April 17, 2000
The staff of the Committee on Open Government is authorized to issue advisory opinions.
The ensuing staff advisory opinion is based solely upon the information presented in your
I have received your letter of January 18. You have asked whether dental records
pertaining to an inmate may be "released to the Attorney General in a pending civil suit
without the person's authorization or waiver being signed."
In this regard, as a general matter, medical and dental records are confidential and
may not be disclosed without the consent of the person to whom the records pertain [see
Public Health Law, §18; Personal Privacy Protection Law, §96(1)]. However, assuming that
the Attorney General is serving as the legal representative of a party to the lawsuit, I believe
that his office would essentially be in the same position as the agency he is representing.
If the Attorney General is not serving as the legal representative or counsel to the
agency, it would be questionable in my view whether the records in question could be
disclosed absent the consent of the subject of the records.
All agency records fall within the Freedom of Information Law. Pursuant to
§§87(2)(b) and 89(2)(b), it is clear that the records at issue would, if disclosed, constitute "an
unwarranted invasion of personal privacy."
Also pertinent is the Personal Privacy Protection Law, which deals in part with the
disclosure of records or personal information by state agencies concerning data subjects. A
"data subject" is "any natural person about whom personal information has been collected by
an agency" [Personal Privacy Protection Law, §92(3)]. "Personal information" is defined to
mean "any information concerning a data subject which, because of name, number, symbol,
mark or other identifier, can be used to identify that data subject" [§92(7)]. For purposes of
that statute, the term "record" is defined to mean "any item, collection or grouping of
personal information about a data subject which is maintained and is retrievable by use of the
name or other identifier of the data subject" [§92(9)].
With respect to disclosure, §96(1) of the Personal Privacy Protection Law states that
"No agency may disclose any record or personal information", except in conjunction with a
series of exceptions that follow. One of those exceptions involves a situation in which a
record is "subject to article six of this chapter [the Freedom of Information Law], unless
disclosure of such information would constitute an unwarranted invasion of personal privacy
as defined in paragraph (a) of subdivision two of section eighty-nine of this chapter." Section
89(2-a) of the Freedom of Information Law states that "Nothing in this article shall permit
disclosure which constitutes an unwarranted invasion of personal privacy as defined in
subdivision two of this section if such disclosure is prohibited under section ninety-six of this
chapter." Therefore, if a state agency cannot disclose records pursuant to §96 of the Personal
Protection Law, it is precluded from disclosing under the Freedom of Information Law.
I hope that I have been of assistance.
Robert J. Freeman