Court Opinion

ID: 3263637
Source: CourtListenerOpinion
Date Created: 2016-07-05 16:33:38.670609+00
Date Added: 2024-06-11T13:40:42.941753
License: Public Domain

Mr. Luther Oneal Sutter Harrill  Sutter, P.L.L.C. Attorneys at Law Post Office Box 26321 Little Rock, AR 72221
Dear Mr. Sutter:
I am writing in response to your request for an opinion regarding the Arkansas Freedom of Information Act ("FOIA") (A.C.A. § 25-19-101 et seq.
Your request is submitted pursuant to A.C.A. § 25-19-105(c)(3)(B) (Supp. 1993), which authorizes the custodian, requester, or the subject of personnel, employee evaluation, or job performance records to seek an opinion from this office stating whether the custodian's decision regarding the release of such records is consistent with the FOIA.
The correspondence you have provided in this regard indicates that you submitted a FOIA request to the University of Arkansas for Medical Sciences (UAMS) seeking copies of letters sent from Unum Provident ("Unum") to the UAMS Benefits Office regarding Unum's determination on individual claims for disability by UAMS employees.1 Letter from Jeffrey A. Bell, Sr. Associate General Counsel to Luther Oneal Sutter, P.A. (June 15, 2005). In making the FOIA request to UAMS, you expressed your belief that the letters from Unum advising of its determination on these claims would not disclose any personal health information. Letter from Luther Oneal Sutter to Jeffrey A. Bell (June 8, 2005). You also stated that you were specifically looking for the names and addresses of all employees who have submitted claims to Unum under the Benefit Program provided them by UAMS. Id.
UAMS declined, through legal counsel, to provide the records. Letter from Jeffrey A. Bell, supra. According to Mr. Bell's June 15 correspondence, the denial was based upon the exemption in the FOIA pertaining to "medical records" and "personnel records" (A.C.A. §§ 25-19-105(b)(2) and (12), respectively), as well as the privacy regulations under the Federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub.L. No. 104-191, 110 Stat. 1936 (codified in scattered sections of volumes 18, 26, 29 and 42 of the United States Code).
You seek my review of this determination.
RESPONSE
I am unable to definitively decide whether the records at issue are safeguarded by HIPAA's privacy regulations because such a decision would require me to undertake a factfinding investigation that is outside the scope of my authority. As explained more fully below, however, if it is determined that HIPAA does not prevent disclosure, it is my opinion that in this particular instance the records are nevertheless exempt from public inspection and copying under the FOIA's "personnel records" exemption. It is therefore my opinion that the custodian has properly decided that the records are not subject to disclosure, based on either HIPAA or the FOIA.
With regard to HIPAA, I believe this issue likely turns on the proper characterization of the correspondence from Unum, which in turn may depend upon the particular role or function of the Benefits Office. As a general proposition in this regard, I note that the broad definition of "protected health information" under HIPAA and its implementing regulations (the "Privacy Rule," 45 C.F.R., Parts 160 and 164) would appear to include the individually identifiable information in the Unum letters. See 45 C.F.R. § 160.103 (defining "protected health information").2 The general rule is that a covered entity may not use or disclose protected health information except as permitted or required by the rules. See id. § 164.502(a). UAMS, as a "covered entity" (see id.
at 160,103), is generally subject to the privacy regulations.
I also note, however, that the definition of "protected health information" expressly excludes "[e]mployment records held by a covered entity in its role as employer." Id. If this exception applies, HIPAA will not prevent disclosure of the Unum letters. This would appear to be the case if the Benefits Office is acting for UAMS in its capacity as an employer. That is, it may well be that in that case the HIPAA regulations are inapplicable based upon the "employment records" exception. Another possibility must, however, be recognized. Depending upon its particular function, it is possible that the Benefits Office is actually acting on behalf of the disability plan such that HIPAA's privacy restrictions will indeed apply. Cf. Tex. Att'y Gen. Op. GA-0138 (2004) (discussing a county's responsibility under a particular plan document, and noting that "business associates" of covered entities are also affected by HIPAA, citing 45 C.F.R. 160.103). The role or function of the Benefits Office may thus factor into the resolution of this issue. I cannot, however, undertake the necessary review to decide the matter. Please note in this regard that the Office for Civil Rights within the U.S. Department of Human Resources ("HHS") has responsibility for implementing the Privacy Rule and provides resources for addressing HIPAA concerns. Consultation with that office may be helpful in addressing the HIPAA concerns.
