Opinion
Opinion By: Jack Conway, Attorney General; Michelle D. Harrison, Assistant Attorney General
Open Records Decision
At issue in this appeal is whether the Cabinet for Health and Family Services, and specifically the Office of Inspector General and the Department for Community Based Services, violated the Kentucky Open Records Act in partially denying Gail M. Langendorf's request(s) for thirty-four categories of documents regarding UK Healthcare Good Samaritan Hospital and the related investigation of her client, Katherine McMillin, an individual accused of abusing a patient at Select Specialty Medical, which is located there. Inasmuch as the CHFS cannot produce nonexistent records for inspection, the agency did not violate the Act in denying access to categories for which no responsive documents exist; a public agency does not have to "prove a negative" in order to refute a claim that certain records exist under
Bowling v. Lexington-Fayette Urban County Government, Ky., 172 S.W.2d 333, 340-341 (2005). In accordance with 09-ORD-022, this office affirms the agency's denial as to six categories of records withheld on the basis of 45 CFR § 2.3, incorporated into the Act by operation of KRS 61.878(1)(k). Because disclosure of the minimal information redacted from the Statement of Deficiencies, which identified specific patients and revealed their medical information, would constitute a clearly unwarranted invasion of personal privacy, the CHFS properly redacted that information per KRS 61.878(1)(a). Neither Ms. Langendorf nor her client fall within any of the exceptions to KRS 620.050(11); accordingly, the CHFS properly relied on this confidentiality provision, incorporated into the Open Records Act by operation of KRS 61.878(1)(l), in redacting information "tending to identify the reporting source" from the reporting form provided.
On June 2, 2008, Ms. Langendorf submitted her initial request for six categories of records concerning Select Specialty to the CHFS Open Records Administrator, Division of Protection and Permanency, the Office of Legal Services, and the Regional Manager of the Division of Health Care Facilities and Services, Eastern Enforcement Branch. In a timely but otherwise deficient response, Markus Bennett, Open Records Specialist, confirmed receipt of the request, generally referenced "state and federal laws that govern the privacy of records," indicated that a review of the records would "be performed as soon as possible" upon receipt of the records ordered from the custodian, and enclosed a CHFS-305, Authorization for Disclosure of Protected Health Information for Ms. Langendorf to complete. This response lacks the specificity required for compliance with KRS 61.880(1), and the CHFS neither invoked nor complied with KRS 61.872(5), the exception to KRS 61.880(1), which mandates that a public agency provide a detailed explanation of the cause for delay and the specific date when the records will be available, both of which are noticeably absent. 1
In prior decisions, the Attorney General has repeatedly admonished the CHFS that "its practice of issuing what appear to be boilerplate responses to records requests in order to secure additional time for final disposition of those requests beyond the statutorily imposed three working day deadline is contrary to both the spirit and the letter of the Open Records Act. " 07-ORD-123, p. 5 (original emphasis). See 07-ORD-030 (acknowledging that "volume of requests directed to CHFS and the nature of the records implicated, in conjunction with the staffing issues CHFS apparently faces, undoubtedly present CHFS with a unique dilemma," but observing in reference to "inherent deficiencies of the standard form letter utilized" by CHFS that the "practice currently employed by CHFS violates both KRS 61.880(1) and KRS 61.872(5)" and the Act "does not contain a provision extending the statutory deadline for CHFS or a waiver of the other procedural requirements"); 08-ORD-014 (noting that 07-ORD-030 "mirrors earlier decisions of this office dating back to at least 1995, all of which were postulated on the proposition that public agencies cannot adopt and implement policies 'which, by design, result in . . . delay[s] in the release of nonexempt public records'")(citation omitted); see also, 05-ORD-134; 96-ORD-168; 95-ORD-115. As in 07-ORD-123, at "the risk of redundancy," this office reiterates that "[w]hile the Attorney General cannot compel the [CHFS] to implement a new policy, or otherwise impose penalties for violations of KRS 61.870 to 61.884, the courts are empowered to do so, and, in the face of a pattern of noncompliance, may well elect to do so." Id., p. 5.
