Opinion
Opinion By: Jack Conway, Attorney General; Amye L. Bensenhaver, Assistant Attorney General
Open Records Decision
This matter having been presented to the Office of the Attorney General in an open records appeal, and the Attorney General being sufficiently advised, we find that the Medicaid Fraud and Abuse Control Unit of the Kentucky Attorney General's Office did not violate provisions of KRS 61.870 to 61.884 in the disposition of James Coy's undated request for "the record on [Mr. Coy's] son, Jason David Coy, that a Mr. Greg Motley started in June of 2010." Mr. Coy's request reached the Attorney General's Office on March 31, 2011, a timely written response was issued on April 4, 2011, notifying Mr. Coy of the reproduction and copying charges, and, upon receipt of this fee, copies of all nonexempt public records were mailed to Mr. Coy. 1 Along with the nonexempt records, the Attorney General provided written citation to statutory exceptions authorizing partial or full nondisclosure of some responsive records and a detailed explanation of how the exceptions applied to the records withheld.
On appeal, Mr. Coy expresses the belief that because "open records can't be withheld, " he is entitled to MFCU's records in full. In a comprehensive and well-reasoned response, MFCU refutes this claim, asserting, most persuasively, that it is the recipient of records, compiled by the Cabinet for Health and Family Services' Department of Community Based Services in an investigation conducted by the Department pursuant to KRS Chapter 209, under the terms of a federally mandated 2 Memorandum of Agreement between the Cabinet and MFCU. As a delegated representative of the Cabinet, MFCU is foreclosed by KRS 209.140, incorporated into the Open Records Act by KRS 61.878(1)(l), 3 from releasing those records in its file obtained from the Cabinet. Additionally, MFCU convincingly argues that other records in its file are statutorily exempt pursuant to KRS 205.175(2), also incorporated into the Open Records Act by KRS 61.878(1)(l). Finally, MFCU invokes 45 C.F.R. 164.512, the Health Insurance Portability and Accountability Act's Privacy Rule, as the basis for withholding protected health care information, and KRS 61.878(1)(a) as the basis for withholding identifying information relating to patients or residents other than Mr. Coy's son, who was the subject of the request, and individuals about whom complaints were made alleging criminal activity but who were not charged.
We adopt in full, and, in the interest of brevity, incorporate by reference, MFCU's arguments in support of invocation of KRS 209.140 and 205.175(2). MFCU clearly established that it is the Cabinet's delegated representative in "investigat [ing] and prosecut[ing] criminal cases of Medicaid fraud, and review[ing] and investigat [ing] complaints alleging abuse or neglect of patients in Medicaid-funded facilities," 4 and that its receipt of investigative records compiled by the Cabinet "in investigating criminal abuse or neglect cases" is restricted by KRS 209.140 and the Memorandum of Agreement executed thereunder. MFCU also established that, in the absence of proof to the contrary, Mr. Coy did not qualify under one of the exceptions to the confidentiality provision found at KRS 209.140. 5
Similarly, MFCU justified its reliance on KRS 205.175(2) by establishing that it is the legally authorized recipient of information and reports of the Cabinet, its agents, representatives, employees, boards or officials functioning under Chapter 205 of the Kentucky Revised Statutes, entitled Public Assistance and Medical Assistance. That chapter includes KRS 205.8451 through 205.8483, relating to the control of Medicaid fraud and abuse, and directs the Cabinet to share "information and reports with . . . the Office of the Attorney General, and any other agencies that are responsible for recipient or provider utilization review" under strict terms of confidentiality. Again, MFCU successfully established that Mr. Coy does not fall within one or more of the excepted categories codified at KRS 205.175(2)(a) through (e) to the confidentiality rule. As noted, we adopt in full, and incorporate by reference, its analysis in this regard.
