FROM:      Robert J. Freeman, Executive Director

CC:           

RE:            Advisory Opinion

The staff of the Committee on Open Government is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the information presented in your correspondence, except as otherwise indicated.

I have received your letter and the materials relating to it. The issue involves the response to a request made pursuant to the Freedom of Information Law (FOIL) for "the accident reports involving the airbag at Whiteface Mountain" to the Olympic Regional Development Authority (ORDA). The FOIL response "contained redactions of names of people injured - and of the write-up of the injuries." ORDA sent a copy of its determination of your appeal, and in brief, the determination justified the redactions based on the exception in FOIL concerning unwarranted invasions of person privacy and the federal Health Insurance Portability and Accountability Act, also known as "HIPAA". You wrote that "If there are no names available, because they are blocked out, how can the other data be an unwarranted invasion of privacy?"

Having reviewed the determination and several samples of the Injury Report form, I offer the following comments.

First, as a general matter, FOIL is based on a presumption of access. All government agency records are available, except those records or portions of records that may properly be withheld in accordance with the exceptions to rights of access appearing in §87(2) of FOIL.

Second, when an agency denies access to records, and the denial is challenged via the initiation of an Article 78 proceeding, unlike other such proceedings in which the petitioner has the burden of proving that the agency acted unreasonably or failed to carry out a legal duty, the agency has the burden of proof when the proceeding involves a denial of access under FOIL. The Court of Appeals confirmed its general view of the intent of the Freedom of Information Law in Gould v. New York City Police Department, stating that:

"To ensure maximum access to government records, the 'exemptions are to be narrowly construed, with the burden resting on the agency to demonstrate that the requested material indeed qualifies for exemption' (Matter of Hanig v. State of  New York Dept. of Motor Vehicles, 79  N.Y.2d 106, 109, 580 N.Y.S.2d 715, 588 N.E.2d 750 see, Public Officers Law  § 89[4][b]). As this Court has stated, '[o]nly where the   material
requested falls squarely within the ambit of one of these statutory exemptions may disclosure be withheld' (Matter of Fink v. Lefkowitz, 47 N. Y.2d, 567, 571, 419 N. Y.S.2d 467, 393 N.E.2d 463)" [89 NY2d 267,
275(1996)].   

The Court also offered guidance to agencies and lower courts in determining rights of access and referred to several decisions it had previously rendered, stating   that:

"...to invoke one of the exemptions of section 87(2), the agency must articulate 'particularized and specific justification ' for not disclosing requested documents (Matter of Fink v. Lefkowitz, supra, 47 N.Y.2d, at 571, 419 N.Y.S.2d 467, 393 N.E.2d 463). If the court is unable to determine whether withheld documents fall entirely within the scope of the asserted exemption, it should conduct an in camera inspection of representative documents and order disclosure of all nonexempt, appropriately redacted material (see, Matter of Xerox Corp. v. Town of Webster, 65 N.Y.2d 131, 133, 490 N.Y.S. 2d, 488, 480 N.E.2d 74; Matter of
Farbman  &  Sons v. New  York  City Health  & Hosps.  Corp., supra, 62 N.Y.2d, a83, 476 N.Y.S.2d 69, 464 N.E.2d 437)" (id.).

Third, §§87(2)(b) and 89(2)(b) of FOIL indicate that an agency may withhold records insofar as disclosure would constitute "an unwarranted invasion of personal privacy."  In my view, there is no doubt that portions of the injury reports may be withheld or redacted insofar as disclosure could identify the injured person. Section 89(2)(b) contains a series of examples of unwarranted invasions of personal privacy, the first two of which involve information of a medical nature. Additionally, when issues have arisen concerning users of state parks, it has generally been advised that records indicating when and where private citizens vacation or spend their leisure time would, if disclosed, result in an unwarranted invasion    of their privacy.

With respect to HIPAA, critical in my view is the assertion in the determination of your appeal that injury report forms are completed by "certified medical staff ' who qualify as "health care providers" subject to H I PAA.  Because that is so, insofar as the information contained on the forms consists of "protected health information" as that phrase is defined in federal HIPAA regulations, I believe that a denial of access based on HIPAA is appropriate and consistent with law.  As indicated in the determination, a "health care provider" is a person or entity that provides, "care, services, or supplies related to the health of an individual", and "protected health information" includes material that is collected from an individual and is "created or received" by a health care provider.

In consideration of the FOIL exception regarding unwarranted invasions of personal privacy and the protection of privacy accorded by HIPAA, the issue is the same relative to both and was expressed in the determination: to what extent is there "a reasonable basis to believe [that] the information can be used to identify [an] individual"?

Absent a victim 's name, address, phone number and similar items unique to that person   or a witness, it is questionable, in my view, whether disclosure of various items on the report   could be used to identify an individual.  For instance, absent clearly identifying details, it may be difficult to demonstrate how disclosure of a person's occupation, his or her height and weight, a victim's description of his or her injury, the nature of treatment, or the destination to which the victim was transported would serve as information that could reasonably be used to identify an individual.  The areas of the form referring to those entries are brief, and absent substantial    detail, it seems unlikely that disclosure could result in the identification of an individual.

Lastly, one element of the form refers to "probable injury". Due to the use of the term "probable", it appears that the entry would reflect the opinion of the employee completing the form. If that is so, that portion of the form could, in my view, be redacted on the ground that it consists of "intra-agency material" deniable pursuant to §87(2)(g) of FOIL.

I hope that I have been of assistance and that the foregoing may encourage ORDA to review and reconsider its determination.