Following a series of correspondence with the OIG and the DCBS, and the receipt of certain responsive documents, Ms. Langendorf submitted her final request on January 9, 2009, asking for thirty-four categories of documents in total. More precisely, she asked for the following "properly redacted documents" for Select Specialty LTAC and/or any other provider identified by specific numbers that she provided:
(1) Copies of all documents relative to completed investigations including the official "Statement of Deficiencies and Plan of Correction, " Form CMS-2567 or any state form. If it contains the name of any individual, medical information about any identifiable resident, the identity of a complainant, or the address of anyone other than an owner of the facility, that information may be redacted;
(2) Any modified Statements of Deficiencies or Plans of Corrections issued or submitted;
(3) All documents relative to DCBS's investigation and reports issued relative to the allegations asserted in DCBS Number 457763 including but not limited to: Notification of Protective Services Investigation Findings Report Form, DCBS 284 or a "Report Not Accepted Letter";
(4) All documents relative to ACTS Complaint/Incident Investigation Report, Intake ID KYOOO10047;
(5) All documents relative to ACTS Complaint/Incident Investigation Report, Intake ID KY00009870;
(6) All documents relative to ACTS Complaint/Incident Investigation Report Intake ID 00009867;
(7) All correspondence/ notifications between DCBS, the Office of the Inspector General, the County Attorney/Commonwealth Attorney's office, the Board of Nursing, or the Regional Office regarding DCBS Number 457763, Intake ID KY00010047, Intake ID KY00009870; or Intake ID 00009867;
(8) Information relative to whether the providers or facilities do or do not participate in the Medicare/Medicaid program;
(9) A list of isolated deficiencies that constitute no actual harm and have the potential for minimal harm;
(10) Facility comments;
(11) Statements that the facility did not submit an approvable plan of correction or failed to comply with the conditions of imposed remedies, if appropriate;
(12) Official notices of provider terminations;
(13) Statistical data on facility characteristics that does not identify any specific individual. 42 CFR 401.120 states that records will not be created by compiling selected items from the files to give the requester data such as ratios or percentages. However, if existing documents contain such statistical data (e.g., Online Survey, Certification and Reporting system reports), they are subject to release;
(14) Final appeal results;
(15) Medicare and Medicaid cost reports; and
(16) Names of individuals with direct or indirect ownership interest in a skilled nursing facility or nursing facility, as defined in 42 CFR 420.201, who have been found guilty by a court of law of a criminal offense in violation of Medicare or Medicaid law;
(17) Any preliminary determination made by the State of Kentucky, based on oral or written evidence and its investigation, that resident neglect, abuse, or misappropriation of property occurred with regard to these facilities;
(18) Any written notification of any investigation into resident neglect, abuse, or misappropriation of property with regard to these facilities issued to:
(19) Any notifications to the individual, the current administrator of the facility, applicable licensing authorities, or the nurse aide registry as specified in 42 CFR 483.156 regarding substantiated findings that an individual neglected or abused a resident or misappropriated a resident's property;
(20) Any documentation relative to the State's decision not to report Katherine McMillin to the nurse aid registry in spite of the recommendation on the ACTS Complaint/Incident Investigation Report that she be referred;
(21) Documentation on all ACTS Complaints;
(22) Case Information from the LTC system;
(23) Case Information from OSCAR or ASPEN;
(24) Documents relating to the Provider Agreement and any documents relative to any change in the effective date of the agreement pursuant to 42 CFR 489.13 (b)(3);
(25) Any waiver requests submitted by the facility relative to the effective date of the Provider Agreement;
(26) Any documentation relative to any issues regarding the facilit[y's] substantial compliance as defined by 42 CFR 488.301;
(27) Any validation or certification surveys conducted on the facility by the State or the Regional Office;
(28) Any Notices of Denial of Participation;
(29) Any Enforcement Remedies exercised by the State in accordance with 42 CFR 488.406;
(30) Documentation relative to the State's submission of the Approved Plan of Action for Regional Office Approval;
(31) Any initial notices issued to the Provider;
(32) All correspondence between the State and the Regional Office relative to investigations, plans of correction, or statements of deficiency;
(33) All documents provided to the State's long-term care ombudsman including but not limited to: Statement of Deficiencies reflecting facility noncompliance and, if applicable, a separate list of isolated deficiencies that constitute no actual harm with the potential for minimal harm; Reports of adverse actions specified in 42 CFR 488.406 imposed on a facility; any written response by the facility, including plans of correction and facility requests for informal dispute resolution; and facility's request for an appeal and the results of any appeal;
(34) Any initial notice sent to the facility and/or the State Medicaid agency and Regional Office which contains any of the following [information-subsections omitted].
