Opinion
Opinion By: Jack Conway, Attorney General; Amye L. Bensenhaver, Assistant Attorney General
Open Records Decision
The question presented in this appeal is whether the Cabinet for Health and Family Services, Department for Medicaid Services, violated the Open Records Act in partially denying Janet Craig's request for copies of records identified in her October 24, 2013, letter of appeal as:
1. all documents from which the Kentucky Medicaid Managed Care Expansion FY 2009-2010 Fee-for-Service Data spreadsheet was created and all documents or communications relating to the creation of the spreadsheet;
2. the FY 2009-FY 2010 Kentucky Medicaid fee-for-service claims data file dated 8/29/12, previously provided to Kentucky Spirit, supplemented with additional data fields (the "Fee For Service Claims Data");
3. the eligibility file of Kentucky Medicaid enrollees in FY 2009-FY 2010, including specifically identified details, or if such eligibility file does not exist, documents sufficient to provide the specific details requested for each Medicaid enrollee in FY 2009-FY 2010 (the "Eligibility Claims Data");
4. all documents relating to the creation of the Managed Care Expansion Data Book; and
5. all documents relating to the creation of a December 21, 2012, letter to the Department from Pricewaterhouse Coopers.
Although we question the adequacy of the Department's initial response to Ms. Craig's request, we affirm its ultimate disposition of that request based on KRS 61.878(1)(a), (i), and (j).
In her September 20, 2013, request, filed on behalf of her client Kentucky Spirit, 1 Ms. Craig acknowledged receipt of the fee-for-service data spreadsheet itself but demanded disclosure of supporting documentation. She also acknowledged receipt of the FY 2009-FY 2010 Kentucky Medicaid fee-for-service detailed claims data file 2 but requested access to "the original" claims file supplemented with "additional fields for each claim record" to include, inter alia , contract ID, member ID, DOB, and gender. She expressed her client's belief in the existence of "an eligibility file of Kentucky Medicaid enrollees in FY 2009-FY 2010" containing such details as member ID, contract ID, DOB, and gender, requesting a copy of that file "or documents sufficient to provide this detail for all Medicaid enrollees in FY 2009-FY 2010." Ms. Craig emphasized her client's interest in obtaining all underlying documentation "relating in any way to the requests" in the Department or Cabinet's custody, including any representative, employee, or contractor.
On September 26, 2013, the Department responded to Ms. Craig through its Division of Fiscal Management's Acting Assistant Director Steve Bechtel. Mr. Bechtel advised Ms. Craig that the requested records "are in storage and are unavailable at this time," noting that "responsive records that are not otherwise exempt from disclosure [would be available] on or before November 20, 2013." Nearly one month later Ms. Craig initiated this appeal, questioning the adequacy of the Department's "canned response" and asserting that "database records, by nature, cannot be unavailable because they are in storage [and, even if in storage, ] there is no explanation as to why it would take two months to get them."
In supplemental correspondence directed to this office after Ms. Craig initiated her appeal, Assistant Counsel Catherine York disputed Ms. Craig's arguments. Noting, generally, that many of the records "are in storage [,]...are in the possession of another...at a remote location[,]...or require a filter to be created and applied," she asserted:
Requests # 1, # 4, & # 5 are specific in their request for documents used by PricewaterhouseCoopers (PwC), an outside contractor to create other documents, and not just the documents provided to PwC by the Cabinet. The specific documents used by PwC are in their possession and were stored by them. Those documents have been requested from PwC. Certain other documents, including related communications and documents sent to PwC by the Cabinet are in storage. All documents related to this request are, therefore, in storage or in the possession of a contractor.
Request # 2 is for a data file previously provided to Kentucky Spirit with additional fields added. Many of those additional fields are exempt from disclosure under the Open Records Act. In particular, the subscriber identifier, member identifier, and member date of birth are all exempt pursuant to KRS 61.878(1)(k), "All public records or information the disclosure of which is prohibited by federal law or regulation" and (l) "Public records or information the disclosure of which is prohibited or restricted or otherwise made confidential by enactment of the General Assembly." The information requested includes protected health information, the release of which is prohibited under HIPAA. The information requested also includes documents that could identify recipients of public assistance. The release of this information is prohibited by KRS 205.175.
Request # 3 is for the eligibility files of all Medicaid enrollees for FY 2009-2010. Again, these files are exempt from disclosure pursuant to KRS 61.878(1)(k) & (l). As with request # 2, the information contained in those files is protected and confidential pursuant to HIPAA and KRS 205.175. Any paper files are stored in local offices. Despite this, the Cabinet is making a good faith attempt to extract those fields that are not confidential from our member database.
