Opinion
Opinion By: Jack Conway, Attorney General; Amye L. Bensenhaver, Assistant Attorney General
Open Records Decision
The question presented in this appeal is whether the Graves County Jail violated the Open Records Act in denying Norman T. Mason and Ralph Priddy's October 2009 requests for incident report(s) relating to Mr. Mason generated on October 15 and October 16, 2009. We find that the Jail violated the Act in asserting that "[a]ny incidents pertaining to anything medical fall under the HIPAA laws," and that because the requests were not notarized, they were denied.
In their requests, Mr. Mason and Mr. Priddy requested incident report(s) relating to "an incident that occur[red] on 10-15/16-09 where Mr. Mason fell[] out of bed, in the shower, and ask[ed] to see the doctor or nurse." Although Mr. Mason referenced medical records in a written release of information to Mr. Priddy submitted with the first request, neither of the requests he and Mr. Priddy submitted identified medical records in the records description. Instead, they limited their requests to the incident report(s) prepared after Mr. Mason fell out of his bed and in the shower on October 15 and 16, 2009.
501 KAR 3:020 Section 5(3) requires the creation, within 48 hours, of a final written report "of all extraordinary or unusual occurrences" that occur in a jail. The term "extraordinary or unusual circumstances" is said to include "serious injury whether accidental or self-inflicted." 501 KAR 3:020 Section 5(3)(c) (enclosed). It is this regulation which is cited as authority for the creation and retention of incident reports. See, e.g., Lexington/Fayette Urban County Government Detention Records Retention Schedule Series L5729, Incident Report. Although it is unclear what precipitated Mr. Mason's falls, it is apparent that he sustained sufficiently serious injuries that he requested medical care.
Nevertheless, it is not the medical records, if any, generated by the medical providers that Mr. Mason and Mr. Priddy requested, but the legally required incident reports of the extraordinary or unusual occurrences which may or may not describe injuries he sustained. Assuming, for the sake of argument, that the Graves County Jail is a health care provider in this context, 1 and therefore a covered entity within the meaning of 45 C.F.R. § 160.103 of the HIPAA Privacy Rule, and that the reports contain "protected health information" within the meaning of 42 U.S.C. § 1320d(6) and 45 C.F.R. § 160.103, this office has joined a growing number of jurisdictions recognizing that public agencies that are "covered entities" must disclose "protected health information" under the "required by law" exception to the HIPAA Privacy Rule to the extent disclosure is required by the Kentucky Open Records Act. See 08-ORD-166 and 09-ORD-167. Accordingly, Mr. Mason is entitled to a copy of the report(s) as the person whose injuries, if any, are described. Neither KRS 61.878(1)(a), nor the other exception to the Open Records Act, operates as an impediment to Mr. Mason's access.
Because the Graves County Jail elected to forego the opportunity to supplement its denial upon receipt of this office's notification of Mr. Mason and Mr. Priddy's appeal, we find that the Jail improperly withheld the report(s) from Mr. Mason and Mr. Priddy. The Jail advances no other arguments in support of nondisclosure, and its HIPAA argument is unpersuasive.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Rev. Ralph Priddy, PresidentNorman MasonRandy Haley, JailerJohn R. Cunningham
Footnotes
Footnotes
1 See 04-ORD-143 (determining that Covington Police Department is not a "covered entity" for purposes of HIPAA notwithstanding the incidental delivery of emergency aid by a police officer).