 9, 1991) (stating "this Office cannot investigate facts."). Nonetheless, we believe in regard to information pertaining to inmates' deaths, the balance falls in favor of the public's interest. Initially, this Office recognizes inmates have a diminished right to privacy. Op. Att'v Gen.. 2007 WL 3244890 (S.C.A.G. Aug. 22, 2007). In a 2007 opinion, we cited to Hudson v. Palmer. 468 U.S. 517, 527-28 (1984) in support of the proposition that prisoners generally have a severely diminished expectation of privacy. Id. We concluded "inmates in prisons, jails or other detention facilities are in a situation where they have a lower expectation of privacy generally." Id. Furthermore, generally, privacy rights are considered personal rights which do not survive death.

As the Court in Society of Professional Journalist noted "privacy rights are considered personal

rights which do not survive." 283 S.C. at 566, 324 S.E.2d at 315 (citing 18 A.L.R.3d 873 (1968),

Page 5

May 15, 2021

62 Am.Jur.2d, Privacy, § 12 (1972)). In a 1996 opinion, we also recognized the privacy rights of an individual do not survive his death. Op. Att'v Gen.. 1996 WL 82899 (S.C.A.G. Jan. 29, 1996). In addition, information regarding inmates is of great public interest. In Houchins v. KOED, Inc., 438 U.S. 1, 8 (1978), the Supreme Court emphasized: conditions in jails and prisons are clearly matters "of great public importance." Pell v. Procunier. supra, 417 U.S., at 830 n. 7, 94 S.Ct., at 2808 n. 7.

Penal
facilities are public institutions which require large amounts of public funds, and their mission is crucial in our criminal justice system. Each person placed

in prison becomes, in effect, a ward of the state for whom society assumes broad responsibility.

It is equally true that with greater information, the public can more intelligently form opinions about prison conditions. Beyond question, the

role of the media is important; acting as the "eyes and ears" of the public, they can be a powerful and constructive force, contributing to remedial action in the

conduct of public business.
Information regarding deaths is also of great importance.

The Court in Society of Professional

Journalists found death certificates were not exempt from disclosure under FOIA.

The Court

concluded

"one of the primary limitations placed on the right of privacy is that it does not prohibit the publication of matter which is of legitimate public or general interest." Meetze v. Associated Press., 230 S.C. 330, 95 S.E.2d 606, 609 (1956). Here, the requested death certificate was that of a murder victim in a case of great public interest. This exception lacks merit. Id. at 566, 324 S.E.2d at 315. The limited privacy interests of inmates, the possibility a court would not even recognize such an interest after their deaths, and the strong public interest in information about inmate deaths, lead us to the conclusion that the privacy exemption likely does to apply to the information sought. As previously stated, this Office consistently advises public bodies with regard to FOIA that when in doubt, the body should disclose the information requested.

See Op. Atf v Gen,. 2011 WL

1740747 (S.C.A.G. Apr. 29, 2011). Because we believe a court likely would determine the information requested is not a medical record and the privacy exemption does not apply, we advise

if the Department possesses a list of inmates and their causes of death, FOIA requires disclosure

of such information.1

1 This conclusion is supported by other jurisdictions finding information pertaining to inmate

deaths is subject to disclosure under state open records legislation. See Op. Atf v Gen.. 2006 WL 542926 (Tex. A.G. Feb. 27, 2006) (finding information regarding custodial deaths must be disclosed pursuant to the Texas Public Information Act).

Page 6

May 15,2021

B. HIPAA

We also understand you are concerned the Health Insurance Portability and Accountability Act of 1 996 ("HIPAA") prohibits the Department from disclosing a list of inmates and their causes of death. The intent of HIPAA is to "'ensure the integrity and confidentiality of [patients'] information' and to protect against 'unauthorized uses or disclosures of the information.'" In re Vioxx Prod. Liab. Litis.. 230 F.R.D. 473, 477 (E.D. La. 2005) (quoting 42 U.S.C. § 1320d2(d)(2)(A) & (B)(ii)). Under HIPAA, Congress entrusted the Secretary of the Department of Health and Human Services with the task of creating national standards to "ensure the integrity and confidentiality of the information" to be collected and disseminated. 42 U.S.C. A. § 1320d-2(d)(2)(A). The regulations promulgating these standards as

created by the Department of Health and Human Services became effective on April 14, 2003, and are collectively known as "the Privacy Rule," which sets forth standards and procedures for the collection and disclosure of "protected health information" ("PHI"). Smith v. Am. Home Prod. Corp. Wveth-Averst Pharm.. 855 A.2d 608, 61 1 (N.J. Law. Div. 2003). Under the Privacy Rule, "[a] covered entity or business associate may not use or disclose protected health information," unless an exception applies. 45 C.F.R. § 164.502(a). Covered entities are defined in the regulations as (1) A health plan.

