Opinion
Opinion By: Jack Conway, Attorney General; Michelle D. Harrison, Assistant Attorney General
Open Records Decision
The question presented in this appeal is whether the University of Kentucky violated the Kentucky Open Records Act in denying Dr. James W. Coleman's August 1, 2011, request for "statistical information on female breast cancers in Jefferson County, Kentucky" as described in six enumerated paragraphs. 1 In a timely written response, Official Records Custodian Frank Butler advised Dr. Coleman that the "Kentucky Cancer Registry does not maintain the data you have requested in the format you have requested." Mr. Butler further indicated to Dr. Coleman that he "may apply for a dataset as described on the Kentucky Cancer Center website at [http://www.kcr.uky.edu/research]. The Registry has a formal document process for data requests, and you would be required to complete and submit your online application form first . . . so the Registry can be compliant with [its] statutory duties." In response to a subsequent e-mail from Dr. Coleman, 2 UK further explained that "KCR does not possess populations at risk for cancer by zip code, " and therefore "cannot calculate cancer incidence rates by zip code. " UK also invoked KRS 214.556(6), incorporated into the Open Records Act by operation of KRS 61.878(1)(l), arguing that "KCR records are confidential by statute."
Under existing authority, UK is not statutorily required to tailor the format of its existing database to conform to the parameters of a request submitted under the Act; however, the alternative is generally to provide a requester with a copy of the entire database after those fields of information for which statutory protection exists, if any, have been redacted. See, for example, 05-ORD-129. Accordingly, the fundamental issue that must be resolved here is whether the protection of KRS 214.556(6) extends to de-identified statistical data such as that requested. Because UK has not cited, nor has the Attorney General independently located, any binding statutory or judicial authority to the contrary, this office reaffirms the reasoning contained in 04-ORD-077 regarding the obligation to disclose statistical data not descriptive of any readily identifiable person and finds that UK has interpreted KRS 214.556(6) too broadly.
By letter dated August 8, 2011, Mr. Butler addressed Dr. Coleman's August 4 e-mail (see note 2), explaining that he apparently drew "an incorrect inference" from the agency's initial response insofar as he believed that he would be able to able to access the information requested in the format requested if he used the established process to which Mr. Butler had referred. Having reiterated that "KCR does not possess populations at risk for cancer by zip code, " and therefore "cannot calculate cancer incidence rates by zip code, " UK advised that in response to "an appropriate request for data, including documented assurances of the protection of patient confidentiality" by Dr. Coleman "or any other requester, KCR could provide cancer incidence counts by zip code. " Cancer incidence rates by county, UK noted, "are publicly accessible through KCR's website. " Mr. Butler reiterated that "KCR does not have to produce the records if they do not have them and they are not required to create documents." Mr. Butler also cited KRS 214.556(6), incorporated into the Open Records Act by operation of KRS 61.878(1)(l), advising Dr. Coleman that he "did not cite this as a basis for denial previously because KCR did not have the records you requested and I saw no need to cite any other basis for a denial" of the request.
Dr. Coleman then asked Mr. Butler to "please provide the incidence counts, i.e., case counts, as set forth in numbered paragraphs 1, 2, 4 and 5 of my original" request. By letter dated August 12, Mr. Butler reaffirmed the denial by UK of his request on the bases of KRS 214.556(6) and 61.878(1)(l). In reply, Dr. Coleman asserted that UK had "misapplied both statutes" because "[s]ome but not all KCR records are confidential pursuant to KRS 214.556(6)." Citing 04-ORD-077, Dr. Coleman argued that the protection of that privilege "applies to individual patient privacy information, not statistical information as I have requested." In further support of his position, Dr. Coleman correctly observed that some KCR data is listed as non-confidential on the KCR website. On behalf of UK, Mr. Butler maintained that "KRS 214.556(6) clearly makes all KCR records confidential. " He further advised Dr. Coleman that his previous recommendation "was not a suggestion that this information would be made available" pursuant to the Open Records Act; rather, it "was to inform you that if you filed a request with KCR and met all the requirements pursuant to the KCR process you may be provided that information, . . . '" According to UK, the "authority to establish the process and mandate these requirements is delegated to KCR pursuant to KRS 214.556." This appeal followed. 3
Upon receiving notification of Dr. Coleman's appeal from this office, General Counsel Barbara W. Jones responded on behalf of UK, quoting the language of KRS 214.556(6) and noting that KCR is "required to issue a variety of periodic reports to state governmental agencies and can determine what data and other information to post on its public website in order to 'advance cancer control in the Commonwealth.' KRS 214.556(7)." According to Ms. Jones, the KCR website accomplishes the "mission to 'advance cancer control' by informing the public and encouraging the development of programs and research to prevent cancer in Kentucky." Ms. Jones further advised that KCR has "established a request for information system in order to track the requests for information, and to maintain records of where its information for programs and research is shared." In all instances, Ms. Jones continued, "a person who desires specific information/data from KCR, must complete the attached application (downloaded from the website) . This allows the requester to self-identify what Level researcher the requester should be considered for purposes of using the requested information." Additionally, the requester must "affirm in writing that he/she will maintain the confidentiality of the information he/she receives." In UK's view, KCR is "not obligated to provide the requester any information/data if the form is incomplete or if it is determined that the requester should not be authorized to receive the information requested." Citing "basic principles of statutory construction," KCR maintained that its denial on the basis of KRS 214.556(6) was proper but cited no express authority for the application process.
