Leave it to the Reporters Committee for Freedom of the Press to spell out, with absolute clarity, the limits of HIPAA as a basis for public agency denial of requests from the press *and* the public about COVID-19 related data.
https://www.rcfp.org/resources/covid-19/#journalists-guide-to-hipaa-dur…
Bear in mind, Kentucky's open records law protects personal medical records under a privacy exception that focuses on the sensitivity of the information in the records and the extent to which disclosure advances, or does not advance, the public's ability to monitor the agency's conduct.
https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=48230
(See subsection (1)(a).)
In this balancing of competing public and private interests, privacy interests in personal medical records prevail over the public interest. Our open records law does *not* require disclosure of personally identifiable medical/health records.
But our law *does* mandate disclosure of "statistical information not descriptive of any readily identifiable person." Thus, Kentucky has mostly avoided the issues that have arisen in other states relating to misapplication of HIPAA to non-identifiable data.
https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=48230
(See section (2).)
Public agency doubters of the analysis that follows should be prepared to defend their indefensible positions in court when the inevitable challenges are presented.