On November 20, Ms. York notified Ms. Craig that responsive emails relating to request 4 had been located and would be disclosed, but that some emails, and attachments, were exempt per KRS 66.878(1)(i) and (j), as preliminary records that were not adopted as part of final agency action. Additionally, Ms. York advised that all remaining nonexempt records would not be disclosed until December 10, 2013, because the Department was "unable to apply the filters as requested" and must obtain the records from its contractor. Ms. York continued to assert protection for subscriber identifier, member identifier, and member date of birth as protected health information under authority of KRS 61.878(1)(k) and (l) and corresponding federal (HIPAA) and state (KRS 205.175 ) law. The Department issued its final response to Ms. Craig on December 10, disclosing additional records but continuing to assert the referenced exceptions.
Ms. Craig countered that under the "required by law" exception to HIPAA, as construed by the Attorney General, the Department could not deny her request for Fee-For-Services Claims Data and Eligibility Claims Data. If applicable, she argued, HIPAA permits sharing of PHI for such purposes as health care operations and business management. Ms. Craig noted that, as a managed care contractor, Kentucky Spirit routinely accessed and shared PHI with the state and that, under the terms of a written agreement, Kentucky Spirit agreed to maintain the confidentiality of all data collected. She challenged the Department's reliance on KRS 205.175, asserting that that confidentiality provision does not apply to Medicaid recipients, but is instead confined to recipients of "public assistance" as defined in the statute. Even if applicable, she maintained, Kentucky Spirit is entitled to information about Medicaid recipients under the statutory exception for a "private or quasi-private" agency when such agency has an agreement with the state that requires confidentiality. Ms. Craig concluded that Kentucky's courts recently required the Cabinet to disclose records relating to child fatalities and near fatalities that elicit far greater privacy concerns than Medicaid subscriber identifiers, member identifiers, and member dates of birth.
By letter dated November 26, 2013, this office requested additional information from the Department, pursuant to KRS 61.880)2)(c), to facilitate our review of the questions on appeal. The Department's responses, where instructive, are incorporated into our analysis. We focus on three questions:
1. Whether the technological and logistical challenges the Department encountered in producing the requested records justified an eighty-one day delay in production, and whether the Department provided the requisite "detailed explanation" for that delay.
2. Whether the emails, and attachments, withheld by the Department under KRS 61.878(1)(i) and (j) qualify for protection under those exceptions; and
3. Whether the public may access subscriber identifiers, member identifiers, and member dates of birth contained in Medicaid fee-for-service claims and eligibility files, and whether Kentucky Spirit enjoys an enhanced right of access to those records as a former managed care provider that is contractually bound to maintain the confidentiality of protected health information.
The answers to questions one and two are "yes." The answer to question three is "no." 3
1. KRS 61.872(5) and the timely production of responsive records
The Department acknowledges that its September 26, 2013, response did not satisfy the requirements of KRS 61.872(5). In the event an agency cannot produce responsive records within three business days, KRS 61.872(5) requires the agency to so notify the records applicant, in writing, on or before the third day, and to provide "a detailed explanation of the cause" for delay. In its original response, the Department indicated that the requested records were "in storage and unavailable" but offered no further explanation. Although the response suggested that responsive records "not otherwise exempt" would be disclosed on November 20, the Department failed to identify any exception authorizing nondisclosure of the requested records in whole or in part. 4
The Department corrected these omissions in correspondence submitted to this office after Ms. Craig filed her appeal, in subsequent correspondence directed to Ms. Craig, and in responding to this office's KRS 61.880(2)(c) request for additional information. While this office looked with disfavor on "canned responses" in 09-ORD-007, upon which Ms. Craig relies, that appeal involved a request submitted by a Cabinet employee for records relating to her, a contested claim that the Cabinet issued no response, and a supplemental response that "was only minimally detailed." 09-ORD-007, p. 4. In the appeal before us, the Department did more than "parrot...the language of the statute upon which it relied in extending the deadline." It did not, in our view "[fall] far short of the procedural mark" in explaining the circumstances justifying the extension.
