PRINT VERSION: Attorney General Opinion No. 19-IB32

OFFICE OF THE ATTORNEY GENERAL OF THE STATE OF DELAWARE

Attorney General Opinion No. 19-IB32

June 24, 2019

VIA EMAIL
Edward Montz, Jr., Ph.D.
edwardmntz0@gmail.com
 
RE:     FOIA Petition Regarding the Delaware Department of Health and Social Services
 
Dear Dr. Montz:
We write in response to your correspondence alleging that the Delaware Department of Health and Social Services (“DHSS”) violated the Delaware Freedom of Information Act, 29 Del. C. §§ 10001-10007 (“FOIA”) with regard to your records request.  We treat your correspondence as a Petition for a determination pursuant to 29 Del. C. § 10005(e) regarding whether a violation of FOIA has occurred or is about to occur.  For the reasons set forth below, it is our determination that DHSS has not violated FOIA as alleged.
 
BACKGROUND
On April 17, 2019, you submitted a request to the Division of Public Health (“DPH”) of DHSS for records pertaining to an outbreak of infectious disease at the assisted living facility, Brandywine Assisted Living at Fenwick Island.  DPH is subject to the federal Health Information Portability and Accountability Act (“HIPAA”) and is considered a “HIPAA Covered Entity,” meaning that DPH must comply with HIPAA regulations for all of its programs, including the Office of Infectious Disease Epidemiology.[1]  Your FOIA request sought the following records:
 
Blanket request for any and all records, notes, documents, phone logs, emails, lab tests, environmental tests and any other materials related to the Brandywine Assisted Living at Fenwick Island GI cluster. Please consider this as a request for any similar materials currently being prepared or planned for future preparation, at such time as these materials are completed. The timeframe of the cluster is early March to the present time. I cannot be more specific in my request because I do not know the extent of the State’s involvement in this matter and am relying on the State to fully disclose all requested/related materials. Please consider this a request for information from ALL DHSS departments and personnel involved in this outbreak.[2]
 
After extending the time for their response on May 9, 2019 and again on May 24, 2019, DPH denied your request, citing two exemptions from the definition of “public record.”  DPH cited 29 Del. C. § 10002(l)(1), which exempts medical files, the disclosure of which would constitute an invasion of personal privacy, and 29 Del. C. § 10002(l)(6), which exempts information protected from disclosure by statute.  In support of the latter exemption, DPH cited the HIPAA and 16 Del. C. § 1210, which defines and prohibits the disclosure of protected health information, except in limited designated circumstances.[3]  This Petition followed.
The Petition alleges two overall issues: 1) that “this is not a legitimate denial;” and 2) that “[you] have little confidence that a proper cleanup of the facility was performed so that threats to the residents and the public exist even today.”[4]  Specifically, you argue that disease cluster investigations can be made public without compromising privacy and that while another DHSS division issued an inspection report on the same facility in 2017, DPH and no other division of DHSS responded to your FOIA request.[5]   You also question how DPH can rely on the privacy exemption when it was able to release this 2017 report containing information from medical files.  Finally, you submitted a list of questions to clarify your initial request, explaining you never intended to request “personal information,” but instead sought “procedures and regulatory actions taken against the facility.”[6]  Finally, citing to your numerous stakeholder interests, you “request that DHSS be ordered to release the material immediately . . . .”[7]
DHSS’s counsel responded to the Petition on DPH’s behalf on June 7, 2019 (“Response”).  DPH contends that it was the only respondent because no other division in DHSS has responsive records and that as a HIPAA Covered Entity, it must protect extensive identifying data, including patients’ residences and dates of an outbreak, and would thus have to redact the documents it has so heavily that they would be “meaningless.”[8]  DPH further argued that the number of individuals in the outbreak created a “reasonable basis” to believe that the data requested could be used to identify those individuals, and there was no applicable exemption to provide the information under Delaware’s privacy law.[9]  In response to your assertion that a report was previously published regarding another outbreak, DPH notes that the division publishing that report, the Division of Health Care Quality, is not a HIPAA Covered Entity.[10]  DPH argues that its records are exempt from disclosure by 29 Del. C. § 10002(l)(1), which exempts medical files which constitute an invasion of personal privacy.  Finally, DPH notes that you have spoken with staff on several occasions about this matter and DPH is willing to speak again about your concerns; additionally, your parents’ medical records would be available to you as a power of attorney.
In your reply submitted on June 12, 2019 (“Reply”), you agree that medical information with personal identifiers should not be released nor should DHSS be required to release information in violation of state or federal law.  However, you argue that identifiers in the requested records could be removed and that certain information from the investigation “could, or should” be in DHSS’s files that does not include patients’ information subject to HIPAA, such as the name of the bacteria causing the outbreak, the source of contamination, and how it was cleaned.  You further challenge DHSS’s reliance on 16 Del. C. § 1210, asserting that DHSS has only alleged a mere possibility that identities could be revealed using information purged of identifiers and that is not enough to meet the statutory threshold that a “reasonable basis” exists to believe identification would be possible.[11]  Also, you allege that DHSS’s assessment that the documents, after redacting the information subject to HIPAA, would be rendered meaningless, “is not a valid argument against releasing redacted information.”[12]  You propose a test to prove that re-identification of patients would be impossible.
In summary, you state that the “point is that information exists (or may exist), which is neither associated with personal medical information and/or may be released, subject to removal of all personal identifiers, without violating either state or federal laws.”  Further, you reiterate your four requests for action by this Office: 1) “any and all information contained in DHSS investigation files of Brandywine Assisted Living be release[d] immediately, subject to compliance with applicable laws;” 2) you “request all that all DHSS files, modified in any way to comply with privacy laws, be reviewed independently by DOJ, before release, to ensure that no information is unnecessarily redacted due to overreach;” 3) you “reject the offer to have telephone conversations in lieu of written documents” as you will not “bargain down” your FOIA rights; and 4) if your requests are denied in whole or in part, you request for “all information which does not contain medical information” be released.
 
