Opinion
Opinion By: Jack Conway, Attorney General; Amye L. Bensenhaver, Assistant Attorney General
Open Records Decision
This matter having been presented to the Attorney General in an open records appeal, and the Attorney General being sufficiently advised, we find that the Cabinet for Health and Family Services violated the Open Records Act in denying David M. Chapman's June 14, 2010, request for "any and all records regarding Laszlo Hirsch." Mr. Chapman represents Valeria Hirsch in a wrongful death action against the owners and operator of the vehicle that struck and killed her husband, Laszlo, on April 25, 2008. It is the decision of this office that the legal analysis found at pages 3 through 7 of 08-ORD-166, a copy of which is attached hereto and incorporated by reference, is dispositive of the question on appeal. At page 6 of that open records decision, the Attorney General determined that "Kentucky's Open Records Law . . . is determinative of the issue of access under the 'required by law' exception to HIPAA's privacy rule . . . ." Under the Open Records Law, specifically KRS 61.878(1)(a), personal privacy interests end at death. Accordingly, there is no impediment to Mr. Chapman's receipt of the records relating to Laszlo Hirsch.
In a response to Mr. Chapman's appeal dated July 6, 2010, the Cabinet for Health and Family Services elaborated on the arguments supporting nondisclosure:
KRS 194A.060 requires an authorization signed by the Cabinet's patient or client or former patient or former client, or their parent or legal guardian, or as otherwise permitted by state or federal law. KRS 194A.060(1); KRS 61.878(1)(l). Likewise, only the person whose records are requested or someone legally entitled to act on their behalf, or who is otherwise entitled to the records under the statute, may authorize the release of records from Adult Protective Services. KRS 209.140 ; KRS 61.878(1)(l).
The Cabinet's regulation, 922 KAR 1:510, states that the Cabinet must comply with HIPAA regarding the release of records in the possession of the Division of Protection and Permanency. If Mr. Hirsch's surviving spouse were the administrator of his estate, she would be entitled to his records as his personal representative under HIPAA. 06-ORD-048. However, at this point, neither Valeria Hirsch nor David Chapman have even alleged, much less proven, that they meet the requirements of either KRS 194A.060 or KRS 209.140.
For these reasons, the Cabinet reaffirmed its denial of Mr. Chapman's request. We disagree with the Cabinet's analysis.
The Cabinet's argument is premised on 922 KAR 1:510, requiring compliance with HIPAA for the release of Protection and Permanency records. HIPAA, the Cabinet emphasizes, would permit Mrs. Hirsch to obtain the records only if she was the personal representative of her husband's estate. 1 The linchpin in the Cabinet's argument fails, however, because 08-ORD-166 establishes that the Open Records Law is determinative of the issue of access under the "required by law" exception to HIPAA's privacy rule. The applicable open records exception, KRS 61.878(1)(a), authorizes public agencies to withhold "[p]ublic records containing information of a personal nature where the public disclosure thereof would constitute a clearly unwarranted invasion of personal privacy. " With few exceptions, 2 the Attorney General has recognized that a person's privacy rights end at death. See, e.g., OAG 81-149; OAG 82-590; OAG 86-31; 99-ORD-11; 01-ORD-245. We reasoned:
Requested records cannot be withheld from public inspection on the grounds of personal privacy where those records pertain to persons who are deceased as their right of privacy terminated at the time of their death. A deceased person has no personal privacy rights and the personal privacy rights of living persons do not extend to matters concerning deceased relatives.
In 77 C.J.S. Right of Privacy § 1(c), it is stated in part that on the theory that the right of privacy is purely personal, it has been held or recognized that it may be enforced only by the person whose right has been infringed. Furthermore, the individual right of privacy which any person has during his life dies with the person and any right of privacy which survives is a right pertaining to the living only. In 62 Am.Jur.2d Privacy § 43 the following appears: "It has generally been held that the right of privacy is purely personal, and that the right of action for its violation does not survive, but dies with the person whose privacy has been invaded."
OAG 86-31, p. 3, 4.
Because Mr. Hirsch is deceased, he no longer has privacy rights. We believe the Open Records Act, which is determinative of the issue of access under the "required by law" exception to the HIPAA privacy rule, requires the Cabinet to disclose the requested records to Mr. Chapman because disclosure will not constitute a clearly unwarranted invasion of personal privacy. 3 The Cabinet's denial of Mr. Chapman's request constituted a violation of the Act.
Georgia's Supreme Court recently addressed a similar issue in a case involving a deceased patient's surviving spouse's attempt to access the patient's medical records for a wrongful death action against the operator of the nursing care facility in which the patient resided. In
Alvista Healthcare Center, Inc., et al. v. Miller, 286 Ga. 122, 686 S.E.2d 96 (2009), the Court rejected the argument that "a wrongful death complaint, together with any affidavit required by [state law] , cannot be filed unless and until an estate has been opened, there has been an appointment of an executor or administrator who is willing to cooperate with the potential wrongful death claimant, and the executor or administrator has made a request for the decedent's medical records soon enough to prevent the action from being barred by the statute of limitations." Miller at 125. The Court observed:
[N]othing in either [state law] or 45 C.F.R § 164.502(g)(4) requires the appointment of an executor or administrator and what may be an otherwise unnecessary administration of an estate. To the contrary, both the Georgia statute and the federal regulation provide for a request by a person who is neither an executor nor an administrator. If the very statute tailored to comply with 45 C.F.R. § 164.502(g)(4) could not be considered to provide anyone other than an executor or administrator with authority to act on behalf of the decedent or his estate for the purpose of obtaining medical records, then that portion of the federal regulation which specifies "other person[s]" having authority to act on behalf of the deceased individual or his estate would be meaningless with respect to this state.
Id. at 125, 126. While Georgia has not, to our knowledge, adopted the position found in 08-ORD-166, and the facts giving rise to the Miller case did not, to our knowledge, involve a public agency subject to the state's open records law, the opinion suggests a growing recognition that HIPAA should not impede a legitimate need for a decedent's medical records in furtherance of a wrongful death action or similar legal redress.
Having determined that the Cabinet for Health and Family Service's argument in support of nondisclosure of the records identified in Mr. Chapman's request directly conflicts with the position set forth in 08-ORD-166, a decision involving the Cabinet that was not appealed to circuit court, we find that the Cabinet improperly denied that request.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
David M. ChapmanGina OneyJon R. Klein
Footnotes
Footnotes
1 In his open records request and letter of appeal, Mr. Chapman explains why Mrs. Hirsch is not the administrator of her deceased husband's estate. Those reasons are irrelevant to our analysis.
2 See, e.g., 08-ORD-188 (affirming 911 dispatch center's denial of that portion of 911 call in which small child's injuries and medical condition were discussed); see also 08-ORD-225.
3 The Cabinet does not assert that the protections afforded by KRS 194A.060 or KRS 209.140, which are incorporated into the Open Records Act by KRS 61.878(1)(l), continue after the client or former patient's death.