On January 13, 2009, Mr. Bennett issued an identical form letter on behalf of the CHFS in response to Ms. Langendorf's request which, as previously noted, was procedurally deficient; Mr. Bennett further advised that all records "requested and releasable from the Department for Community Based Services" had already been provided. Shortly thereafter, Ms. Langendorf initiated this appeal, contending that the CHFS violated KRS 61.880(1) and KRS 61.872(5) , and that "[m]uch of what has been requested has not been produced and what has been produced has been improperly redacted. " Upon receiving notification of Ms. Langendorf's appeal from this office, Jon R. Klein, Assistant Counsel, responded on behalf of the CHFS, addressing each category of records by number and ultimately advising that, in short, the CHFS "has either already provided, or, in the case of DMS records, is in the process of providing, all of the records in the [CHFS's] possession that may be released under existing law." With the exception of the noted procedural violations, the agency's disposition of Ms. Langendorf's request is entirely consistent with governing law and is therefore affirmed.
Nonexistent records
In responding to Items 2, 3 (in part), 7, 10, 11, 14, 16, 17, 19, 25-32, and 33, 2 the CHFS ultimately advised Ms. Langendorf that no responsive documents exist. 3 As long recognized by the Attorney General, a public agency cannot afford a requester access to nonexistent records or those which the agency does not possess. 07-ORD-190, p. 6; 06-ORD-040. To clarify, the right of inspection attaches only if the records being sought are "prepared, owned, used, in the possession of or retained by a public agency. " KRS 61.870(2); 02-ORD-120, p. 10; 04-ORD-205. A public agency's response violates KRS 61.880(1), "if it fails to advise the requesting party whether the requested record exists," with the necessary implication being that a public agency discharges its duty under the Open Records Act by affirmatively indicating that no such records exist as the CHFS has asserted here. 98-ORD-154, p. 2, citing 97-ORD-161, p. 3. On multiple occasions, the Attorney General has expressly so held. 04-ORD-205, p. 4.
With regard to statutory obligations of a public agency when denying access due to nonexistence of the records, the analysis contained in 07-ORD-190 is controlling; a copy of that decision is attached hereto and incorporated by reference (along with a copy of 07-ORD-188 upon which the former decision was premised). In the absence of the requisite prima facie showing, the Attorney General must affirm the denial of Ms. Langendorf's request as to all nonexistent records being sought in accordance with
Bowling v. Lexington-Fayette Urban County Government, Ky., 172 S.W.3d 333, 340-341 (2005), and prior decisions of this office such as 07-ORD-190 and 07-ORD-188. To hold otherwise would result in the CHFS "essentially hav[ing] to prove a negative" in order to refute any claim that such records exist. 07-ORD-190, p. 7. As the Attorney General has long recognized, this office cannot "adjudicate a dispute regarding a disparity, if any, between records for which inspection has already been permitted, and those sought but not provided." OAG 89-81, p. 3. To the extent Ms. Langendorf is questioning the volume, content or value of the records produced, such an issue is not justiciable in this forum; rather, "questions relating to the verifiability, authenticity, or validity of records disclosed under the Open Records Act are not generally capable of resolution under the Act." 04-ORD-216, p. 3.
Records withheld on the bases of 45 CFR § 2.2(3) and KRS 61.878(1)(k)
In denying Ms. Langendorf's request as to Items 4-6 and 21 (all documents related to "ACTS Complaint/Incident Investigation Report" for specified Intake ID nos.), Mr. Klein advised that redacted versions of the ACTS (Automated Complaint Tracking System) reports were originally provided; however, "those documents are not subject to release by the [CHFS] and now must be requested from the Center for Medicare Services in Atlanta, GA, in accordance with 45 CFR Part 2, 73 FR 53148, and 45 CFR 2.2(3). KRS 61.878(1)(k); 09-ORD-022, p. 5." Mr. Klein also noted that Ms. Langendorf "acknowledges that she was notified of this change on January 6, 2009, three days prior to her present request under appeal." Similarly, Mr. Klein denied access to Items 22 (Case information from the Long Term Care system) and 23 (Case information from OSCAR and ASPEN) 4 pursuant to 45 CFR Part 2, 73 FR 53148, and 45 CFR § 2.2(3), advising in both instances that such information "may be requested in the same manner as ACTS Complaints." Although the OIG "was dilatory in failing to invoke the applicable federal regulations, and state exemption incorporating those regulations into the Open Records Act" in 09-ORD-022 until after the appeal was filed, as in this case, the Attorney General ultimately found that the "OIG properly relied on 45 CFR § 2.3," 5 incorporated into the Act by operation of KRS 61.878(1)(k), in withholding responsive ACTS investigative reports. 6 09-ORD-022, p. 5. Because the reasoning of upon which that decision was based can also logically be extended to case information from OSCAR and ASPEN, the instant appeal presents no reason to depart from this governing precedent, a copy of which is attached hereto and incorporated by reference; accordingly, the agency's denial is affirmed relative to Items 4-6 and 21-23 on the basis of 45 CFR § 2.3, consistent with 09-ORD-022.