Responding to our questions concerning the duration of the delay and the circumstances that necessitated it, Ms. York explained:
The Cabinet has stated that the documents responsive to Ms. Craig's request were in the possession of PricewaterHouse Coopers and that it was our understanding that these databases were not in active use by them but in storage. Ms. Craig's request was not for databases currently held by Medicaid, but for documents USED by PwC. In order to be 100% accurate in its response, the Cabinet was required to ask PwC to provide the documents it used. The documents are by their very nature in the possession of PwC. For that reason, the Cabinet requested PwC to provide documents responsive to ALL of Ms. Craig's requests. The Cabinet was informed by PwC that it would take some time to produce the documents and November 20, 2013, was given as the earliest date. On November 19, 2013, the undersigned was informed that PwC would be unable to produce the requested data until December 10, 2013.
In order to expedite production of some of the data, the Department attempted to extract the fields requested in # 3 of the request. The Department initially believed that it would be able to extract the specific fields requested by Ms. Craig in her request number # 3 by applying a filter. In this case, there was an attempt made to retrieve only the records that would have been provided to PwC at a specific point in time; however, the Department realized that it could not create the database to look precisely the same as that sent TO PwC.
It should be noted that Ms. Craig asked for fields contained in eligibility files for 2009-2010. The Medicaid database is in constant use and may experience changes and updates. When Department staff attempted to apply the filter, it realized that it might not be able to extract the data requested for the specific dates. The database had been previously transmitted to PwC and was, therefore, a snapshot in time. Again, in order to be 100% precise, the documents had to come from PwC. The Department was informed by PwC that this was a time-consuming process and relayed that information. PwC had to retrieve the database, create a program to extract the data, and then perform the extraction. 5
The Department could not have envisioned these logistical and technological challenges when Ms. Craig's request first arrived. As time passed, the Department encountered the challenges and communicated them to Ms. Craig and this office. We know of nothing more the Department could have done, given Ms. York's assertion that both she and Neville Wise 6 "made multiple requests, primarily telephonic, to PwC to expedite the production of the requested data." While the eighty one day delay in production of the records Ms. Craig requested "represents the outer most limit of acceptable delay," the record on appeal reflects focused and meaningful efforts to produce those records culminating in the Department's fulfillment of its commitment to produce all nonexempt records on December 10, 2013. 12-ORD-097, p. 5 (six month delay in retrieving, reviewing, redacting, reproducing, and releasing 22,000 emails "represents the outermost acceptable limit for production of public records" ).
2. KRS 61.878(1)(i) and (j) and responsive emails
As noted, Ms. Craig acknowledged receipt of the final version of the Kentucky Medicaid Managed Care Expansion FY 2009-2010 Fee-for-Service Data Spreadsheet in her original request and Ms. York indicated that Ms. Craig was furnished with a copy of the final version of the Managed Care Expansion Data Book in Ms. York's December 10 response to Ms. Craig's request, but in two of five subparts of that request, she demanded copies of records relating to the creation of these records. The Department produced "multiple emails responsive to" these demands, but elected to withhold eighteen emails and attachments relating to the Data Book based on the exceptions for preliminary records found at KRS 61.878(1)(i) and (j). 7 Ms. York described each of these emails and attachments, in general terms, at Attachment A of her December 20, 2013, response to our request for additional information. We incorporate Attachment A as part of our analysis.
In a recent decision, this office recognized that KRS 61.878(1)(i) and (j) "have been repeatedly analyzed over time," but that "little has changed in the mode of analysis since the courts first undertook to do so." 14-ORD-014, p. 7. Continuing, we observed:
Preliminary drafts, notes, correspondence, recommendations, and memoranda in which opinions are expressed or policies formulated retain their preliminary characterization, even after final agency action is taken, unless they are adopted as part of that final action. 8 Accord, Kentucky State Board of Medical Licensure v. Courier-Journal and Louisville Times Co., 663 S.W.2d 953, 956-957 (Ky. App. 1983) (recognizing that "documents defined in subsections [(i)] and [(j)] which become a part of the records adopted by the [agency] as the basis of its final action become releasable as public records . . .[, but u]nless so adopted and made a part of the [agency's] final action, such documents shall remain excluded under subsection [(i)] and [(j)] of the Act"); see also University of Kentucky v. Courier-Journal and Louisville Times Co., 830 S.W.2d 373, 378 (Ky. 1992) (holding that "materials that were once preliminary in nature lose their exempt status once they are adopted by the agency as part of its action"). The Court of Appeals reaffirmed this position in November 2013, reversing a circuit court opinion that email exchanged by public employees in anticipation of a scheduled meeting to discuss a matter still in negotiation qualified for protection under KRS 61.878(1)(i) and (j) "and that piecemeal disclosure along the path of the decision making process is not mandatory." University of Louisville v. Sharp , No. 2012-CA-000838-MR, p. 2 (November 22, 2013). To preserve the integrity of a public agency's internal decision making process by promoting full and frank discussion between and among public employees and officials, and by equipping them with the tools needed in hammering out official action, "the General Assembly has determined that the public's right to know is subservient to . . . the need for governmental confidentiality" 9 in pre-decisional records not adopted in that official action.
