Opinion
Opinion By: Gregory D. Stumbo, Attorney General; James M. Ringo, Assistant Attorney General
Open Records Decision
The question presented in this appeal is whether the University of Kentucky Medical Center (Medical Center) violated the Open Records Act in denying the open records request of Edgar A. Scott, Jr. for certain patient medical records maintained by the Medical Center. For the reasons that follow, we find that, with the exception of a procedural deficiency, the Medical Center properly denied access to the medical records under authority of KRS 61.878(1)(a).
By letter dated July 6, 2005, Mr. Scott submitted a request to the Medical center for:
Certified copies of any and all medical records pertaining to the treatment of . . ., 1 D.O.B: 5/20/95, treated on 4/10/03. Regarding the case of Commonwealth of Kentucky -- Plaintiff vs. Edgar A. Scott, Jr. -- Defendant.
In addition to the above, Mr. Scott asked for the credentials and employment positions Joe Dugan, Leah Williams, Joe Hill, and Dr. Charles Eckerline, who assisted or participated in pelvic exam, and conclusions and statements made by Dr. Eckerline to Detective Carol Sims with the Lexington Police Department after the exam.
After receipt of notification of Mr. Scott's appeal and the letter of appeal, the Medical Center provided this office with a copy of its response to Mr. Scott's request. In a letter dated August 23, 2005, Frank Butler, Official Records Custodian, on behalf of the Medical Center, responded to Mr. Scott's request, advising:
This letter is in response to your Open Records request dated July 6, 2005, we received your request with the Attorney General's Notice of Appeal. Prior to receipt of the Attorney General's notice, this office had no knowledge of your request. Your request was initially received July 28, 2005 by Hospital Medical Records and was then forwarded to another department for response. We apologize for your request not being answered in a timely fashion.
In response to Mr. Scott's request for patient medical records, Mr. Butler advised that these records were exempt from disclosure under authority of KRS 61.878(1)(a) and the Health Insurance Portability and Accountability Act of 1996, better known as HIPAA. In its response, the Medical Center provided Mr. Scott with the credential and employment position information he requested, but denied his request for conclusion and statements made by Dr. Eckerline to the Lexington Police Department after the pelvic exam, for the same reasons it had denied access to the patient's medical records.
For the reasons that follow, we find that the substantive response of the Medical Center did not constitute a violation of the Open Records Act.
KRS 61.878(1)(a) excludes from public inspection:
Public records containing information of a personal nature where the public disclosure thereof would constitute a clearly unwarranted invasion of personal privacy.
It is well recognized that a person's medical records and medical information is information in which a person has a privacy interest and the disclosure of records containing such information would constitute an unwarranted invasion of privacy. See 03-ORD-023, at page 6, where we stated:
Few records are accorded greater protection than patient medical records. Indeed, in a different factual context the Kentucky Supreme Court has determined that information elicited within the relationship of a health care provider and his or her client is "both personal and private," that disclosure of records containing such information "would constitute a serious invasion of personal privacy, " and that with regard to such records "there is a . . . public interest in personal privacy [that is] strongly substantiated." Kentucky Board of Examiners of Psychologists v. Courier-Journal and Louisville Times, Ky., 826 S.W.2d 324, 328 (1992). State and federal legislation support this position. See, e.g., KRS 422.320 (requiring the clerk of the court to permanently dispose of subpoenaed medical records "in a manner that protects the confidentiality of the medical information contained therein"); Health Insurance Portability and Accountability Act of 1996 Public Law 104-191 (establishing standards for privacy of individually identifiable health information and aimed at guaranteeing the privacy and confidentiality of patient medical records). . . .
We conclude that the requested patient medical records and the statements of Dr. Eckerline regarding his examination and treatment of the patient could properly be withheld from disclosure under KRS 61.878(1)(a). Accordingly, the Medical Center's denial of Mr. Scott's request for these records did not violate the Open Records Act. Because the records at issue may be excluded from disclosure under KRS 61.878(1)(a), we need not address whether they would also be subject to nondisclosure under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
In a supplemental response, the Medical Center acknowledged that Mr. Scott's request had been erroneously treated as a request for medical records, rather that an open records request. Nevertheless, the failure to respond to the request within three business days after its receipt constituted a procedural violation of the Open Records Act. KRS 61.880(1).
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.846(4)(a). The Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceedings.
Footnotes
Footnotes
1 The individual whose records Mr. Scott requested is identified by name in his open records request. We have omitted her name in deference to her privacy interests.