OHSU v. Oregonian Publishing Co., LLC

• Court: Oregon Supreme Court
• Decided: October 19, 2017
• Docket: S064249
• Status: Published

Opinion

68 October 19, 2017 No. 56

IN THE SUPREME COURT OF THE STATE OF OREGON

OREGON HEALTH AND SCIENCE UNIVERSITY, a public corporation, Respondent on Review, v. OREGONIAN PUBLISHING COMPANY, LLC, a domestic limited liability company, Petitioner on Review. (CC 111216443; CA A152961 SC S064249)

On review from the Court of Appeals.* Argued and submitted March 3, 2017. Duane A. Bosworth, Davis Wright Tremaine LLP, Portland, argued the cause and filed the briefs for petitioner on review. Also on the briefs was Derek D. Green. Roy Pulvers, Holland & Knight LLP, Portland, argued the cause and filed the brief for respondent on review. Also on the brief was Nellie Q. Barnard. Inge D. Wells, Assistant Attorney General, Salem, filed the brief on behalf of amicus curiae State of Oregon. Also on the brief were Ellen F. Rosenblum, Attorney General, and Benjamin Gutman, Solicitor General. Hillary A. Taylor, Keating Jones Hughes, PC, Portland, filed the brief on behalf of amicus curiae Oregon Medical Association. Also on the brief was Lindsey H. Hughes. Before Balmer, Chief Justice, and Kistler, Walters, Landau, Nakamoto, and Flynn, Justices, and Brewer, Senior Justice pro tempore.** ______________ ** Appeal from Multnomah County Circuit Court, Richard Maizels, Judge. 278 Or App 189, 373 P3d 1233 (2016). ** Baldwin, J., retired March 31, 2017, and did not participate in the decision of this case. Duncan, J., did not participate in the consideration or decision of this case. Cite as 362 Or 68 (2017) 69

BREWER, S. J. pro tempore The decision of the Court of Appeals is reversed in part and affirmed in part. The judgment of the circuit court and the supplemental judgment awarding attorney fees and costs to The Oregonian are reversed, and the case is remanded to the circuit court for further proceedings.

Case Summary: Defendant newspaper filed a public records request under ORS 192.490(1) with plaintiff, a public corporation that provides patient health care, seeking a list of the claimant names, attorney names, dates of alleged torts, and other information for tort claim notices received by plaintiff. Plaintiff responded that some of the requested information was exempt from disclosure pursuant to various state and federal laws. Defendant petitioned the district attorney, pursuant to ORS 192.450 and ORS 192.460, for an order directing plaintiff to disclose the requested record, which the district attorney granted, and plaintiff filed an action in circuit court, seeking a declaratory judgment that the information in the requested record that it had declined to disclose was exempt from disclosure. On the parties’ cross-motions for summary judgment, the circuit court determined that the exemptions that plaintiff relied on were not available and entered a judgment requiring plaintiff to disclose the requested record. Plaintiff appealed, and the Court of Appeals reversed in part, directing the circuit court to examine the tort claim notices in question to determine if they are exempt from disclosure under ORS 192.496(1) because they contain information about the physical or mental health or psychiatric care or treatment of an individual patient. Held: For tort claim notices involving patients, (1) the requested information at issue—the claimant names, attorney names, and dates of the alleged torts—is “protected health information” that is confidential pursu- ant to ORS 192.553; (2) the protected health information at issue is exempt from disclosure under ORS 192.502(9)(a); and disclosure of the requested record is not required by ORS 192.420(1). The decision of the Court of Appeals is reversed in part and affirmed in part. The judgment of the circuit court and the supplemental judgment awarding attorney fees and costs to The Oregonian are reversed, and the case is remanded to the circuit court for further proceedings. 70 OHSU v. Oregonian Publishing Co., LLC