We remind MFCU that in interpreting 45 C.F.R. 164 512, the HIPAA Privacy Rule, this office has determined that public agencies that are "covered entities" as defined in the Privacy Rule, "must disclose protected health information," within the meaning of the Privacy Rule, under the "required by law" exception to HIPAA to the extent that disclosure is required by the Kentucky Open Records Act. See 08-ORD-166; 08-ORD-188; 08-ORD-225; 10-ORD-161. Our analysis in these open records decisions was drawn from the position adopted by the Ohio Supreme Court in State ex rel. Cincinnati Enquirer v. Daniels, 108 Ohio St. 3d 518, 844 NE2d 1181 (Ohio 2006) and by the Texas Court of Appeals in Abbott v. Texas Department of Mental Health and Mental Retardation, 212 S.W.3d 648 (Tex. App. 2006), and is reflected in 08-ORD-166. A copy of that decision is attached hereto and the analysis incorporated by reference except to the extent that KRS 61.878(1)(a) 6 is the controlling law in resolving the issue of access to the Crisis Intervention Plan, containing medical information about individual residents or clients, under the "required by law" exception to the HIPAA Privacy Rule. Because the medical information qualifies for protection under KRS 61.878(1)(a), that open records exception authorized nondisclosure of the information, HIPAA's Privacy Rule notwithstanding. Accord, 06-ORD-209, citing 05-ORD-239 and 03-ORD-023. 7 We therefore affirm MFCU's redaction of medical information about individual clients or patients, not on the basis of the Privacy Rule, but on the basis of KRS 61.878(1)(a) as the "controlling law" under the "required by law" exception to the Privacy Rule.
The latter exception has been construed by this office to authorize nondisclosure of records, or parts of records, identifying "individuals who were complained on or investigated for potential criminal activity but were not charged" in decisions dating back to OAG 91-35. In OAG 91-35, the Attorney General concluded that investigative records of its Medicaid Fraud Division (now MFCU) were protected from public disclosure by KRS 61.878(1)(a) as long as the individuals investigated were not charged with a crime. Nevertheless, the Attorney General also recognized that, in so holding, we did not "state a per se rule that in every case where individuals have been investigated but not charged with a crime, that information is properly exempt from disclosure under . . . KRS 61.878(1)(a) . . .," and thereafter restricted our holding to "the facts presented." OAG 91-35, p. 6, 7. While we affirm MFCU's reliance on KRS 61.878(1)(a) in this case to support nondisclosure of individuals against whom complaints were leveled and/or who were investigated, but not charged, we urge MFCU to bear the latter observation in mind in interpreting and applying this unsettled area of law.
In sum, we find no error in the Medicaid Fraud and Abuse Control Unit's partial denial of Mr. Coy's request. Contrary to his belief, "while all government agency records are public records . . ., not all these records are required to be open to public access . . . some being exempt under KRS 61.878." KRS 61.8715; see also Beckham v. Board of Education and Jefferson County, 873 S.W.2d 575, 578 (Ky. 1994) (Kentucky Supreme Court declares that "From the exclusions [codified at KRS 61.878(1)(a) through (n)] we must conclude that with respect to certain records, the General Assembly has determined that the public's right to know is subservient to statutory rights of personal privacy and the need for governmental confidentiality. A cursory examination of KRS 61.878 reveals an extensive list of matters excluded from public access, and this also suggests an absence of legislative intent to create unrestricted access to records"). MFCU therefore properly relied on KRS 61.878(1)(a) and (l), the latter exception incorporating KRS 209.140 and 205.175(2), in partially denying Mr. Coy's request for "the record on [his] son, Jason David Coy, that a Mr. Greg Motley started in June of 2010."
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Distributed to:
James CoyTravis Mayo
Footnotes
Footnotes
1 Owing to the discrepancy in the number of pages for which Mr. Coy was originally charged and the number of pages ultimately released to him, his check was returned and alternate arrangements made for payment of copies and postage.
2 42 C.F.R. 1007.9(d).
3 KRS 61.878(1)(l)authorizes public agencies to withhold "[p]ublic records or information the disclosure of which is prohibited or restricted or otherwise made confidential by enactment of the General Assembly."
4 42 C.F.R. 1007.11(a)-(b); KRS 205.8469(1).
5 The Unit acknowledges that Mr. Coy is the father of Jason Coy, but was unable to confirm that he was Jason's legal guardian, or that he fell within one of the other excepted categories.
6 KRS 61.878(1)(a)authorizes nondisclosure of "[p]ublic records containing information of a personal nature where the public disclosure thereof would constitute a clearly unwarranted invasion of personal privacy. "
7 At page 2 of 06-ORD-209, the Attorney General recognized that:
Few records are accorded greater protection than patient medical records. Indeed, in a different factual context the Kentucky Supreme Court has determined that information elicited within the relationship of a health care provider and his or her patient is "both personal and private," that disclosure of records containing such information "would constitute a serious invasion of personal privacy, " and that with regard to such records "there is a . . . public interest in personal privacy [that is] strongly substantiated." Kentucky Board of Examiners of Psychologists v. Courier-Journal and Louisville Times, 826 S.W. 324, 328 (Ky. 1992).
Compare, 09-ORD-166.