It is apparent from this discussion that I cannot resolve these questions concerning HIPAA because such a decision would require an investigation of the facts that I am not authorized to conduct. The discussion is offered simply to frame the HIPAA issue as I perceive it. As also indicated above, however, resolution of that issue is not critical to your question because even if it is determined that the records constitute employment records that are not protected under HIPAA, it is my opinion that the FOIA's "personnel records" exemption will prevent their release in this instance.3
"Personnel records" are subject to inspection and copying under the FOIA except to the extent that disclosure would constitute a "clearly unwarranted invasion of personal privacy." A.C.A. § 25-19-105(b)(12). Although the FOIA does not define the term "personnel records" as used therein, this office has consistently taken the position that "personnel records" are any records other than employee evaluation/job performance records that relate to the individual employee. See, e.g., Op. Att'y Gen. 2005-032 (and opinions cited therein). For purposes of the FOIA, therefore, it seems clear that the letters to UAMS from Unum are properly considered "personnel records."
Under the FOIA, "personnel records" must be released unless their release would constitute a "clearly unwarranted invasion of [the employee's] personal privacy." A.C.A. § 25-19-105(b)(12). The FOIA does not define the phrase "clearly unwarranted invasion of personal privacy." The Arkansas Supreme Court, however, has construed the phrase, and has adopted a balancing test to determine whether an individual has a protectable privacy interest in a particular personnel record. The balancing test essentially involves weighing the interests of the public in accessing the records against the individual's interest in keeping the records private. See Young v. Rice, 308 Ark. 593, 826 S.W.2d 252 (1992). If the public's interest outweighs the individual's interest, the custodian must disclose the records. Id. at 598. This will ordinarily be the case if the public interest is substantial (and the privacy interest might be sufficiently protected by redacting identifying information). Id.
Disclosure will also generally be required even if the public interest and the privacy interest are both minimal because the balance is tipped in favor of disclosure under the "clearly unwarranted" test. Id. If, however, the individual's privacy interest is "not insubstantial," then the records will be protected as long as there is little public interest in the information. See Stilley v. McBride, 332 Ark. 306, 965 S.W.2d 125
(1998). The Supreme Court has made clear that the privacy balancing test must be undertaken with reference to the particular facts in light of the unique circumstances attending the specific records in question. Id. The decision on the relative weight of the privacy interest in the case of certain records will not necessarily be determinative in another case.
When these precepts are applied to the records in question, I believe that a court would likely find that in this case disclosure would result in a clearly unwarranted invasion of personal privacy. With regard to the privacy interest, as stated by Mr. Bell, ". . . even if [the Unum correspondence] is devoid of specifics about the employee's particular medical condition, [it] would reveal the employee's name, address, and the fact [that] the employee had a medical condition triggering the filing of a claim for disability benefits." (June 15, 2005 Letter, supra). In my opinion this gives rise to a substantial privacy interest. This conclusion is consistent, moreover, with previous opinions of this office that have distinguished between records reflecting, on the one hand, general information about insurance benefits for public officials or employees, and on the other hand, the personal details of an employee's insurance coverage. See, e.g., Op. Att'y Gen. 2004-167. Individual employees have a significant privacy concern in protecting the latter information from disclosure.
With regard to the public interest in these records, the question is the extent to which the FOIA would be served by the release of a letter that advises an employee regarding the determination on his or her individual disability claim. See Stilley, supra. In my opinion, no substantial public interest would be served by such release in this instance. Even if the letters contain no specific medical information, the fact that the employee was filing a disability claim itself constitutes personal information in which the public here has no strong interest.
Accordingly, if the question turns on the FOIA rather that HIPAA, as discussed above, it is my opinion that the records' custodian has properly determined that the records are exempt from public inspection and copying under the FOIA.
Assistant Attorney General Elisabeth A. Walker prepared the foregoing opinion, which I hereby approve.
Sincerely,
MIKE BEEBE Attorney General
MB:EAW/cyh
1 Apparently, Unum is UAMS's disability insurance provider.
2 This of course assumes that Unum is a "covered entity" under HIPAA, presumably by virtue of it being a "health plan." See
45 C.F.R. 160.102-.103 (defining "covered entity" and "health plan").
3 The Privacy Rule under HIPAA does not exempt state statutes that are "more stringent." 45 C.F.R. §§ 160.202-.203. Generally, a state statute is more stringent than the Privacy Rule if it "provides greater privacy protection for the individual who is the subject of the individually identifiable health information." Id. § 160.202(6).