Opinion
Opinion By: Daniel Cameron, Attorney General; Matthew Ray, Assistant Attorney General
Summary : The Hopkins County Health Department (the "Department") violated the Open Records Act ("the Act") when it did not issue a timely written response to a request to inspect records. However, the Department did not violate the Act when it denied inspection of records exempt under the Health Insurance Portability and Accountability Act ("HIPAA") or when it did not produce for inspection records that do not exist in the Department's possession.
Open Records Decision
On June 10, 2021, John Yarbrough ("Appellant") mailed a request to the Department to inspect records related to deaths attributed to Covid-19 within the county. The Appellant specified that the scope of his request included the "age, date, location of death, and comorbidities[]" as well as "all records of vaccine adverse reactions." The Appellant further sought records pertaining to Covid-19 cases "after vaccination," and information related to the use of polymerase chain reaction ("PCR") tests, which he claims were used by the Department. 1On June 29, 2021, having received no response from the Department, the Appellant appealed to this Office.
Historically, a public agency was required to respond to an open records request within three business days. 2KRS 61.880(1). In response to the public health emergency caused by the novel coronavirus, however, the General Assembly modified that requirement when it enacted SB 150, which became law on March 30, 2020. SB 150 provides, notwithstanding the provisions of the Act, that "a public agency shall respond to the request to inspect or receive copies of public records within 10 days of its receipt." SB 150 § 1(8)(a). Under KRS 446.030, when the period prescribed by statute is seven days or less, weekends and legal holidays are excluded from the computations of time. Therefore, because SB 150 provides ten days to respond, weekends or holidays are not excluded from the computation of time and a response is due within ten calendar days of receipt.
Here, the Department does not assert that its response was timely, or explain why its response was dated twenty days after the Appellant submitted his request. Because the Department did not reply to the Appellant's request within ten days, it violated the Act, as modified by SB 150.
After the Appellant initiated this appeal, the Department responded to the request and provided responsive records to the Appellant. Specifically, it provided anonymized data related to Covid-19 deaths in the county it serves. The anonymized data categorized the deaths by gender and age. The Department also stated that the "most common co-morbidities" are "diabetes, lung diseases, cancer, heart disease, age, and smoking." The Department also indicated that there have been "several" deaths associated with Covid-19 associated with mild or no comorbidities. The Department, however, claimed it could not give "more detailed information about patients" due to the Health Insurance and Portability Act ("HIPAA"). For that reason, it denied the Appellant's request for the dates and locations of the deaths.
The Department was authorized to deny inspection of the dates and locations of deaths under HIPAA. A public agency may deny inspection of public records or information "the disclosure of which is prohibited by federal law or regulation[.]" KRS 61.878(1)(k). HIPAA is a federal law that applies to "covered entities," which include "health care providers." 45 CFR § 160.103. Entities covered under HIPAA, such as the Department, which provides health care services to individuals, are prohibited from releasing the "individually identifiable health information" of individuals, and such information includes "past, present, or future" health conditions that "identifies the individual" or if "there is a reasonable basis to believe the information can be used to identify the individual." 45 CFR § 160.103. However, information "regarding a person who has been deceased for more than 50 years" is not protected. Id. Therefore, if the person has been deceased for less than 50 years, the decedent's "individually identifiable health information" remains protected.
Here, the Department explains that, due to HIPAA, it is unable to release the dates or locations of deaths "because in a small community that makes these cases easily identifiable with obituaries." The Appellant argues there is a strong public interest in disclosing information about those who suffer deaths related to Covid-19 and such information is vitally important to shed light on the Department's pandemic response. However, in all instances in which an exception to HIPAA may apply, the discretion to use that exception is left to the covered entity. For example, it is true that, in some circumstances, "individually identifiable health information" may be shared if the Department "in good faith, believes the use or disclosure" is "necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public." 45 CFR § 164.512(j)(1)(i). But even then, the disclosure can only be made "to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat." Id. Therefore, the use of that exception, if it even applied under these facts, is left to the discretion of the Department. And the Department has declined to exercise its discretion under any exception to HIPAA. Therefore, the Department did not violate the Act in denying the Appellant's request for these records.
Finally, in response to the Appellant's request for records related to adverse reactions to vaccines, or records related to the use of PCR tests, the Department stated that no responsive records exist within its possession.
A public agency cannot grant a requester access to a record that does not exist.
Bowling v. Lexington Urban County Government , 172 S.W.3d 333, 341 (Ky. 2005). Once a public agency states affirmatively that it does not possess responsive records, the burden shifts to the requester to present a prima facie case that the requested records do exist in the agency's possession. Id. at 341. If the requester can make a prima facie case that records do or should exist, then the agency "may also be called upon to prove that its search was adequate."
City of Fort Thomas v. Cincinnati Enquirer , 406 S.W.3d 842, 848 n.3 (Ky. 2013) (citing Bowling , 172 S.W.3d at 341). This Office has found that an agency is not required to create a record to discharge its duty under the Act and the failure to do so is not a violation of the Act. See, e.g. , 19-ORD-051; 19-ORD-218.
Here, the Department claims it does "not have the access or permission to share" information related to the Vaccine Adverse Events Reporting System ("VAERS"), and that it has never performed PCR testing. The Department also states it does "not compile [general] death report statistics" such as statistics of deaths caused by the flu, heart attacks, cancer, or other diseases. The Appellant provides as prima facie evidence the Department's prior public statement that it "had no issues reported by those who got" a specific vaccine brand. The Appellant states that he is requesting to inspect the document that the Department relied upon to make that public statement. But the Department claims that it does not possess records from the VAERS system, and is unable to produce those records for inspection. Even if the Department did possess records contained in the VAERS system, its public statement was that there have been no adverse-effect reports. Thus, it stands to reason that there would be no records in the system related to adverse vaccine effects, if none were reported, and thus there are no records for the Department to possess. Moreover, the Appellant does not refute the Department's claim that it does not use PCR testing. As such, the Department did not violate the Act when it did not produce for inspection records that do not exist in its possession.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General shall be notified of any action in circuit court, but shall not be named as a party in that action or in any subsequent proceedings.
Footnotes
Footnotes
1 The PCR test is a common test used to diagnose people who are currently infected with severe acute respiratory syndrome coronavirus 2 ("SARS-CoV-2"), the coronavirus that causes COVID-19. It is considered the "gold standard" and is the most accurate and reliable test for diagnosing COVID-19. The Cleveland Clinic, https://my.clevelandclinic.org/health/diagnostics/21462-covid-19-and-pc… (last visited Jul 19, 2021).
2 Effective June 29, 2021, KRS 61.880(1) is modified to require an agency to respond, in writing, within five business days of receiving the request and notify the requester whether it will comply with or deny the request. A public agency should no longer rely on SB 150, and its ten-day deadline, when responding to requests submitted under the Act. However, because the Appellant had submitted his request on June 10, 2021, the provisions of SB 150 controlled the Department's response time.