With regard to application of 04-ORD-077, UK did "not disagree with the principles summarized by the Attorney General" relative to
Kentucky Board of Examiners of Psychologists v. Courier-Journal, 826 S.W.2d 324 (1992) but noted there was no "statutory construction analysis" contained therein. Accordingly, the analysis of
Hardin County Schools v. Foster, 40 S.W.3d 865 (Ky. 2001) upon which 04-ORD-077 was premised "is not applicable in this appeal," UK contended, as "the records were not denied because of patient confidentiality concerns. The records were denied because all records maintained by KCR are confidential by statute." 4
To facilitate a correct resolution of this matter, the Attorney General requested, under authority of KRS 61.880(2)(c) and 40 KAR 1:030, Section 3, that UK provide us with additional information regarding the fundamental question presented. Specifically, this office asked Ms. Jones to please explain if or when KCR ceased to maintain data by zip code given that such information was available when 04-ORD-077 was issued. This office also requested that UK elaborate upon the assertion that "KCR does not 'possess populations at risk for cancer by zip code, " and thus cannot determine "cancer incidence rates by zip code, ' clarifying the specific meaning of 'populations at risk' and 'incidence rates' and the relationship between the two." Further, UK was asked how it "reconciles the fact that KCR's website identifies 'Non-Confidential Types' under the heading 'Types of Data Available' with its position that all KCR data is confidential per KRS 214.556(6), particularly as that provision was interpreted in 04-ORD-077." (Original emphasis.) This office also requested that UK clarify whether it "has the ability to extract any responsive information from the existing database as generally required under the Open Records Act if non-exempt information exists." Finally, this office asked UK to elaborate upon its position that 04-ORD-077 is distinguishable from this appeal, "given the similarity between the requests (in relevant part) in each case and the holding of that decision which, as you know, is based on Hardin County Schools v. Foster, [above]."
In response, UK quoted KRS 214.556 in its entirety and explained the "history and background of KRS 214.556 [acknowledging that "legislative history is thin"], the societal implications, and the important role of a cancer registry. " UK also generally referenced guidelines from the International Association of Cancer Registries, Centers for Disease Control and Prevention, and the North American Association for Central Cancer Registries, arguing that all of the above "direct that in order to assure confidentiality and integrity of cancer registry data, the director of the cancer registry should evaluate requests and determine if the request is appropriate." UK further asserted that the General Assembly "expressly implemented this directive" by enacting KRS 214.556, particularly subsection (6); however, noticeably absent from that provision is any specific language vesting the Director of KCR with such authority. 5
UK then referenced authority from other jurisdictions, including Texas and Delaware, enclosing a summary outlining the "civil and even criminal penalties" that can result from disclosure of cancer registry information. KRS 214.556 does not contain any comparable provision. Finally, UK argued that 04-ORD-077 is not applicable on these facts because a request for KCR documents maintained by the University of Louisville was at issue and, while U of L "is a participant in the KCR (and as a healthcare provider is required to participate by statute) it does not maintain the state's cancer registry and does not have the same obligations." According to Ms. Jones, U of L "lacked a specific statutory charge to protect the records, as well as statutory language stating that all data, findings and conclusions in its possession are confidential. " UK further emphasized that Dr. Coleman requested "'raw data and any and all other documents used in connection with calculations that appeared in a report " published by U of L in 2003. (Original emphasis.) Reiterating that KCR "does not possess population records by zip code, " and thus "cannot calculate cancer incidence rates by zip code, " UK noted that Dr. Coleman is assuming "the existence of the information by zip code because of records in the possession of a [U of L] researcher . . . [but] he used sources outside of the KCR."
