Opinion
Opinion By: Gregory D. Stumbo, Attorney General; Michelle D. Harrison, Assistant Attorney General
Open Records Decision
At issue in this appeal is whether the Kentucky Transportation Cabinet violated the Kentucky Open Records Act in denying the request of Richard Clay for copies of records reflecting any action taken by the Medical Review Board during the meeting "at which it recommended that Catherine Browning be allowed to take the 'one (1) Final Road Test'" referenced in the Board's letter of October 7, 2002, absent her written consent, given that Ms. Browning is allegedly Mr. Clay's client. Because the requested records contain "personal information, " the Cabinet did not violate the Act in making disclosure contingent upon receipt of written authorization from Ms. Browning. To the contrary, the Cabinet merely complied with The Driver's Privacy Protection Act, 18 U.S.C. § 2721-25, incorporated into the Open Records Act by operation of KRS 61.878(1)(k), in requiring Mr. Clay to verify his status; any less would constitute a violation of 18 U.S.C. § 2721 (b)(13).
"On behalf of [his] client, Catherine Browning," Mr. Clay requested copies of the aforementioned records, "including any information that is inscribed on a tangible medium or which is stored in an electronic or other medium and is retrievable in perceivable form," on March 30, 2005. 1 By letter dated April 12, 2005, Dan G. Druen, Jr., Commissioner, Department of Administrative Services and Custodian of Records, denied Mr. Clay's request on behalf of the Cabinet. As observed by Mr. Druen:
Individual personal medical information is not subject to public disclosure pursuant to the Health Insurance Portability and Accountability Act of 1996 and KRS 61.878(1)(a)(k). Release of such information would constitute a clearly unwarranted invasion of Ms. Browning's personal privacy. Should you be able to provide this office with a notarized release form signed by Ms. Browning stating her consent to the Cabinet to release her medical records, any available information will be forwarded to you.
Arguing that Mr. Druen "evidently misunderstands" the nature of his request, Mr. Clay now appeals from the Cabinet's "untimely" denial of his request. In Mr. Clay's view, there is "no stretch of the imagination by which those records could be construed as 'personal medical information, ' whatever that term has to do anyway." (sic) If, in fact, "personal medical information" is contained in the records requested, Mr. Clay believes that requiring a "notarized release form" is "beyond anything required by HIPAA, 45 CFR 164.508." It is a "requirement made up by the custodian entitled to no deference." Based on the following, this office respectfully disagrees with Mr. Clay's assessment.
Upon receiving notification of Mr. Clay's appeal from this office, Todd Shipp, Assistant General Counsel, elaborated upon the Cabinet's position. By way of background, Mr. Shipp advises this office that Mr. Clay "has been Ms. Browning's attorney in a litigation matter involving this Cabinet for some time, which arose out of action taken by the [MRB] against Ms. Browning's driving privileges." 2 At this point, the Cabinet is unsure whether Mr. Clay represents Ms. Browning, and has therefore asked him to provide "a release form executed by her." Upon receipt of a release form, the Cabinet "will be more than happy to provide a copy of her entire MRB file" to Mr. Clay. 3 Due to the sensitive nature of the information contained in records responsive to Mr. Clay's request, including "personal data such as home address, social security number, birth date and most particularly medical information, " the Cabinet must deny Mr. Clay's request until such a release is received. As explained by Mr. Shipp:
The reasons are twofold. One, the unfettered release of this information would constitute an unwarranted invasion of personal privacy. KRS 61.878(1)(a). Two, the release of the documents within this file would violate two Federal protective laws that limit this Cabinet's authority to release this material. The Federal Driver's Privacy Protection Act specifically prohibits the release of the above-referenced personal information. The Act does except certain groups, provided the appropriate release forms are forwarded. Since the actions of the Medical Review Board and its documents derive from and result from her driver ['s] license, the protection applies to this case. The second federal law that prohibits disclosure is [HIPAA]. Section 1177 clearly penalizes any person who discloses individually identifiable health information to another. [] The Kentucky Open Records Act clearly recognizes the dilemma faced by state agencies when federal law is passed to limit disclosure of personal information by excepting from disclosure this type of data at KRS 61.878(1)(k).
Attached to the Cabinet's supplemental response are copies of OAG 92-10 and OAG 92-24, which Mr. Shipp cites in support of the proposition that "any benefit which would inure to the public by virtue of the release of medical records and information does not outweigh the privacy interest in those same records." 4 Both federal laws "carry personal and entity liability in the way of criminal and civil sanctions." Accordingly, the Cabinet maintains that its denial of Mr. Clay's request was "more than warranted."
