Opinion
Opinion By: Jack Conway, Attorney General; Jessica R. C. Malloy, Assistant Attorney General
Open Records Decision
Cable News Network, Inc., ("CNN"), appeals the University of Kentucky's partial denial of Senior Medical Correspondent Elizabeth Cohen's February 13, 2014 and March 27, 2014 requests for records relating to UK's pediatric heart surgery program. While UK disclosed the 2011 and 2012 mortality rates by "STAT" category 1 and by procedure, it refused to provide raw numbers of the total volume of surgeries, number of deaths, and number of survivors on which the rates were based. Further, UK refused to disclose reports submitted to UK by the Society of Thoracic Surgeons Congenital Heart Surgery Database/Duke Clinical Research Institute from June 2011 to the present.
In defending its decision to deny CNN's request for raw data, UK argues that it is prohibited from disclosing statistical data where, in this case, the raw numbers of surgeries, deaths, and survivors is "less than five." To that end, UK argues that, either individually or collectively, three statutes prohibit UK from releasing information when there is a reasonable basis to believe the information can be used to identify an individual. First, UK argues that the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 42 U.S.C. § 1320d-2, prohibits the disclosure of this information as UK made the calculations "as part of its ongoing review to improve patient safety, health care quality, and health care, outcomes." Second, UK argues the Patient Safety and Quality Improvement Act ("PSQIA"), 42 U.S.C. §§ 299-b-21 through b-26, prohibits the disclosure of the raw numbers, as the records constitute patient safety work product. Third, UK argues the privacy exception to the Open Records Act, under KRS 61.878(1)(a), precludes UK from releasing the numbers of surgeries, deaths, and survivors, because releasing the information may reasonably lead to the identification of a particular patient.
To support its argument that it is precluded from releasing raw data which is "less than five," UK relies on guidelines issued by the National Center for Health Statistics "prohibit[ing] (1) the disclosure of quantity figures that are less than five; and (2) the disclosure of numbers greater than five if such disclosure would result in numbers less than five being derivable through subtraction or other calculation. " See NATIONAL CENTER FOR HEALTH STATISTICS STAFF MANUAL ON CONFIDENTIALITY § 10.3. While the guidelines are nonbinding, UK argues that they are "helpful in determining whether there is a reasonable basis to believe that an individual patient can be identified . . . ."
UK restated these arguments in response to CNN's March 27 request but asserted additional grounds for nondisclosure of the newly requested fall and spring "harvest reports" and other records that do not exist. Citing KRS 61.878(1)(b), UK refused to disclose the reports characterizing them as "scientific research information that was disclosed to the University by the Society of Thoracic Surgery with the explicit understanding that the University would not disclose the information to others . . . ." Addressing an unspecified record or records, UK refused to create a new record "to the extent the request requires the University to produce a record that does not exist." An analysis of the argument advanced by UK follows.
I. UK properly withheld the raw data consisting of the total volume of surgeries, number of deaths, and number of survivors related to its pediatric cardiothoracic program, as those numbers are less than five.
As there is a reasonable basis to believe that the disclosure of the raw number of surgeries, number of deaths, and number of survivors which are less than five could be used to identify individual patients and is descriptive of a readily identifiable person, HIPAA and KRS 61.878(1)(a) impedes access to this data. See 45 C.F.R. 160.103(2)(ii).
It is unnecessary, in our view, to debate which of these laws, HIPAA or KRS 61.878(1)(a), is controlling in this appeal. In this context, the laws share a common aim: protection of patient privacy. The laws also recognize the propriety of release of nonidentifiable patient information. Thus, 45 C.F.R. 160.103(2)(ii) excludes information from the definition of individually identifiable health information if there is no "reasonable basis to believe the information can be used to identify the individual." KRS 61.878(2) excludes from the protections afforded by KRS 61.878(1)(a) through (n) "statistical information not descriptive of any readily identifiable person." Like the court in
Abbott v. Texas Dep't of Mental Health and Mental Retardation, 212 S.W.3d 648, 657 (Tx. App. 2006), we believe that "a covered entity may satisfy all the requirements of both sets of statutes."