Redactions made per KRS 61.878(1)(a) (Item 1) and KRS 620.050(11) (Item 3)
In addressing Item 1 of Ms. Langendorf's request, Mr. Klein advised that she "was provided a redacted Statement of Deficiencies (SOD) and Plan of Correction (POC) on August 5, 2008[,]" as evidenced by the record on appeal. The SOD "was redacted to remove identifying information about patients, including identifying numbers, their age, and information about their health in accordance with KRS 61.878(1)(a) and 45 CFR 164.502(a)," incorporated into the Act by operation of KRS 61.878(1)(k).
It is well-established that disclosure of medical records or the information contained therein generally constitutes a "clearly unwarranted invasion of personal privacy, " and such records, or portions thereof may thus be withheld on the basis of KRS 61.878(1)(a). 7 05-ORD-239, pp. 2-3. In 03-ORD-023, this office recognized as much in observing:
Few records are accorded greater protection than patient medical records. Indeed, in a different factual context the Kentucky Supreme Court has determined that information elicited within the relationship of a health care provider and his or her client is "both personal and private," that disclosure of records containing such information "would constitute a serious invasion of personal privacy, " and that with regard to such records "there is a . . . public interest in personal privacy [that is] strongly substantiated. " Kentucky Board of Examiners of Psychologists v. Courier-Journal and Louisville Times, Ky., 826 S.W.2d 324, 328 (1992). State and federal legislation support this position. . . .
Having reviewed the unredacted version of the SOD in camera, pursuant to KRS 61.880(2)(c) and 40 KAR 1:030, Section 3, this office finds no error in the redactions made as the OIG redacted only the identification numbers, diagnoses, and related medical information for two patients, all of which could be used to identify the patient (s) when viewed in context but does not describe the incident(s) which resulted in the subject investigation. In other words, the limited redactions do not preclude the public from "monitoring the agency's conduct in discharging its statutory duty to investigate abuse and neglect" at such facilities. 08-ORD-166, p. 9 (holding that extensive redactions made by OIG per new policy adopted in May 2008, in contrast, were not justified under KRS 194A.060(1) or KRS 61.878(1)(a), when there was no "reasonable basis to believe" that the redacted information could be used to identify the individual resident nor would the disclosure thereof have constituted a clearly unwarranted invasion of personal privacy and the redactions effectively "render[ed] those records meaningless"). 8 Because the agency, in this instance, "str[uck] the proper balance between the individual's right of privacy and the public's right to know that the OIG discharged its statutory duty," the redactions were permissible under KRS 61.878(1)(a); consideration of the alternative basis for denial is therefore unnecessary.
In addressing Item 3, Mr. Klein advised, in relevant part, that Ms. Langendorf was provided "with all the documents responsive to this request on August 14, 2008[,]" as evidenced by the record on appeal; however, these records were redacted "to remove information tending to identify the reporting source, in accordance with KRS 620.050(11)," incorporated into the Open Records Act by operation of KRS 61.878(1)(l). With regard to application of KRS 620.050(11), the analysis contained in 08-ORD-127, a copy of which is attached hereto and incorporated by reference, is controlling. When viewed in conjunction, KRS 61.878(1)(l) and 620.050(11) operate to ensure that any information by which the person initiating a report of dependency, neglect or abuse under KRS 620.030 can be identified remains confidential. Because Ms. Langendorf has not demonstrated that either she or her client fall into any of the excepted categories delineated at KRS 620.050(11)(a)-(c) nor does the record indicate that a court order has been issued as required for subsection (d) to apply, the DCBS is statutorily prohibited from releasing the redacted information to either of them.