To begin, the Transportation Cabinet's failure to respond in writing to Mr. Clay's request, within three business days of receipt, constitutes a violation of KRS 61.880(1). As a public agency, the Cabinet must comply with both the procedural and substantive provisions of the Open Records Act regardless of the requester's identity or his purpose in requesting access. KRS 61.880(1) contains the procedural guidelines to which a public agency must adhere in responding to requests submitted pursuant to the Open Records Act. In relevant part, KRS 61.880(1) provides:
Each public agency, upon any request for records made under KRS 61.870 to 61.884, shall determine within three (3) days, excepting Saturdays, Sundays, and legal holidays, after the receipt of any such request whether to comply with the request and shall notify in writing the person making the request, within the three (3) day period of its decision. An agency response denying, in whole or in part, inspection of any record shall include a statement of the specific exception authorizing the withholding of the record and a brief explanation of how the exception applies to the record withheld. The response shall be issued by the official custodian or under his authority, and it shall constitute final agency action.
In applying this provision, the Attorney General has consistently observed:
"The value of information is partly a function of time." Fiduccia v. U.S. Department of Justice, 185 F.3d 1035, 1041 (9th Cir. 1999). This is a fundamental premise of the Open Records Act, underscored by the three day agency response time codified at KRS 61.880(1). Contrary to [U of L's] apparent belief, the Act contemplates records production on the third business day after receipt of the request, and not simply notification that the agency will comply. In support, we note that KRS 61.872(5), the only provision in the Act that authorizes postponement of access to public records beyond three business days, expressly states:
(Emphasis added). Additionally, we note that in OAG 92-117 this office made abundantly clear that the Act "normally requires the agency to notify the requester and designate an inspection date not to exceed three days from agency receipt of the request." OAG 92-117, p. 3. Only if the parameters of a request are broad, and the records implicated contain a mixture of exempt and nonexempt information, and are difficult to locate and retrieve, will a determination of what is a "reasonable time for inspection turn on the particular facts presented. " OAG 92-117, p. 4. In all other instances, "timely access" to public records is defined as "any time less than three days from agency receipt of the request." OAG 82-300, p. 3; see also 93-ORD-134 and authorities cited therein. Pursuant to KRS 61.872(5), "any extension of the three day deadline for disclosure must be accompanied by a detailed explanation of the cause for the delay, and a written commitment to release the records on the earliest date certain." 01-ORD-38, p. 5.
01-ORD-140, pp. 3-4.
In general, a public agency cannot postpone or delay this statutory deadline. "The burden on the agency to respond within three working days is, not infrequently, an onerous one. Nevertheless, the only exceptions to this general rule are found at KRS 61.872(4) and (5)." 02-ORD-165, p. 3. Unless the person to whom the request is directed does not have custody or control of the records, or the records are in active use, in storage, or are not available, the agency is required to notify the requester of its decision within three working days, and to afford the requester timely access to the requested records. Id., citing 93-ORD-134. If, on the other hand, any of those conditions exist, the agency must "immediately so notify" the requester, and designate a place, time, and date for inspection "not to exceed" three days from receipt of the request, "unless a detailed explanation of the cause is given for further delay and the place, time and earliest date on which the public record will be available for inspection. " KRS 61.872(5) (Emphasis added); 02-ORD-165. In other words, KRS 61.872(5) dictates that "any extension of the three day deadline for disclosure must be accompanied by a detailed explanation of the cause for delay, and a written commitment to release the records on the earliest date certain. 01-ORD-38, p. 5 (Emphasis added).
Here, Mr. Druen responded to Mr. Clay's request dated March 30, 2005, on behalf of the Cabinet in a letter dated April 12, 2005. Noticeably absent from both the Cabinet's initial and supplemental responses are any explanation for the delay, let alone a detailed explanation. Although the Cabinet otherwise complies with KRS 61.880(1) by citing the specific exception that applies and explaining how the exception applies to the record(s) withheld, this belated response does not cure the initial omission. 5 As consistently recognized by this office, the procedural requirements of the Open Records Act are "not mere formalities but are an essential part of the prompt and orderly processing of an open records request." 93-ORD-125, p. 5; 04-ORD-080; 02-ORD-187. To avoid future violations, the Cabinet should adhere to these guidelines in responding to requests submitted pursuant to the Open Records Act.
Turning to the substantive issue presented, a review of the Driver's Privacy Protection Act validates the Cabinet's position as to the accessibility of the requested records absent the written consent of Ms. Browning, with one exception. Among those records which are excluded from application of the Open Records Act are: "All public records or information the disclosure of which is prohibited by federal law or regulation." KRS 61.878(1)(k). Resolution of the instant appeal turns on the language of 18 U.S.C. § 2721, et seq., entitled Prohibition on release and use of certain personal information from State motor vehicle records, commonly known as the Driver's Privacy Protection Act, which is incorporated into the Open Records Act by operation of KRS 61.878(1)(k). More specifically, the express language of 18 U.S.C. § 2721(b)(13) dictates the outcome on the facts presented.