BREWER, S. J. pro tempore

This case concerns a public records request made by defendant Oregonian Publishing Company, LLC (The Oregonian), a newspaper, to plaintiff Oregon Health and Sciences University (OHSU), a public health and research university that provides patient care at its hospital, con- ducts research, and educates health care professionals and scientists. The circuit court ordered OHSU to disclose the requested record, and OHSU appealed. The Court of Appeals reversed and remanded to the circuit court to examine the public records at issue and then determine whether state and federal exemptions permitted OHSU to withhold some of the requested information. On review, the issues have narrowed to whether the requested record con- tains “protected health information” and student “education records” under federal and Oregon law and, if so, whether that information nonetheless must be disclosed pursuant to ORS 192.420(1), a provision of the Oregon Public Records Law (OPRL).1

For the reasons explained below, we conclude that the requested record contains protected health information and that ORS 192.420(1) does not require the disclosure of that information. In the absence of adequately developed arguments, we decline to consider whether the part of the requested record consisting of tort claim notices filed by stu- dents contains “education records,” and, if so, whether those records are exempt from disclosure. We therefore leave undisturbed the Court of Appeals’ disposition of that issue, which was to remand to the circuit court for examination of the tort claim notices.

Accordingly, we reverse in part and affirm in part the decision of the Court of Appeals, we reverse the judg- ment of the circuit court and its supplemental judgment awarding attorney fees and costs to The Oregonian, and we remand to the circuit court for further proceedings.

1 The OPRL is codified at ORS 192.410 to 192.505. Under ORS 192.420(1), “[e]very person has a right to inspect any public record of a public body in this state, except as otherwise expressly provided by ORS 192.501 to 192.505.” Cite as 362 Or 68 (2017) 71

I. FACTS AND PROCEDURAL BACKGROUND The Oregonian, through a reporter, made a pub- lic records request to OHSU, based on ORS 192.420(1), in which it sought information contained in tort claim notices received by OHSU.2 In particular, The Oregonian’s request sought: “[A] list of tort claims filed against [OHSU] and its affil- iated entities, preferably in spreadsheet form, with infor- mation dating back [five years] and including only the fol- lowing types of information or data fields: claim number, claimant full name, attorney full name, date of alleged tort, date of tort claim notice, and whether it is closed or open. If you need to fully redact from the printout other data fields or information not fitting the above description, please do so.” The Oregonian stated that it was “not requesting the text of actual tort claim notices.” The Oregonian asserted that it did not seek “any information generated in the course of medical treatment,” nor was it requesting “health informa- tion of any kind.” From The Oregonian’s previous communi- cations with OHSU, The Oregonian understood that provid- ing such a list from OHSU’s record database would not pose a logistical problem. OHSU created a record tailored to The Oregonian’s request (the “requested record”). The requested record is a list in which each row represents a discrete tort claim notice and each column represents a category of infor- mation requested by The Oregonian for each tort claim notice. OHSU did not provide the requested record to The Oregonian, but, instead, responded by stating that it would comply with the public records request in part and object to it in part, as described below. In response, The Oregonian petitioned the Multnomah County District Attorney, pursuant to ORS 2 As a public corporation under ORS 353.020, OHSU’s tort liability and the limits on it are set out in the Oregon Tort Claims Act, ORS 30.260 to 30.300. Moreover, the Oregon Tort Claims Act regulates the manner in which claims against public bodies are prosecuted. As part of that regulation, a tort claim notice must be given to the public body prior to the commencement of litigation, stating the name and address of the claimant, as well as a “description of the time, place and circumstances giving rise to the claim.” ORS 30.275. 72 OHSU v. Oregonian Publishing Co., LLC

