Hospital and health systems face big penalties if they do not comply with the privacy and security standards of the Health Information Portability and Accountability Act (HIPAA). So it may be astonishing to learn that the federal Privacy Rule does not apply to public records requests to Oregon public healthcare institutions, at least for now.
The Privacy Rule was an incidental casualty of a little-known decision last year from the Oregon Court of Appeals. That decision has caused consternation and confusion extending beyond the plaintiff and defendant. The new case law only applies to public institutions, which are subject to the state public records laws. It could be superseded by the Oregon Supreme Court, which heard oral arguments in March and may issue an opinion as soon as this fall.
The case, Oregon Health & Science University (OHSU) v. Oregonian, began in August 2011, when Nick Budnick, then at The Oregonian, asked for a list of people dating back to 2006 who let OHSU know they intended to sue. Oregon law requires the tort claims notice to be filed no more than 180 days before a lawsuit is launched against a state agency. State law also protects the sued agency from excessive damages, if found to be in the wrong. In contrast, no notice is required to sue a private institution, such as Providence or Legacy, and no cap is placed on damages.
“Other [state] agencies release this information,” Budnick says. “OHSU does not.” The idea was to inform the public about the claims made against OHSU and find out how much they were spending to settle cases out of court. The request asked for limited information from the tort claims: Name, attorney, dates of alleged tort and claim notice, and status (open or closed)—and not for the nature of the claim or claimant. More than 200 people filed tort claim notices over the five-year period, a group that could include patients, students, employees, faculty members, contractors, business partners, florists, visitors, and others, according to court documents.
OHSU media relations denied the request, citing sensitive business secrets, as well as HIPAA and other federal privacy protections of patients, students and employees on the list. “OHSU exerted the exemption, because it takes seriously the protection of patient and student privacy and confidentiality and because OHSU must comply with the constraints of HIPAA, FERPA, and state laws protecting the confidentiality of patient and student information, according to an email from OHSU spokesperson Tamara Hargens-Bradley.
Budnick then petitioned the Multnomah County district attorney, who ruled that the tort claims notice list is not a protected medical record. He ordered OHSU to disclose the information, and required The Oregonian to pay any associated costs, if any. In turn, OHSU sued The Oregonian, and lost by summary judgment in the trial court, which ordered OHSU to disclose the information and required OHSU to pay the Oregonian’s attorney fees.
The appeals court ruling on May 11, 2016, caught many people by surprise, in part because of some apparent errors in facts, and because the decision took a line of reasoning independent from either side’s argument.
“The parties led the court down the wrong path,” the decision said. Written by Judge Timothy Sercombe, the decision reasoned that HIPAA literally does not apply to Oregon public records. Although startling in theory, the rejection of HIPAA may have little practical effect on the release of information, which may otherwise be protected by state privacy laws. Student notices also may be protected, the judge said, but personnel records of employees were not exempt from disclosure. Sercombe and his panel of two other judges remanded the case back to trial court for a determination on all categories.
In its decision, the appeals court also developed a novel interpretation of the public records law. It asserted that an entire record could be withheld if small amounts in the record are confidential. That counters the usual practice of redacting exempt material.
In a friend of the court brief, the Oregon Attorney General’s office urged the Supreme Court to review and reverse the appeals decision. “The interpretation … is erroneous and will curtail meaningful access to public records in Oregon,” said the brief, written by Attorney General Ellen Rosenblum, Solicitor General Benjamin Gutman, and AG special counsel Michael Kron. Another aspect of the decision “creates independent exemptions from disclosure [that] threaten to create an unwarranted expansion of public records disclosure exemptions.”
In another friend of the court brief, the Oregon Medical Association applauded the appeals court decision that the identity of patients on the tort notices claim list was protected medical information, consistent with HIPAA protections.
Despite the decision’s potential threat to government transparency, Budnick commiserated with the appeals court. “Public records laws are subtle creatures of not just statutory language, but past decisions,” he said. “It’s hard for judges who have not dealt with a lot of these cases to figure it out.”