In
Hardin County Schools v. Foster, 40 S.W.3d 865 (Ky. 2001), the Kentucky Supreme Court addressed a similar issue in the context of a dispute focusing on access to student discipline statistics compiled by the Hardin County Public Schools. Rejecting the school system's reliance on the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g(b)(1) ("FERPA"), the Court reasoned that, "[t]he statistical information requested by Foster does not contain any information which directly relates to a particular student and thus is not an educational record within the meaning of the federal statute. . . . Personally identifiable information would include information that makes the identity of the student easily traceable such as a name, address or personal characteristics." Id. at 868-69. Recognizing that the school system "has the burden of proving that the document sought fits within an exception to the open Records Act," that the Act "demonstrates a general bias favoring disclosure, " and that KRS 61.872(2) requires disclosure of "statistical information not descriptive of any readily identifiable person," the Court resolved any existing doubt in favor of disclosure, concluding that the statistical compilations "did not identify individual students" and were therefore "not descriptive of any readily identifiable person." Id. at 868.
Writing in dissent, Justice Keller lamented the Court's failure to review the actual statistics to make a factual determination whether disclosure of the information would make student identities "easily traceable. " He observed that, "[a]lthough my colleagues conclude correctly that our inquiry is situation specific, I must decline the invitation to 'imagine' a factual record which defines the situation before us on the basis of our own assumptions . . . . " Id. at 872. He went further explaining there is "no basis for this Court, or any court, to express a definitive opinion as to whether this information will actually make student identities easily traceable when that information exists . . . only as hypotheticals and probabilities." Id.
Fortunately, after Judge Keller raised his concerns with "hypotheticals and probabilities," the National Center for Health Statistics issued guidelines to determine whether a reasonable basis exists to believe the information's release could be used to identify an individual. Indeed, in prohibiting the disclosure of "quantity figures that are less than five" and "numbers greater than five if such disclosure would result in numbers less than five being derivable through subtraction or other calculation, " the guidelines set a concrete and actual baseline for determining whether a reasonable basis exists to withhold the information. As the Guidelines explain, in order to provide a complete set of information on a particular subject, "statisticians may--and sometimes do--present so much detail in published tabulations that they accidentally reveal confidential information about particular study subjects." NATIONAL CENTER FOR HEALTH STATISTICS STAFF MANUAL ON CONFIDENTIALITY § 10.3. Accordingly, we agree with the "less than five" baseline. As UK asserts the raw numbers of surgeries, deaths, and survivors are "less than five," the guidelines establish that withholding the information is reasonable. We agree. Likewise, it is reasonable for UK to withhold from disclosure raw numbers which are greater than five but would result in numbers less than five being derivable through subtraction or other calculation. Accordingly, using the National Center for Health Statistics' guidelines "less than five" baseline, we hold that a reasonable basis exists for UK's nondisclosure of this raw data.
II. UK properly withheld reports submitted to UK by the Society of Thoracic Surgeons, because the records were compiled and maintained for scientific research.
UK denied CNN's request for reports submitted to it by the Society of Thoracic Surgeons based on KRS 61.878(1)(b). This exception authorizes nondisclosure of "[r]ecords confidentially disclosed to an agency and compiled and maintained for scientific research. " In a 2001 open records decision analyzing the applicability of KRS 61.878(1)(c) to necropsy records maintained by UK, we recognized that KRS 61.878(1)(b) "would have been available" to the University as a basis for withholding identifying information confidentially disclosed by private horse farm owners who brought dead foals to the Livestock Disease Diagnostic Center for examination. In resolving the records access dispute, we sought "to promote the goals of scientific research at the university level in an environment that recognizes the importance of public agency accountability without impeding private cooperation and candor." 01-ORD-143, p. 14. Nine years later we rejected UK's invocation of the exception to support nondisclosure of "visualizations" presented at a "visioning session" conducted by the Kentucky Consortium for Energy and the Environment because the visualizations "were generated by the University and therefore not 'confidentially disclosed' to it." KRS 61.878(1)(b) was, on these facts, "facially inapplicable to the visualizations. " 10-ORD-151, p. 7.