192.450 and ORS 192.460,3 for an order directing OHSU to disclose the requested record. OHSU responded that parts of the requested record were exempt from disclosure. As a visual explanation, OHSU’s response included a table that contained rows that illustrated the types of tort claims that OHSU had received during the specified period—including professional liability claims, employment liability claims, general liability claims concerning students, general liabil- ity claims concerning patients, and other general liability claims—and columns that contained the information spec- ified in The Oregonian’s request. For each type of claim and each type of information requested, OHSU indicated in the table whether it was willing to provide that informa- tion or not. If OHSU indicated that it would not provide the information in the table due to a claimed exemption from disclosure, OHSU also cited the source of that claimed exemption. In all, OHSU initially claimed six exemptions that, it asserted, prohibited disclosure of parts of the requested information, including, among others, the Health Insurance Portability and Accountability Act (HIPAA) of 1996, 42 USC § 1320d to 1320d-9, and its implementing regulations known as the Privacy Rule, 45 CFR Parts 160 and 164; several exemptions under Oregon law; and exemptions pertaining to education records under the Family Educational Rights and Privacy Act (FERPA), 20 USC § 1232g. Based on those claimed exemptions, OHSU argued that it was precluded from disclosing claimant names, attorney names, and dates of the alleged torts for tort claim notices related to patients. Specifically with regard to attor- ney names, OHSU argued that patients could be identified if attorney names were disclosed and court filings that listed OHSU as a defendant were searched for those attorney names. For claims filed by students related to their educa- tion, OHSU asserted that it could not disclose the student

3 ORS 192.450 and ORS 192.460 authorize a person who has been denied the right to inspect or receive a copy of a public record to petition the local district attorney or the attorney general—depending on the type of public body involved in the public records request—to initially determine, subject to judicial review, whether the requested public record may be withheld from disclosure. Cite as 362 Or 68 (2017) 73

names. OHSU agreed to provide the requested information pertaining to other liability claims.4 The district attorney ruled that the claimant names, attorney names, and dates of the alleged torts for all claims were not exempt from disclosure, and it directed OHSU to disclose the entire requested record. OHSU there- after gave notice to the district attorney of OHSU’s intent to initiate a circuit court action. OHSU then filed this action, seeking a declaratory judgment that the information in the requested record that it had declined to disclose was exempt from disclosure. The Oregonian asserted counterclaims in which it sought injunctive relief requiring disclosure of the entire requested record and a statutory award of attorney fees and costs. Before the circuit court, the parties filed cross- motions for summary judgment. In OHSU’s motion, it asserted, pursuant to various state and federal exemp- tions, that it was entitled to withhold from disclosure all the information that it had declined to disclose or, in the alternative, some of that information.5 In support of its motion, OHSU submitted an affidavit from its Director of Risk Management. The director stated that she had per- sonally examined hundreds of tort claim notices, including many requested by The Oregonian. Based on her review of those tort claim notices, the director averred that “tort claim notices submitted to OHSU by patients or others and maintained by OHSU relating to patient care always iden- tify one or more patients.” She further stated that tort claim notices for patient claims “includ[e] the fact that the individ- ual received care at OHSU” and “include specific informa- tion about the physical or mental health or psychiatric care

4 OHSU also initially declined to disclose claimant names for employment liability claims; however, OHSU later agreed to disclose that information. Accordingly, the issue whether claimant names pertaining to employment liabil- ity claims are exempt from disclosure is not before us. In addition, OHSU initially argued that all the information requested in the tort claim notices was exempt from disclosure under ORS 192.502(21), the sensitive business records exemp- tion. OHSU no longer makes that argument, and we therefore do not consider it. 5 In its motion for summary judgment, OHSU stated that, if the court exer- cised its authority pursuant to ORS 192.490(1) to review the requested record in camera, OHSU would provide the requested record for the court’s review. The circuit court, however, did not engage in an in camera review. 74 OHSU v. Oregonian Publishing Co., LLC

or treatment of the patient.” The director continued, “Many tort claim notices provide specific and detailed information about the circumstances giving rise to the potential claim.” She also stated that all tort claim notices received by OHSU are kept in OHSU’s risk management office. OHSU also submitted an affidavit from its Executive Vice Provost, who stated that OHSU receives funds under programs administered by the United States Department of Education. He described tort claim notices received by OHSU from students: “Tort claim notices submitted to OHSU by OHSU students always contain information identifying the student, such as the student’s name, and information directly related to the student, such as a description of the time, place and circumstances giving rise to the claim. * * * OHSU treats tort claim notices directly related to students as ‘education records’ to which FERPA applies.” In turn, The Oregonian’s motion for summary judg- ment sought a judgment enjoining OHSU from withholding the requested record and ordering its disclosure. The circuit court issued a letter opinion and order denying OHSU’s motion and granting The Oregonian’s motion. The court ruled that the exemptions that OHSU relied on with respect to patient claims did not apply because disclosure of the requested record could lead to the discovery of confidential information only if a listed claimant was contacted and chose to divulge confidential information. Further, the court determined that the other exemptions that OHSU relied on were not available. The circuit court then entered a general judgment requiring OHSU to disclose the requested record; pursuant to ORS 192.490(3), the court also entered a supplemental judgment for attorney fees, costs, and disbursements in favor of The Oregonian. OHSU appealed, arguing that the claimant names, attorney names, and dates of the alleged torts that related to patients were exempt from disclosure. In support of its argument, OHSU relied on the HIPAA Privacy Rule, which generally prohibits the disclosure of “protected health information”; ORS 192.502(8), which exempts disclosures Cite as 362 Or 68 (2017) 75