For now, issues of privacy and disclosure for public healthcare agencies will need to be sorted by state law and not by HIPAA, says Duane Bosworth, an attorney at Davis Wright Tremaine who argued The Oregonian’s case before the state Supreme Court in March.
Because the Oregon Supreme Court agreed to review the case, the Court of Appeals decision will not become final until the Supreme Court has issued its decision. Among the possible outcomes are the Supreme Court agreeing with the Court of Appeals (on the
same or different grounds), disagreeing with the lower court's conclusion
and reversing the decision, or returning the case to the Court of Appeals for
additional action.
the appellate opinion strongless influences the law of Oregon decisions until the Supreme Court rules differently, Bosworth added. The decision guides trial courts and agencies.
In the unintended consequences department, the appeals decision was cited as a rationale for the Oregon Health Authority’s futile legislative attempt to extend HIPAA protection to psychiatric health records used at hearings of the Psychiatric Security Review Board (PSRB), which is not covered by HIPAA. The PSRB and OHA were trying to block a request for the records of Anthony Montwheeler, who was released in December 2016 after claiming to fake mental illness for 20 years to avoid jail. He was arrested less than a month later on charges of killing two people.
“A recent appellate opinion about HIPAA and public agencies has led to
ambiguity and confusion about whether patients’ medical records retain confidentiality after they have been given into the PSRB’s possession,” testified attorney Micky Logan, Legal Affairs Director at the Oregon State Hospital, in favor of the proposed bill.
Across the country, “there’s a real conflict between state right-to-know and HIPAA,” said Stephen Wirth, an attorney at Pennsylvania-based Page, Wolfberg & Wirth, a firm specializing in national emergency medical services law. The conflict usually comes from state law provisions allowing access to information protected by HIPAA, such as identifiable medical information released by local emergency services providers at the scene of a car accident or the mental health status of a person with a gun who threatened to shoot someone. "When there is a conflict between state law and HIPAA,” Wirth added, “the law that better protects the patient's privacy will usually prevail."
As for OHSU, Hargens-Bradley declined to comment on the appeals decision, citing a policy about ongoing litigation, except to speculate on a potential impact “that a public body could not rely on HIPAA to exempt protected health information under the Oregon Public Records Law.”
Bosworth acknowledged that it is fair to expect a reporter to follow up with the individuals on the tort claims list to try to learn why they were suing.
“Whether any tort claimant chooses to talk to a reporter is squarely in the hands of that person,” he said. Some people may be eager to share their stories about what they believe OHSU did wrong. Others may not want any publicity and will leave the reporter in the dark about their status—patient, employee, student, or visitor—unless they choose to disclose that information.
OHSU’S attorney Roy Pulvers of Holland & Knight who argued the case before the state Supreme Court has retired and did not respond to inquiries from The Lund Report.
In court documents, Pulvers argued that the list of tort claim notices from patients are protected health information by federal and state laws. He noted that HIPAA defers to state law for required disclosure of protected health information, such as child and elder abuse and certain infectious diseases, but that state law does not require disclosure of the tort claims notices. When the case hit the Supreme Court, Pulvers newly offered a spreadsheet of all requested tort claim notices without the names of the patients and students, which The Oregonian rejected, “because that new list was not the public record The Oregonian sought or the record OHSU had previously agreed it would provide if ordered by a court,” Bosworth said.
There is no sign that OHSU considers any of its activities exempt from HIPAA as enforced by the federal government. After all, last year OHSU agreed to pay a $2.7 million federal fine and pursue “a rigorous three-year corrective action plan,” because of its most recent breaches of electronic health information.
Every Thursday, the Supreme Court releases opinions on its website, giving a 24-hour notice the day prior. Stay tuned for the next chapter.
Carol can be reached at [email protected]
Editor's note: This story was revised to clarify that the Court of Appeals decision on OHSU v. Oregonian does not become final until the state Supreme Court issues its decision.