(2) A health care clearinghouse.
(3) A health care provider who transmits any health information in electronic

form in connection with a transaction covered by this subchapter. 45 C.F.R. § 160.103.

The regulations further define a "transaction" as follows:
Transaction means the transmission of information between two parties to carry

out financial or administrative activities related to health care. It includes the following types of information transmissions: (1) Health care claims or equivalent encounter information.

Page 7

May 15,2021

(2) Health care payment and remittance advice.

(3) Coordination of benefits.
(4) Health care claim status.

(5) Enrollment and disenrollment in a health plan.

(6) Eligibility for a health plan.
(7) Health plan premium payments.

(8) Referral certification and authorization.
(9) First report of injury.
(10) Health claims attachments.
(11) Health care electronic funds transfers (EFT) and remittance advice.

(12) Other transactions that the

Secretary may prescribe by

regulation.
45 C.F.R. § 160.103.

The determination of whether the Department is in fact a health care provider for purposes of HIPAA is a factual determination, which cannot be made in an opinion of this Office. Op. Atf v Gen., 2010 WL 928445 (S.C.A.G. Feb. 18, 2010) ("This office has repeatedly stated that an opinion of this office cannot determine facts noting that the determination of facts is beyond the scope of an opinion of this office.").

However, we do not believe the Department would be

considered a health plan or a health care clearinghouse. In your letter, you indicated the Department maintains an Electronic Medical Record system, provides medical care to inmates, transmits medical records electronically, and pays for medical treatments via electronic means.

Based on this information, we believe it is likely a court would find the Department is a health care provider who transmits health information in electronic form in connection with a covered transaction, and is therefore a covered entity for purposes of HIPAA.

Assuming the Department is a covered entity, it is prohibited from disclosing protected health information. HIPAA defines protected health information as individually identifiable health information:

Page 8
May 15, 2021

(1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium.

(2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years. 45 C.F.R. § 160.103.

The list described in your request letter would identify individual inmates by name and therefore, contains identifiable information. We have not found a source confirming information related to an individual's cause of death amounts to "health information" under HIPPA. But, for purposes of our analysis, we presume a person's cause of death is considered health information. Moreover, regarding deceased individuals, the Privacy Rule specifies, "[a] covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual." 45 C.F.R. § 164.502.

Furthermore, as you noted in your letter, inmates are not exempt from HIPAA's Privacy Rule and covered entities are only allowed to disclose inmates' protected health information to correctional institutions and law enforcement under specific circumstances such as for the health and safety of the other inmates. 45 C.F.R. § 164.5 12(k)(5). Thus, inmates are generally protected under HIPAA even after their deaths. Under HIPAA alone, we believe a court could find the Department is a covered entity and therefore, is prohibited from releasing inmates individually identifiable health information, including inmates causes of death. C. FOIA vs. HIPAA

Faced with the possibility the same information is required to be disclosed under state law but is prohibited from disclosure under HIPAA, we must consider which law controls. We addressed a

Page 9

May 15, 2021

similar issue in a 2014 opinion concerning a detention facility's release of the drug names of pharmaceuticals dispensed to inmates. On. Att'v Gen.. 2014 WL 7210767 (S.C.A.G. Dec. 4, 2014). We pointed out FOIA protects information exempt by statute or law from disclosure. Id (citing S.C. Code Ann. § 30-4-20).

However, HIPAA allows for disclosure of protected health
information if "'disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law."' Id. (quoting 45 C.F.R. § 164.512). We added "[t]his conclusion is strengthened by the preamble of the Privacy Rule where the HHS indicated its intention in creating the Privacy Rule was to 'preserve access to information considered important enough by state or federal authorities to require its disclosure by law,' that HHS did not 'believe that Congress intended to preempt each such law,' and that the Privacy Rule was intended to 'avoid

any obstruction to the health plan or covered health care provider's ability to comply with its existing legal obligations.'" Id (quoting 65 Fed. Reg. 82462, 82667-68). Our 2014 opinion cited to cases in Texas and Ohio resolving this conflict in favor of state public information laws as well as several attorney generals' opinions coming to the same conclusion. Id. (citing Abbot v. Texas Dent, of Mental Health and Mental Retardation. 212 S.W.3d 648 (Tex. App. 2006); State Cincinnati Enquirer v. Daniels, 108 Ohio St. 3d 518, 844 N.E.2d 1181 (Ohio

2006)). Relating particularly to information on deaths, we discovered a 2007 Georgia Attorney General's opinion addressing whether the Georgia Department of Human Resources is prohibited from releasing death certificates due to HIPAA. Op. Att'v Gen.. 2007 WL 2199002 (Ga. A.G.

July 11, 2007).

The Attorney General found Georgia law requires death certificates to be Considering the impact of HIPAA, the Attorney General cited to 42
§1320d-7, stating "[njothing in this part shall be construed to invalidate or limit the

accessible to the public.