DISCUSSION
Under FOIA, a public body carries the burden of proof to justify denial of a request for records.[13]  Your request seeks medical information about a disease outbreak.  DHSS denied access to these medical records pursuant to 29 Del. C. § 10002(l)(1) and 29 Del. C. § 10002(l)(6).  You allege that DHSS’s response was improper primarily due to three reasons: 1) DPH was the only responding division of DHSS; 2) you believe the disease cluster investigations can publicized without compromising privacy; and 3) you believe that DHSS has information not subject to the state and federal laws that should be released, including any information remaining in the heavily redacted materials. [14]
First, with regard to your allegation that other divisions within DHSS were not required to response, DHSS’s counsel has confirmed in its Response that DPH is only division believed to have responsive records.[15]  Consistent with this Office’s practice, we accept those representations and find that DHSS appropriately supported its designation of DPH as the appropriate location to search for responsive records.[16]
Second, you suggest that DHSS’s release of the 2017 report indicates that it is possible for DHSS to create a report without using personal medical information.  However, DHSS has not indicated that any such report exists in the fashion you contemplate and FOIA does not require creation of a document. If, in your opinion, other laws outside of FOIA require otherwise, DHSS does not have an obligation under FOIA to create a report.[17]
Third, you allege that DHSS must have certain responsive records that are not precluded from disclosure under state and federal law and should be produced to you, even if heavily redacted.  One reason is that you challenge DHSS’s application of 16 Del. C. § 1210, arguing that there is no reasonable basis to assert that individuals can be identified using the information which would be produced to you and other reasonably available information.  The other reason is that you believe other records without personal medical information must, or should, exist, and the information remaining, even after heavy redactions, should be produced.   DHSS represents that it has reviewed the requested records in light of 16 Del. C. § 1210 and determined that due to the size of the outbreak, DHSS believes that there is reasonable basis that releasing the information that you have requested would potentially reveal the identities of individuals.[18]  Further, DHSS has reviewed the records and found that the remaining responsive documents would be meaningless after the needed redactions.  DHSS also points to 29 Del. C. § 10002(l)(1), noting that the requested records in this case are medical records concerning infectious diseases of individuals at a facility.
This Office accepts the representations of a public body’s counsel to determine whether requested records exist.[19]  Despite the Petition’s assertion that other records might exist or the heavily redacted documents are meaningful, DHSS’s counsel responds that DHSS’s review of the records reveals that the only remaining information would be meaningless due to the heavy redactions required by state and federal law.  In addition, this Office previously determined that FOIA does not require this Office to conduct an investigation or a review of records that a public body has withheld in response to a FOIA request.[20]  Rather, “FOIA only requires a determination of whether the City provided sufficient reasons for withholding the redacted information to satisfy its burden of proof.”[21]  In these circumstances, we are satisfied that DHSS demonstrated that it asserted both FOIA exemptions, 29 Del. C. § 10002(l)(1) and 29 Del. C. § 10002(l)(6) and its underlying state and federal statutes, with a clear understanding of their meanings.
Finally, we note that your Petition includes a list of questions and issues that you expected to be addressed by the documents released to you.  FOIA does not require a public body to answer questions, but to the extent you would like to submit more specific FOIA requests to DHSS incorporating the questions you posed to this Office, you may wish to do so.[22]
 