UK confirmed that the reports contain scientific research and were disclosed to it "with the explicit understanding that the University would not disclose the information to others." Our KRS 61.880(2)(c) review of the reports substantiates UK's position. Without disclosing the substantive content of the report, we can confirm that the introductory pages contain a number of statements of confidentiality and restrictions on disclosure by the participant, UK, without the Society's prior express written permission. On these facts, KRS 61.878(1)(b) is facially applicable to the reports. UK did not violate the Open Records Act in denying this part of CNN's request.
III. UK erred in failing to provide CNN with sufficient information about the records withheld based on their nonexistence to permit CNN to dispute the records' claimed nonexistence.
UK denied CNN's March 27 request for collated mortality rates, and raw numbers of the total volume of surgeries, number of deaths, and number of survivors for the program from January 2006 to December 2010 and categorized by the five "STAT" categories, nine named procedures commonly treated as quality indicators, and, for the same period but extending to October 2012, three identified procedures. This denial was based, in part, on the nonexistence of responsive records. UK did not, however, indicate which of the requested records did not exist. Instead, UK stated that "[t]o the extent that [the] request requires the University to produce a record that does not currently exist, the University declines to create a new record." Citing 10-ORD-187, UK maintained that it had no obligation to create a record that does not exist.
UK correctly states the governing law but fails to identify which of the requests it is not obligated to fulfil owing to the nonexistence of the requested record. KRS 61.880(1) establishes the requirements for agency response to an open records request. An agency response denying, in whole or in part, inspection of any record must include a statement of the specific exception authorizing the withholding of the record and a brief explanation of how the exception applies to the record withheld. In a recent opinion, the Kentucky Supreme Court examined this requirement, observing:
Open Records Act disputes are notorious, of course, for posing unique challenges to our usual adversarial method of dispute resolution. Vaughn v. Rosen, 484 F.2d 820 (D.C. Cir. 1973). Whereas in most disputes both sides have more-or-less equal access to the relevant facts, so that factual assertions and legal claims can be adversarially tested, in ORA cases only the agency knows what is in its records. Rather, the court must hold the agency to its burden of proof by insisting that the agency make a sufficient factual showing -- by affidavit; by oral testimony; or, if necessary to preserve the exemptions, by in camera production -- to justify the exemption. The agency should provide the requesting party and the court with sufficient information about the nature of the withheld record (or the categories of withheld records) . . . to permit the requester to dispute the claim and the court to assess it.
City of Ft. Thomas v. Cincinnati Enquirer, 406 S.W.3d 842, 851-852 (Ky. 2013). UK denied CNN access to records based on the records' nonexistence but failed to specify which of the requests would not be honored on this basis. While it cannot produce a nonexistent record, and is not legally obligated to create one, UK is obligated to provide CNN with sufficient information about the nature of the record or records to which access was denied based on it or their nonexistence to permit CNN "to dispute the claim and the court to assess it." Id.
IV. Conclusion
The University of Kentucky invokes federal and state law to support the position that it properly denied CNN's request for records relating to its pediatric cardiothoracic program and met its statutorily assigned burden of proof in sustaining that action. KRS 61.880(2)(c). Relying on the concrete and actual numbers outlined by the National Center for Health and Statistics guidelines, UK properly withheld the raw numbers of surgeries, deaths, and survivors which support the program's already disclosed mortality rates, because the numbers could be used to identify individual patients and is thus protected by HIPAA and KRS 61.878(1)(a). We, further, affirm UK's denial of CNN's request for reports confidentially disclosed to it by the Society of Thoracic Surgeons that consist of scientific research and analysis based on KRS 61.878(1)(b), an exception to the Open Records Act which is facially applicable here. Finally, we find that, although UK cannot produce nonexistent records and is not obligated to create records to fulfill CNN's request, its response to CNN's March 27 request did not satisfy KRS 61.880(1) or the standard recently established by the Kentucky Supreme Court. The University must provide CNN with sufficient information about the records withheld based on their nonexistence to permit CNN to dispute the record(s)' claimed nonexistence.
Either party may appeal this decision by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Distributed to:
Juanita P. DueBill SwinfordWilliam E. Thro
Footnotes
Footnotes
1 CNN explains that the "STAT" categories are "defined by the Society for Thoracic Surgeons Congenital Heart Surgery Database and the European Association of Cardiothoracic Surgeries, and "categorize surgical procedure types and calculate mortality rate in categories assigned by complexity from levels 1-5."