U.S.CA.

authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention." Id The Attorney General also cited to 45 C.F.R. § 160.203, providing state laws are preempted except when "[t]he provision of State law, including State procedures established under such law, as applicable, provides for the reporting of disease or injury, child abuse, birth, or

death, or for the conduct of public health surveillance, investigation, or intervention." Id In addition, the Attorney General referenced the general rule under 45 C.F.R. 164.512(a) that "[a] covered entity may use or disclose protected health information to the extent that such use or

disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law." Id Based on these provisions, the Attorney General opined "responding to a request for access to or information from death certificates, as the media have sought in the request, is required by law and not subject to the prohibitions of HIPAA." Id The Nebraska Attorney General also considered whether HIPAA restricted cause of death information from being disclosed as part of a public record. Op. Att'v Gen.. 2004 WL 908403 (Neb. A.G. Apr. 20, 2014). The Attorney General referenced 45 C.F.R. § 164.512(a) as allowing

covered entities to disclose protected health information without authorization to the extent such a disclosure is required by law. The Attorney General made the distinction that the covered entity must "determine if the disclosure is mandatory rather than merely permissible and, if it is mandatory, a covered entity may disclose the protected health information pursuant to §

Page 10
May 15,2021

164.512(a)." The Attorney General found the Nebraska public records statutes "clearly mandate or compel state agencies to make records available to the public, including birth and death records." Id As such, the Attorney General opined "the Nebraska public records statutes fall within § 164.512(a)(1) as a disclosure required by law." The Attorney General added: In response to a comment about state Freedom of Information Act laws, HHS

has responded that the "rules permit covered entities to make disclosures that are required by state Freedom of Information Act (FOIA) laws under Sec. 164.512(a). Thus, if a state FOIA law designates death records and autopsy reports as public information that must be disclosed, a covered entity may disclose it without an authorization under the rule.

To the extent that such
information is required to be disclosed by FOIA or other law, such disclosures

are permitted under the final rule."

65 Fed. Reg. 82597 (2000). For these
reasons, it does not appear that HIPAA restricts the cause of death information from being disclosed as part of the public record. Id.

In regard to the requested list of inmates and causes of death, South Carolina does not have a

specific statute requiring disclosure of such information. However, given our analysis above, we believe such information must be disclosed as a public record under FOIA. Pursuant to section 24-9-35 of the South Carolina Code, requiring a record of inmate deaths, such information appears

to be in the Department's possession. Moreover, given our Supreme Court's decisions in Society of Professional Journalists and Perry, we do not believe a court would find such information is prohibited from disclosure as a medical record. We also do not believe the information is exempt from disclosure due to the privacy exemption. As such, disclosure is mandatory rather than merely permissible. Furthermore, failure to disclose may result in and injunction or the award of attorneys fees for violating FOIA. Therefore, we believe a court would find, even if inmates' names and

causes of death are protected health information under HIPAA, HIPAA would not restrict the disclosure of such information as it is required to be released pursuant to state law. Conclusion

This Office strongly supports transparency and disclosure under FOIA. Indeed, we have consistently advised for decades: When in doubt disclose. Moreover, the operation of our prisons

and jails and what occurs therein are matters of great public importance. For that reason, among others, prisoners have a diminished expectation of privacy while in prison. Additionally, courts have held a prisoner has no private right of action under HIPAA. See Seaton v. Mavberg. 610 F.3d 530 (9th Cir. 2010). Section 24-9-35 requires prisons, jails, and other corrections facilities to maintain records of prisoners' deaths and the cause of prisoners' deaths. The Legislature amended this statute several times and had the opportunity to designate these records as confidential, but has not done so. This also is an indication that prisoners, as wards of the state, have a diminished expectation of privacy in prison.

Page 1 1

May 15,2021

In accordance with our analysis above, we do not believe a court would find information pertaining to inmates and their causes of death are medical records, requiring it to be closed to the public. We also do not believe such information is exempt from disclosure as an invasion of an inmate's privacy. Thus, we believe information pertaining to inmates and their causes of death in possession of the Department is subject to disclosure under FOIA. We believe the Department likely is a covered entity for purposes of HIPAA and is prohibited from disclosing inmates' protected health information. However, based on our understanding of HIPAA, a covered entity may disclose protected health information to the extent it is required to do so by law.

We believe FOIA requires disclosure of the requested information, and therefore,

do not believe HIPAA prevents such a disclosure of inmate names and causes of death.

Furthermore, according to the federal regulations associated with HIPAA, "[cjovered entities will not be sanctioned under this rule for responding in good faith to such legal process and reporting

requirements." 65 Fed. Reg. at 82,462-01.

Sincere]}',

/
Robert D. Cook

Solicitor General

/

Cydney Milling

Assistant Attorney General