This analysis applies with equal force to the appeal before us. Our inspection of the records withheld, under authority of KRS 61.880(2)(c), confirms the Department's position that the emails and attachments fall squarely within the parameters of KRS 61.878(1)(i) and (j). To its credit, the Department released a number of pre-decisional records to Ms. Craig that were responsive to her request for supporting documentation. 10 Its decision to withhold the eighteen emails identified in Attachment A did not constitute a violation of the Open Records Act.
3. KRS 61.878(1)(a) and the right of access to subscriber identifiers, member identifiers, and dates of birth
On December 10, 2013, the Department released an encrypted flash drive containing records responsive to the "remainder of [Ms. Craig's] requests" and consisting of "a total of 10 files: a data dictionary, eligibility summary, and 8 quarterly files that represent the FY 09-10 FFS data for the MC expansion" as well as "the portion of the SAS Code used to create the CT_CLM field and CT_CLM_NEW field." 11 Additionally, the Department provided "specifications related to the extracts and data dictionary." The Department continued, however, to assert that subscriber identifiers, member identifiers, and member dates of birth were excluded from inspection by KRS 61.878(1)(k) 12 and (l), 13 incorporating HIPAA and KRS 205.175 respectively. As noted, Ms. Craig challenged the Department's position. She argued that HIPAA is inapplicable under its "required by law" exception, as interpreted by this office and by other jurisdictions, and that even if applicable her client is entitled to these records as a former managed care contractor that routinely accessed and shared protected health information under the exception for health care operations and business management purposes. 45 CFR § 164.502(a)(1)(ii). Moreover, she observed, her client's written agreement with the Department included a confidentiality clause extending protection to the data collected beyond the agreement's term. Ms. Craig rejected the Department's invocation of KRS 205.175, deriding the attempt "to shoehorn Medicaid recipients into the class of persons protected by" that statute, noting that the statute deals with recipients of public assistance and enumerates the programs to which it applies not including the Medicaid program. Because the Department belatedly, and in our view properly, invoked KRS 61.878(1)(a) as the basis for withholding the referenced fee-for-service and eligibility claims data, we are spared debate on the application of HIPAA and KRS 205.175 to the records withheld.
At note 2 of her December 20, 2013, response to the Attorney General's KRS 61.880(2)(c) request for additional information, Ms. York cited KRS 61.878(1)(a), explaining that the "withheld fields . . . could be used to identify the members and would be an unwarranted invasion of the privacy of private individuals." We agree. In a recent opinion, Kentucky's highest court commented on the competing interests implicated by disclosure of personal information about private individuals in response to an open records request, recognizing that the "individual's interest becomes stronger with regard to personal information the dissemination of which could subject him or her to adverse repercussions . . [such as] embarrassment [and] stigma . . . ." Kentucky New Era v. City of Hopkinsville, -- SW --, p. 5, 2013 WL 6700223 (Ky.), 14 and holding that "Kentucky's private citizens retain a more than de minimus interest in the confidentiality of the personally identifiable information collected from them by the state." Id. at 6. Against this interest, the Court balanced the public's interest in the "disclosure of certain information about private citizens [that] sheds significant light on the agency's conduct," acknowledging that in such cases "the citizen's privacy interest must yield." Id. (Emphasis added.) Ultimately the Court concluded, the Act "is meant to open the state's public agencies to meaningful public oversight . . . [and] not meant to turn the state's agencies into clearing houses of personal information about private citizens readily available to anyone upon request," affirming nondisclosure of personal identifiers relating to victims, witnesses, and uncharged suspects appearing in police records. Id. at 11. With respect to information that identifies Medicaid recipients, we believe the private/public interest balance tips in favor of nondisclosure. Clearly, "significant privacy interests are at stake, " Kentucky New Era at 7, and dissemination of the identifiers could subject the recipients to embarrassment and stigma. Conversely, "the public interest is more attenuated," and no claim is advanced that disclosure of personal identifiers "sheds significant light" on the Department's conduct. Id. We therefore affirm the Department's decision to redact these identifiers from the fee-for-services and eligibility claims data.