UK did not clarify the meaning of "populations at risk" and "incidence rates" as requested nor did it directly respond to any of the specific questions asked with the exception of unsuccessfully attempting to distinguish 04-ORD-077. Dr. Coleman noted these omissions in a reply letter dated October 7, further arguing that a "negative inference should be drawn" from its "refusal to explain" the listing of "Non-Confidential Types" of data on its website. He further observed that the KCR website contains "incidence and mortality rates are posted for over 70 different cancer sites in humans in all counties in this Commonwealth." Acknowledging that "[t]he issue of population at risk data and incidence rates was properly and adequately addressed by UK," Dr. Coleman reiterated that he narrowed the request to include only specified breast cancer "case counts" in certain zip codes, data which UK has acknowledged is maintained in the KCR database. Assuming that UK does not maintain the specific data requested, which is unclear from the inconsistent assertions of record, the agency is not required to compile such data or tailor the format of its existing database to conform to the parameters of the request. Under the circumstances presented, a public agency such as UK must, in the alternative, release the entire database; accordingly, the underlying question of this appeal is whether all KCR data is confidential per KRS 214.556(6). In the absence of any binding statutory or judicial authority that would justify departing from 04-ORD-077, it remains controlling.
Recognizing as a threshold issue that a "database is unquestionably a 'public record' as that term is defined at KRS 61.870(2)," the Attorney General has addressed the issue of public access to governmental databases a number of times in recent years. See 03-ORD-214; 05-ORD-129; 10-ORD-061; 11-ORD-085. In 03-ORD-214, the Attorney General was asked to determine whether the Kentucky Tobacco Settlement Trust Corporation had properly denied a request for the database containing the Phase II payments from 2002, identifying the quantities used in calculating the payments (indicating tobacco quota owned or tobacco grown), and requiring manipulation of that data. Although the Corporation erred in denying the request, this office concluded that the Corporation satisfied its statutory obligation to disclose the records by producing them in standard format, as that term is defined at KRS 61.874(2)(b). In our view, the Corporation was not obligated to tailor the format to conform to the parameters of the request at issue. Relying upon 03-ORD-004 (disclosure of existing database, with appropriate redactions to protect identifying information relating to individual Medicaid recipients, did not constitute unreasonable burden under KRS 61.872(6)), this office held that the Corporation discharged its statutory duty by making the entire database available in the format in which it was regularly maintained. 03-ORD-214, p. 9 (citations omitted).
KRS 61.874(3) speaks directly to this issue. In relevant part, KRS 61.874(3) provides that "[i]f a public agency is asked to produce a record in a nonstandardized format, or to tailor the format to meet the request of an individual or group, the public agency may at its discretion provide the requested format and recover staff costs as well as actual costs incurred." In construing this provision, the Attorney General has consistently observed that "[a]lthough they are not required to do so, public agencies may agree to extract electronically stored information to conform to the parameters of an open records request and in so doing, incur 'actual costs' in addition to media and mechanical processing costs . . . that could properly be passed along to the requester. " 01-ORD-158, p. 4 (holding that agency was not required to comply with request for compilation of statistical data not already maintained); 10-ORD-061. This position mirrors the holdings in a series of decisions dating back to 95-ORD-82, recognizing that is within the discretion of a public agency to tailor the format of records to conform to the parameters of a specific request, and to recoup both staff and actual costs in the event that it affirmatively exercises this discretion. 96-ORD-133; 99-ORD-68; 02-ORD-148; 05-ORD-129.
Because the language of KRS 61.874(3) is discretionary, UK did not violate the Act in refusing to reformat its database to conform to the parameters of Dr. Coleman's request. However, the analysis does not end there. In 02-ORD-89, the Attorney General reaffirmed the principle that a public agency can properly decline to reformat its database for the purpose of satisfying a request for information in a specially tailored format by virtue of KRS 61.874(3) . At the same time, this office recognized that "[t]he agency's alternative . . . would be to release the entire database in the format in which it is regularly maintained." Id., p. 12, note 5. See 05-ORD-129 (database maintained by the agency contained information responsive to the request and this office reaffirmed the principle that redacting information contained in a database is not the equivalent of producing a record in a nonstandardized/specially tailored format) ; see also 96-ORD-251. Here, KRS 214.556 precludes UK from releasing the entire database; accordingly, this office asked UK whether it has the ability to extract any responsive information from the existing KCR database, but received no response, presumably because UK continued to maintain that all KCR data is confidential.
UK has repeatedly asserted that "KCR does not possess populations at risk for cancer by zip code, " and therefore "cannot calculate cancer incidence rates by zip code. " (Emphasis added.) However, this position is seemingly inconsistent with its statement that in response to "an appropriate request for data, including documented assurances of the protection of patient confidentiality" by Dr. Coleman "or any other requester, KCR could provide cancer incidence counts by zip code. " (Emphasis added.) In light of these apparent discrepancies, and given the limited evidence presented, the Attorney General asked UK to clarify "the specific meaning of 'populations at risk' and 'incidence rates' and the relationship between the two." UK did not do so. Dr. Coleman appears to refer to "incidence counts" and "case counts" interchangeably. In any event, he ultimately revised the request, asking for specified breast cancer "case counts" in specified zip codes. UK did not directly respond though it did maintain its earlier position. The record on appeal is, at best, conflicting on the distinction, if any, between the requested "incidence rates" and "case counts," and/or "incidence counts." However, UK maintains that it cannot calculate incidence rates by zip code, and Dr. Coleman ultimately conceded that "[t]he issue of population at risk data and incidence rates was properly and adequately addressed." UK indicated that upon receipt of an "appropriate request," KCR "could provide cancer incidence counts by zip code. " Accordingly, this office must assume that statistical information responsive to Dr. Coleman's request (as revised prior to his appeal), exists in the database at a minimum.
