Question
I was told by our county authorities that the county cannot release specific ages, gender, co-morbidities or housing situation (group homes vs. apartments vs. single-family homes) for those individuals whose cause of death was attributed to COVID-19 on the grounds that releasing that data would violate health information privacy rules under HIPPA (Health Insurance Portability and Accountability Act).
I do not want a list of information for each individual. I want to aggregate data on demographics. I understand HIPPA protects the individually identifiable health information about a decedent, but I wouldn’t think aggregate information would count as “individually identifiable.” Can you give some guidance?
Answer
As you know, the CPRA has many listed exemptions to its disclosure rules. One of those, Cal. Gov. Code § 6254(k), exempts “Records, the disclosure of which is exempted or prohibited pursuant to federal or state law.” HIPAA could be one of these laws, though at present, no published California case has discussed the intersection of the CPRA and HIPAA.
HIPAA’s implementing regulations authorize the disclosure of certain health information where required by state law. 45 CFR § 164.512(a)(1). As other state courts have held, this includes state open records laws that presume records are disclosable.See, e.g.,State ex rel. Cincinnati Enquirer v. Daniels, 844 N.E.2d 1181 (Ohio 2006).As such, some types of information otherwise protected by HIPAA could be disclosable under the CPRA, though no California authority has yet stated this explicitly.
On the other hand, the CPRA contains a separate exemption for “[p]ersonnel, medical, or similar files, the disclosure of which would constitute an unwarranted invasion of personal privacy.” § 6254(c). This might be an independent ground for denying your type of request. However, this exemption is not an “all-or-nothing” approach. Where only a portion of a record is exempt, the non-exempt portions should be disclosed.Braun v. City of Taft, 154 Cal. App. 3d 332, 341 (Ct. App. 1984).
Note that, when exempt and non-exempt information is contained in the same record, Cal. Gov. Code § 6253(a) requires public agencies to redact any “reasonably segregable portion” and disclose the rest. If the county has the type of data you are seeking, and it can reasonably segregate personally identifiable information, it should do so. Additionally, where information is stored in an electronic format, the agency can be requested to compile and/or extract certain data. Cal. Gov. Code § 6253.9(a). This could include aggregate numbers like the data you are seeking.
However, the California Court of Appeal has held that the CPRA does not require state agencies to create a new record, or alter the substantive content of a record, when a requester seeks records that do not exist.Sander v. Superior Court, 26 Cal. App. 5th 651 (Ct. App. 2018). If the county would have to create a fundamentally new record that presents its data in an aggregated format, then Sander indicates that it cannot be compelled to do so. As the Sander court indicated, the difference lies in asking a public agency to “segregate and extract” electronic data, and asking a public agency to manipulate or restructure the substantive content of a record.Id.at 669.
In sum, HIPAA is probably not as clear a barrier to disclosure as the county’s response indicates. If the data is not reasonably segregable or capable of extraction and compilation from an electronic source, however, then the county probably cannot be compelled to create a new record aggregating its data in order to respond to your request.
More information about the CPRA, including your options for enforcement, can be found at the First Amendment Coalition’s website here.
Bryan Cave Leighton Paisner LLP is general counsel for the First Amendment Coalition and responds to FAC hotline inquiries. In responding to these inquiries, we can give general information regarding open government and speech issues but cannot provide specific legal advice or representation. No attorney-client relationship has been formed by way of this response.
Asked & Answered posts should not be relied on as legal advice, and FAC makes no guarantees about their completeness or accuracy. All posts carry a date of publication that readers should take note of in assessing their usefulness, given that laws and interpretations of them may change over time. Posts predating Jan. 1, 2023, that discuss the California Public Records Act may contain statute numbers no longer in use. Please see this page for a table showing how the California Public Records Act has been renumbered.