Our review begins with the definition of "personal information. " In relevant part, 18 U.S.C. § 2721 provides:
(a) In general. --A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity;
"Personal information" is defined as information "that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations and driver's status." 18 U.S.C. § 2725(3). "Highly restricted personal information" means "an individual's photograph or image, social security number, medical or disability information." 18 U.S.C. § 2725(4). 6 Fourteen categories of "Permissible uses" for personal information are codified at Subsection (b). State departments of motor vehicles, and officers, employees, or contractors thereof must disclose personal information to entities, both governmental and private, "in connection with matters of motor vehicle or driver safety and theft, motor vehicle emissions . . .," and may disclose the same information for the uses enumerated in the statute. See 01-ORD-25; 98-ORD-1. As indicated, subsection (b)(13) is implicated here. By virtue of this provision, personal information may be disclosed: "For use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains." (Emphasis added). Because the record is devoid of any written consent from Ms. Browning, the Cabinet is not permitted to provide Mr. Clay with access to the records requested assuming the records contain "personal information. " In fact, the Cabinet is subject to civil penalties of up to $ 5,000.00 per day for each day of noncompliance. 01-ORD-25; 98-ORD-1.
Unable to conclusively resolve the issue of whether the requested records contain protected "personal information" based upon the limited evidence of record, the Attorney General requested that the Cabinet provide copies of those records to this office for in camera review pursuant to KRS 61.880(2)(c) and 40 KAR 1:030, Section 3. 7 Although this office is not at liberty to discuss the nature of those records in detail, the records can generally be described as a letter and a memorandum directed to Ms. Browning by Lisa Bowling, Coordinator, MRB Division of Driver Licensing, on October 7, 2002, advising her as to the recommendation of the MRB, both of which appear to be in Mr. Clay's possession. Also included among the responsive records is a medical form consisting of four sections which contains not only name, address, social security number, and other identifying information, but also Ms. Browning's medical history, all of which is properly characterized as "personal information, " and some of which constitutes "highly personal information" in our view. Accordingly, the Cabinet properly denied Mr. Clay's request as to those records pursuant to the DPPA.
Still at issue is a form dated November 7, 2002, containing a review of Ms. Browning's performance during a driving test. Unless the Cabinet establishes how the information contained in this form qualifies as personal information in the relevant sense, the Cabinet must honor Mr. Clay's request as to this responsive record by providing him with a copy upon receipt of payment. More specifically, the Cabinet must clarify in writing why the information is not more accurately described as information relating to "driver's status," which is not protected, as opposed to medical/health information to which the DPPA clearly applies. 8 With this exception, the denial by the Cabinet is affirmed.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882 . Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Footnotes
Footnotes
1 Although Mr. Clay also requested copies of records "reflecting the schedule of all meetings of the Medical Review Board for 2002 and 2003," the Cabinet honored this portion of his request as evidenced by the record. Accordingly, any issues relative to those records are now moot, and Mr. Clay's appeal focuses exclusively on the Cabinet's conditional decision as to the records reflecting any action taken relative to Ms. Browning.
2 See Browning v. Transportation Cabinet, 2005 WL 195087 (Ky. App. 2005).
3 KRS 186.44 (1) provides:
The Transportation Cabinet shall promulgate administrative regulations to establish a medical review board. The purpose of the medical review board shall be to receive cases relating to the ability of an applicant or holder of a motor vehicle operator's license to drive due to physical or mental disability which may affect or limit a person's ability to safely operate a motor vehicle.
4 See 05-ORD-030 and 02-ORD-55, copies of which are attached hereto and incorporated by reference, for the analysis employed by this office in determining whether an agency has properly invoked KRS 61.878(1)(a). Given our resolution of the issue relative to the Driver's Privacy Protection Act, further elaboration regarding the applicability of KRS 61.878(1)(a) is unnecessary here.
5 A response issued pursuant to 40 KAR 1:030 Section 2 should be viewed as an opportunity to supplement rather than supplant its denial. "The Open Records Act presumes that the agency's KRS 61.880(1) response is complete in and of itself." 02-ORD-118, p. 3. Accordingly, this office considers supplemental responses that correct misstatements appearing in, or misunderstandings resulting from, the complainant's letter of appeal, or, which offer additional support for the agency's original denial. Id.
6 "Express consent" is defined as "consent in writing, including consent conveyed electronically that bears an electronic signature as defined in section 106(5) of Public Law 106-229."
7 In relevant part,KRS 61.880(2)(c) provides:
The burden of proof in sustaining the action shall rest with the agency, and the Attorney General may request additional documentation from the agency for substantiation. The Attorney General may also request a copy of the records involved but they shall not be disclosed.
Likewise, 40 KAR 1:030, Section 3 provides:
Additional Documentation. KRS 61.846(2) and KRS 61.880(2) authorize the Attorney General to request additional information from the agency against which a complaint is made. If documents thus obtained are copies of documents claim by the agency to be exempt from the Open Records Law, the Attorney General shall not disclose them and shall destroy the copies at the time the decision is rendered.
8 In light of this determination, analysis of the remaining arguments advanced by the Cabinet is unnecessary.