Opinion
Opinion By: Gregory D. Stumbo, Attorney General; James M. Ringo, Assistant Attorney General
Open Records Decision
The question presented is whether the Cabinet for Health and Family Services (Cabinet) violated the Kentucky Open Records Act in denying the request submitted by attorney Darrell Hall to the Cabinet's Office of Inspector General, Special Investigation Division for a copy of records pertaining to Hazel Quillen. For the reasons that follow, we conclude that because Mr. Hall did not provide proper consent or court order for release of the requested investigative records, the Cabinet properly relied upon KRS 61.878(1)(l), incorporating KRS 194A.060 into the Open Records Act, in denying access to the requested records. 1
By letter dated August 1, 2007, Mr. Hall submitted a request for investigative records pertaining to Hazel Quillen:
? I hereby request a copy of all information pertaining to the above referenced matter, including all emails, inter-office memorandums, and any and all correspondence between your Whitesburg Office and the Frankfort Office of the Cabinet for Health and Family Services concerning the above matter.
In a letter dated August 7, 2007, Anne E. Burnham, Assistant Counsel, responded to Mr. Hall's request, advising:
This is in response to the above-referenced Open Records Request pertaining to the records of an investigation relating to Hazel Quillen that you forwarded to the Office of Inspector General's Special Investigations Division. Dated August 1, 2007 and received in that office on August 6, 2007. This request is virtually the same as a request you sent to the Cabinet's Office of Inspector General, Division of Fraud, Waste, and Abuse/Identification and Prevention dated April 20, 2007. Following receipt of the April 20, 2007 request, I sent you a letter dated April 24, 2007 denying that request. For the same reasons outlined in that letter, your request for these records is again denied for the following specific reasons.
There were no authorizations or court orders accompanying your request. Therefore, your request is denied in its entirety. Any individuals who would be directly or indirectly identified in records responsive to your request have a right to privacy under Kentucky law with regard to any records in the possession of the Cabinet for Health and Family Services. In accordance with KRS 61.878(1)(a), KRS 194A.060, and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and regulations promulgated thereunder at 45 C.F.R. Parts 160 and 164, the Cabinet is required by law to ensure such information is not released without proper authorization or court order. You did not submit any type of court order or authorization for release of personal health information with your request for records. The requested records contain financial and/or medical information of a personal nature regarding a client of the Cabinet. Release of these records absent a legally effective authorization or court order would constitute an unreasonable invasion of personal privacy. KRS 61.878(1)(a). Likewise the requested records are made confidential by state and federal law and are exempt from disclosure on that ground. KRS 194A.060, 42 C.F.R. 431.306; 45 C.F.R. 164.502(a); KRS 61.878(1)(k) and (l).
Shortly thereafter, Mr. Hall initiated the instant appeal. In his letter of appeal, he advised that he represented Hazel Quillen who is currently in a nursing home and further advised "Ms. Quillen's Medicaid benefits were terminated because she has excess resources, which is simply not true. I requested a hearing which is presently set for August 29, 2007. . . . The hearing officer had authorized me to review the file prior to the hearing but the Cabinet for Health and Family Services (Cabinet) refuses to allow me to review the file."
After receipt of notification of the appeal, Ms. Burnham provided this office with a response to the issues raised in the appeal. In her response, she reiterated that, based on the authorities cited in her original responses, the Cabinet was required by law to ensure that the records requested by Mr. Hall were not released without proper authorization or court order and that release of financial and/or medical information of personal information of a client of the Cabinet absent a legally effective authorization or court order would constitute an unreasonable invasion of personal privacy.
Addressing Mr. Hall's assertion that he represented Ms. Quillen in an ongoing administrative hearing, Ms. Burnham advised:
While this may be the case, Mr. Hall failed to attach the Hearing Officer's "Notice of Administrative Hearing" with his requests. The undersigned had no knowledge that any sort of appeal or administrative action was pending prior to receipt of said Notice with Mr. Hall's August 16, 2007 letter of appeal.
Furthermore, upon information and belief, it is the understanding of the undersigned that the usual custom and practice is for the appellant to review the "case file" at the local office, which in this case is located in Whitesburg, Mr. Hall's principal place of business. If Mr. Hall believes that the Cabinet is not cooperating with the Hearing Officer's "Notice, " he should address such matter with the Hearing Officer assigned to the administrative action. In addition, the "Notice" provided by Mr. Hall does not constitute a court order for the Cabinet to produce the records sought in accordance with HIPAA. 2 To begin with, the Notice is not signed by the Hearing Officer, rather the hearing Officer's name has [been] typed onto the form by an unknown individual arguably the Hearing Officer knowing that it has been sent. Secondly, the Notice appears to be a form document utilized in such matters to provide the parties notice as to when and how the hearing will proceed. Therefore, the undersigned continues to submit that Mr. Hall has failed to provide the requisite documentation which would thereby allow the Cabinet to release the requested records.
In 05-ORD-054, this office held that KRS Chapter 194A governs the records generated by the Cabinet's Office of Inspector General and that KRS 194A.060 makes confidential all records and reports that directly or indirectly identifies a client or patient of the Cabinet, absent consent of the identified person. In that decision, the Attorney General stated:
Pursuant to KRS 194A.060 , incorporated into the Open Records Act by operation of KRS 61.878(1)(l):
In addition, Subsection (2) expressly provides: "In all instances, the individual's right to privacy is to be respected." When viewed in conjunction as mandated by HIPAA, 45 CFR § 164.512 and KRS 194A.060 remove any doubt as to the confidentiality of the requested OIG records. In other words, HIPAA mandates compliance with state law, which, in turn, precludes access without consent.
05-ORD-054, pages 17-18. Because the requested records identify the patient, the Cabinet is permitted to disclose the information only upon receipt of either an authorization or consent from the patient or court order. Since Mr. Hall failed to provide the Cabinet with proper authorization for release of the requested Office of Inspector General documents, the agency properly denied his request under authority of KRS 194A.060, incorporated into the Open Records Act by KRS 61.878(1)(l).
At the time of his requests, Mr. Hall did not advise the Cabinet that an administrative hearing concerning his client was pending nor did he attach the Hearing Officer's "Notice of Administrative Hearing, " which he attached with his letter of appeal. In her response provided to this office, Ms. Burnham advised that the "Notice" provided by Mr. Hall did not constitute a court order for the Cabinet to produce the records sought in accordance with HIPAA, as it was not signed by the Hearing Officer and appeared to be a form document utilized in such administrative hearings to provide the parties notice and guidance as to when and how the hearing would proceed. Based on the limited information Mr. Hall furnished to the Cabinet with his requests and the deficiencies in the Notice which he furnished to this office on appeal, we find that the Cabinet acted in a manner consistent with state and federal law in requiring that his client execute proper release or consent forms prior to disclosure of the otherwise exempt records Mr. Hall requests.
A party aggrieved by this decision may appeal it by initiating an action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Footnotes
Footnotes
1 The Cabinet also relied on KRS 61.878(1)(a), and the Health Insurance Portability and Accountability Act and the regulations promulgated thereunder. In view of our determination that KRS 194A.060 prohibits disclosure of the disputed records, we do not address these additional arguments supporting nondisclosure.
2 See 45 C.F.R. Part 164.512(e)(1)(i), which states that "a covered entity may disclose protected health information in the course of any judicial or administrative proceeding in response to an order of a court or an administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order."