The fact that Ms. Craig's client formerly enjoyed access to this information, and is contractually bound by a continuing obligation to maintain the confidentiality of information formerly obtained, does not alter our analysis. As Ms. York correctly observed in her December 20 letter to this office "Kentucky Spirit no longer provides services to any members and the authorization for the release of information was restricted to" Kentucky Spirit members. Subsequent disclosures of a broader information set under Kentucky's Open Records Act are not subject to these contractual prohibitions on disclosure.
This, fundamentally, is the rationale that supports our conclusion. In
Zink v. Commonwealth, 902 S.W.2d 825, 828 (Ky. App. 1994), Kentucky's courts determined that access to public records "does not turn on the purpose for which the request is made or the identity of the requester . . . . [T]he legislature clearly intended to grant any member of the public as much right of access to information as the next." The corollary of required disclosure of personal identifiers of Medicaid recipients to Ms. Craig is required disclosure of that information to the public generally. Here, as in Kentucky New Era , we find that "in the absence of any substantial reason to believe that the agency ha[s] not 'effectively promoted the public interest [in monitoring its conduct by means of the records already disclosed] '. . . disclosure of the private information [will] not serve the public interest and [is] not required merely' to satisfy the public's curiosity." Kentucky New Era at 7, citing
Kentucky Board of Examiners of Psychologist v. Courier-Journal and Louisville Times Co., 826 S.W.2d 324, 328 (Ky. 1992).
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Distributed to:
Janet A. CraigSteve BechtelCatherine York
Footnotes
Footnotes
1 Kentucky Spirit is a Medicaid managed care provider which, until July, 2013, served 124,000 Medicaid recipients under its contract with the Cabinet.
2 Dated August 29, 2012.
3 By letter dated January 14, 2014, Ms. Craig responded to Ms. York's December 20 answers to our request for additional information. Having reviewed her response, we find nothing that alters our analysis.
4 In acknowledging the inadequacy of its original response, the Department explained that it was "sent by a nonattorney who was unfortunately not as familiar with open records responses." This is not a plausible defense to a deficient response to an open records request insofar as KRS 61.880(1) requires that "[t]he response shall be issued by the official custodian or under his authority...." Any deficiencies in the response prepared by the nonattorney should have been corrected when the official custodian authorized its issuance as final agency action.
5 Offsite storage of agency records implicates both records management and records access issues. Thus, at page 5 of 13-ORD-053, we recognized that "under no circumstances may a public agency surrender control of its records to a third party and thereby abrogate its duties under the Open Records Act." Our review of Pricewaterhouse Cooper's contract with the Department confirms the existence of several provisions addressing ownership and control of the records and required production for various purposes. Contract, Doc ID No: PON2 746 12000010952, Sections 2.02, 9.07, 9.29, 9.54, 9.55, and 9.56. We are satisfied that the Department adequately addressed these issues.
6 Deputy Commissioner of the Department.
7 KRS 61.878(1)(i) and (j) authorize nondisclosure of:
(i) Preliminary drafts, notes, correspondence with private individuals, other than correspondence which is intended to give notice of final action of a public agency;
(j) Preliminary recommendations, and preliminary memoranda in which opinions are expressed or policies formulated or recommended[.]
8 City of Louisville v. Courier-Journal and Louisville Times Co., 637 S.W.2d 658, 659 (Ky. App. 1982).
9 Beckham v. Board of Education of Jefferson County, 873 S.W.2d 575, 578 (Ky. 1994).
10 In Lawson v. Office of the Attorney General, -- S.W.3d -- (Ky. 2013), 2013 WL 6700120 (Ky.) the Kentucky Supreme Court recognized the "waivability" of the exceptions, declaring that "the General Assembly did not intend to mandate an iron rule of nondisclosure whenever an exemption applies."
11 December 10, 2013, letter from Catherine York to Janet Craig.
12 KRS 61.878(1)(k) authorizes public agencies to withhold, "[a]ll public records or information the disclosure of which is prohibited by federal law or regulation[.]"
13 KRS 61.878(1)(l) authorizes public agencies to withhold, "[p]ublic records or information the disclosure of which is prohibited or restricted or otherwise made confidential by enactment of the General Assembly[.]"
14 Kentucky New Era , above, analyzes the public's right of access to social security and driver's license numbers, home addresses, and telephone numbers of victims, witnesses, and uncharged suspects in a police department's arrest and incident reports.