Records provided - Items 8, 9, 12, 13, 18 and 20
In responding to Items 8 and 12, Mr. Klein advised Ms. Langendorf that he was enclosing "eleven pages of letters from CMS regarding participation in the Medicare program." With regard to Items 9 and 18, Mr. Klein informed Ms. Langendorf that no deficiencies were issued "other than in the 11/16/07 SOD already provided"; however, with his response Mr. Klein provided Ms. Langendorf with "7 pages of 'no deficiency' SODs from the time period she requested." Mr. Klein advised that "[t]wo pages of existing documents with non-identifying data requested" were available and provided to Ms. Langendorf in response to Item 13. Finally, the "only document responsive" to Item 20 "was already provided" according to Mr. Klein. In sum, the CHFS had either already provided 9 Ms. Langendorf with documents responsive to said items of her written request or has done so now. 40 KAR 1:030, Section 6 provides: "Moot complaints. If requested documents are made available to the complaining party after a complaint is made, the Attorney General shall decline to issue a decision in the matter." See 04-ORD-046; 03-ORD-087. In applying this mandate, the Attorney General has consistently held that when access to public records which are the subject of a request is initially denied but subsequently granted, the "propriety of the initial denial becomes moot. " 04-ORD-046, p. 5, citing OAG 91-140. Absent objective proof to the contrary, this office must assume that Ms. Langendorf has received copies of any existing records in the possession of the CHFS that are responsive; accordingly, the related issues are moot per 40 KAR 1:030, Section 6. For all of the foregoing reasons, the agency's ultimate disposition of Ms. Langendorf's request is affirmed.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Gail M. LangendorfJon R. Klein
Footnotes
Footnotes
1 Likewise, the identical form letters directed to Ms. Langendorf on July 9, 2008, and January 13, 2009, in response to her amended requests of July 3, 2008, and January 9, 2009, respectively, were procedurally deficient. In addition, the responses issued on August 5 and 14, 2008, failed to comply with KRS 61.880(1) insofar as the CHFS merely parroted the language of KRS 61.878(1)(a), and indicated that information was "redacted in accordance with the Kentucky Revised Statutes," respectively, instead of citing the applicable statutory exception(s) and providing the requisite brief explanation of how it applied to the records or information being withheld.
2 Mr. Klein referred Items 15, 24, 33, and 34 to the Department for Medicaid Services for a response. DMS provided Ms. Langendorf with documents responsive to Items 15 and 24; any related issues are thus moot per 40 KAR 1:030, Section 6. DMS advised that documents responsive to Item 34 had already been provided, and "[t]here were no responsive records for Item No. 33."
3 Specifically, Mr. Klein advised with regard to Item 3 that neither a "DCBS 284, nor a 'Report Not Accepted Letter' [was] generated as a result of this investigation. Accordingly, these documents were not provided." In response to Item 19, Mr. Klein advised that "[t]o the extent that any substantiated findings were made, they were documented in records already released. . . . There is no documentation in OIG's files to indicate that the requested notifications were drafted or sent."
4 OSCAR is the acronym for Online Survey Certification And Reporting. ASPEN is the acronym for Automated Survey Processing Environment.
5 Pursuant to 45 CFR § 2.3:
No employee or former employee of the DHHS [Department of Health and Human Services] may provide testimony or produce documents in any proceedings to which this part applies concerning information acquired in the course of performing official duties or because of the person's official relationship with the Department unless authorized by the Agency head pursuant to this part based on a determination by the Agency head, after consultation with the Office of the General Counsel, that compliance with the request would promote the objectives of the Department.
6 At page 2 of that decision, the Attorney General observed that amendments were made to the cited regulations in late 2008, which presumably "accounts for the OIG's recent change in policy" regarding disclosure of the reports.
7 With regard to application of KRS 61.878(1)(a) generally, the analysis contained in 06-ORD-006 (pp. 5-10) is controlling; a copy of that decision is attached hereto and incorporated by reference.
8 At page 7, this office noted that "[o]ur analysis of the OIG's original invocation of KRS 61.878(1)(a) mirrors our analysis of its invocation of KRS 194A.060(1) inasmuch as both exceptions are aimed at protecting 'the individual's right to privacy.'" In our view, the policy violated the Act, "incorporating KRS 194A.060(1), as the controlling law in the resolution of this dispute under the 'required by law' exception to the HIPAA Privacy Rule." 08-ORD-166, p. 9.
9 Unless Ms. Langendorf can explain the necessity of reproducing the same records more than once, such as loss or destruction of the records, the CHFS is not obligated to satisfy the same request a second time. 05-ORD-198, p. 2.