Opinion
Opinion By: Gregory D. Stumbo, Attorney General; James M. Ringo, Assistant Attorney General
Open Records Decision
This matter having been presented to the Attorney General in an open records appeal, and the Attorney General being sufficiently advised, we find that Lexington-Fayette County Health Department (LFCHD) properly relied on KRS 61.878(1)(a) in denying Ralph Brumagen's request for patient medical records of three named individuals. 1 We believe that 05-ORD-239 is controlling. A copy of this decision is attached hereto and incorporated by reference.
In his letter of appeal, dated September 14, 2006, Mr. Brumagen stated that he had received no response to his request for patient medical records of three named individuals. After receipt of notification of the appeal and a copy of the letter of appeal, Melinda G. Rowe, MD, Commissioner of Health, LFCHD, provided this office with a response to the issues raised in the appeal. In her response, Dr. Rowe acknowledged that, while failure to respond to Mr. Brumagen's request within three business days was a procedural violation, the patient medical records were exempt from disclosure under KRS 61.878(1)(a) and (k). Citing 05-ORD-239 and KRS 61.878(1)(a), she explained that a person's medical records and medical information was information in which a person had a privacy interest and the disclosure of these records would constitute an unwarranted invasion of personal privacy and, as the records responsive to Mr. Brumagen's request fell within this exclusion, LFCHD was not required to disclose them.
It is well recognized that a person's medical records and medical information is information in which a person has a privacy interest and the disclosure of records containing such information would constitute an unwarranted invasion of privacy. In 05-ORD-239, quoting 03-ORD-023, at page 6, we stated:
Few records are accorded greater protection than patient medical records. Indeed, in a different factual context the Kentucky Supreme Court has determined that information elicited within the relationship of a health care provider and his or her client is "both personal and private," that disclosure of records containing such information "would constitute a serious invasion of personal privacy, " and that with regard to such records "there is a . . . public interest in personal privacy [that is] strongly substantiated." Kentucky Board of Examiners of Psychologists v. Courier-Journal and Louisville Times, Ky., 826 S.W.2d 324, 328 (1992). State and federal legislation support this position. See, e.g., KRS 422.320 (requiring the clerk of the court to permanently dispose of subpoenaed medical records "in a manner that protects the confidentiality of the medical information contained therein"); Health Insurance Portability and Accountability Act of 1996 Public Law 104-191 (establishing standards for privacy of individually identifiable health information and aimed at guaranteeing the privacy and confidentiality of patient medical records). . . .
Accordingly, we affirm the LFCHD's denial of Mr. Brumagen's request for patient medical records under authority of KRS 61.878(1)(a) and 05-ORD-239. In addition, the LFCHD asserted that the records were also exempt from disclosure under KRS 61.878(1)(k) 2 and the Health Insurance Portability Act of 1996 (HIPAA), 45 CFR § 164, 500 et seq., which prohibits the LFCHD from disclosing protected health information without the protected health information without the written authorization of the individual or a valid court order. Dr. Rowe advised that because Mr. Brumagen was requesting protected health information of three individuals who have not given written authorization to disclose the records and there was no court order requiring disclosure, the LFCHD was not required to disclose the records. Because the records at issue may be excluded from disclosure under KRS 61.878(1)(a) , we need not address in this appeal whether they would also be subject to nondisclosure under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
The failure to respond to the request within three business days after its receipt constituted a procedural violation of the Open Records Act. KRS 61.880(1). However, we will not belabor the issue as the agency has acknowledged its error in failing to timely respond and we assume it will promptly respond in writing to future open records requests.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3) , the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Footnotes
Footnotes
1 The individuals whose records Mr. Brumagen requested are identified by name in his open records request. We have omitted their names in deference to their privacy interests.
2 KRS 61.878(1)(k) excludes from the application of the Open Records Act: "All public records or information the disclosure of which is prohibited or restricted by federal law or regulation."