UK relied upon KRS 214.556 in denying Dr. Coleman's request for statistical data contained in the KCR database, and in further asserting that all KCR data is confidential pursuant to subsection (6) of that provision, which provides that "[a]ll information, interviews, reports, statements, memoranda, or other data furnished by reason of this section and any findings or conclusions resulting from those studies shall be privileged." In 04-ORD-077, however, this office recognized that "subsections (5) and (6) operate in tandem to prohibit disclosure of personally identifiable information flowing to or from the [KCR] in furtherance of its stated purpose [see KRS 214.556(1)]," and significantly, found that the "prohibition on disclosure of data is not . . . absolute [see KRS 214.556(7)], but is instead confined to data identifying 'any person whose condition or treatment has been reported to the [KCR]' per KRS 214.556(2) ." 04-ORD-077, pp. 7-8. Based upon the analysis contained in Hardin County Schools v. Foster , above, this office held that U of L had "failed to meet its burden of proving that the statistical information contained in the records to which Dr. Coleman" requested access was "descriptive of any readily identifiable person."
This office respectfully finds the attempt by UK to distinguish 04-ORD-077 from the instant appeal unpersuasive. Because the parties are both clearly familiar with 04-ORD-077 (a copy of which is attached hereto and incorporated by reference), disagreeing as to its application, this office will not unnecessarily lengthen the instant decision with a recitation of the reasoning upon which it was premised. UK asserted that its "formal document process for data requests" is necessary for compliance "with [its] statutory duties," and that "authority to establish the process and mandate these requirements" can be found in KRS 214.556(6), which further authorizes the director of the KCR to "evaluate requests and determine if the request is appropriate" according to UK; however, a review of KRS 214.556 does not confirm any of these assertions. Equally lacking from KRS 214.556 is any language indicating that UK has a different "statutory charge" or level of responsibility or authority that would justify treating it differently than any other participant 6 (such as of U of L) in the KCR; instead, subsection (6) affords protection to "data furnished by reason of this section and any findings or conclusions resulting from those studies" regardless of which participant furnishes the data or possesses it.
The Attorney General has "neither the duty nor the prerogative . . . to breathe into the statute that which the Legislature has not put there."
Commonwealth of Kentucky v. Gaitherwright, 70 S.W.3d 411, 413 (Ky. 2002). Further, the KCR website identifies 'Non-Confidential Types' under the heading 'Types of Data Available'" and UK declined to satisfy its burden of proof under KRS 61.880(2)(c) by explaining how it reconciled that characterization of some KCR data with its position that all KCR data is confidential per KRS 214.556(6), "particularly as that provision was interpreted in 04-ORD-077," relying instead on the purported authority of the KCR Director to determine whether a request should be honored. For all of the foregoing reasons, the Attorney General finds that UK did not violate the Open Records Act in declining to reformat its database or create a record for the purpose of complying with Dr. Coleman's request for statistical KCR data but did interpret KRS 214.556(6) too expansively in refusing to provide him with access to existing responsive data which is "not descriptive of any readily identifiable person" consistent with 04-ORD-077.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Distributed to:
Dr. James Coleman, PhD.Frank Butler
Footnotes
Footnotes
1 Dr. Coleman specifically requested the following:
1. Incidence rates of black female breast cancers (combine both in situ and invasive) for ZIP Code 40211 covering the aggregates for 1995-2000, 2001-2005 and 2006-2008 per 100,000 age-adjusted using both the 1970 U.S. population and the 2000 U.S. Standard Million Population. Also, please give: (i) the 95% confidence intervals for the two standards covering each of the three time periods; and (ii) for this ZIP Code, the size of the population at risk and the total case counts for each year from 1995 through 2008.
2. [Same as above for zip code 40212]
3. Incidence rates of black female breast cancers (combine both in situ and invasive) for ZIP Codes 40211 and 40212 combined covering the aggregates for 1995-2000 and 2006-2008 per 100,000 age-adjusted using both the 1970 U.S. population and the 2000 U.S. Standard Million Population. Also, please give the confidence intervals for the two standards covering each of the three time periods.
4. [Same as Item 1. except for "white female breast cancers" for zip code 40222]
5. [Same as Items 1, 2, and 4 for "white female breast cancers" for zip code 40223]
6. [Same as Item 3 except for "white female breast cancers" for zip codes 40222 and 40223 combined]