CONCLUSION
It is our determination that DHSS has not violated FOIA as alleged.
 
Very truly yours,
/s/ Alexander S. Mackler
_____________________________
Alexander S. Mackler
Chief Deputy Attorney General
 
cc:
Joanna S. Suder, Deputy Attorney General
Dorey L. Cole, Deputy Attorney General
[1]           Response.
[2]           Petition.
[3]           Id.
 
[4]           Id.
 
[5]           Id.
 
[6]           Id.
 
[7]           Id.
 
[8]           Response.
 
[9]           Id.

[10]         Id.
 
[11]         Reply.
 
[12]         Id.
 
[13]         29 Del. C. § 10005(c).
 
[14]         Your Petition also alleges that you “have little confidence” that the clean-up was properly performed, which is a matter outside of FOIA that is not within our authority to address through the petition process.
 
[15]         Response (“Based upon information and belief, no other Division within the Department has any responsive records.”).
 
[16]         Del. Op. Att’y Gen. 17-IB59, 2017 WL 6348853, at *FN12 (Nov. 20, 2017) (citing to the Delaware Lawyers’ Rules of Professional Conduct and determining that the factual representations made by the public body’s counsel “serve to satisfy [its] burden.”).
 
[17]          Del. Op. Att’y Gen. 18-IB34, 2018 WL 3947262, at *2 (July 20, 2018) (“FOIA does not require a public body to create a new document in response to a records request.”).
 
[18]         See 16 Del. C. § 1210 (including information “about which there is a reasonable basis to believe such information could be utilized (either alone or with other information that is or should reasonably be known to be available to predictable recipients of such information) to reveal the identity of that individual.”).
 
[19]         See Del. Op. Att’y Gen. 15-IB14, 2015 WL 9701645, at *FN 14 ( (“It has been our historical practice to accept such representations from an attorney for the custodian of public records to determine that such documents do not exist for purposes of FOIA.”).”
 
[20]         Del. Op. Att’y Gen. 18-IB04, 2018 WL 1061272, at *3 (Jan. 23, 2018).
 
[21]         Id. (emphasis in original).
 
[22]         See, e.g. Del. Op. Att’y Gen. 17-IB05, 2017 WL 1317847, at *3 (Mar. 10, 2017); Del. Op. Att’y Gen. 17-IB04, 2017 WL 1317846, at *2 (Mar. 8, 2017); Del. Op. Att’y Gen. 08-IB05, 2008 WL 1727613, at *1 (Feb. 22, 2008); Del. Op. Att’y Gen. 00-IB08, 2000 WL 1092967, at *2 (May 24, 2000); Del. Op. Att’y Gen. 97-IB06, 1997 WL 606408, at *5 (Mar. 17, 1997).
 
 

<< Back