prohibited by federal law; ORS 192.558(1), which prohib- its the unauthorized disclosure of protected health infor- mation; ORS 192.502(9)(a), which exempts from disclosure public records that are confidential; ORS 192.496(1), which exempts certain records that contain information about the physical or mental health or psychiatric care or treatment of a living person if public disclosure would constitute an unreasonable invasion of privacy; and ORS 192.502(2), which exempts personal information if public disclosure would constitute an unreasonable invasion of privacy. For claims related to students, OHSU argued that the students’ names were protected under FERPA and therefore were exempt from disclosure under ORS 192.502(8). OHSU also argued that, if the Court of Appeals modified the judgment ordering disclosure, an award of attorney fees would be discretionary under ORS 192.490(3), and the supplement judgment awarding fees should be remanded to determine whether attorney fees should be awarded, and, if so, in what amount. In response, The Oregonian reiterated its position that it was not seeking “protected health information” or edu- cation records that are exempt from disclosure. According to The Oregonian, if OHSU complied with its request, The Oregonian would not receive any information regarding the status of any claimant—including whether the claimant was a patient or a student—or the nature or description of any claim. In its opinion, the Court of Appeals first noted that, by its terms, the OPRL does not require a public body to create new public records in response to a public records request. OHSU v. Oregonian Publishing Co., LLC, 278 Or App 189, 194 n 3, 373 P3d 1233 (2016). The court further stated: “The parties assume, as do we, that the question presented in this case is whether the requested information (name of claimant, date of the alleged tort, name of claimant’s attor- ney) can be redacted from the tort claim public records that could otherwise be provided to The Oregonian pursuant to its demand and whether OHSU may disclose any of the information in some of the tort claim notices. For purposes 76 OHSU v. Oregonian Publishing Co., LLC

of this case, the compilation of that information into a dif- ferent public record does not change the issues that must be resolved.”

Id. In considering the application of HIPAA’s Privacy Rule to patient claims, the Court of Appeals assumed for the sake of its decision that the patients’ names, names of the patients’ attorneys, and the dates of the alleged torts in the tort claim notices constituted “protected health information.” Id. at 201. The court noted, though, that the Privacy Rule allows disclosure of protected health infor- mation when disclosure is “required by law.” Id. (citing 45 CFR § 164.512(a)(1)). The court then concluded that, if the requested record was not exempt from disclosure under the OPRL, its disclosure would be “required by” the OPRL and, therefore, allowed by the Privacy Rule. Id. at 202. The court further reasoned that, if disclosure of protected health information is allowed by the Privacy Rule because it is otherwise “required by” the OPRL, then disclosure is not “prohibited by federal law” under ORS 192.502(8). Id. Because it concluded that the Privacy Rule and ORS 192.502(8) did not prohibit disclosure of the protected health information in the tort claim notices, the Court of Appeals opined that whether disclosure was prohibited depended on whether an exemption from disclosure existed under the OPRL for information about the physical or mental health or psychiatric care or treatment of a living individual, ORS 192.496(1), or personal information, ORS 192.502(2). Id. Turning to the exemption in ORS 192.496(1), the Court of Appeals explained that the determination whether the requested record contained information about the physical or mental health or psychiatric care or treat- ment of a living individual and, if so, whether its disclo- sure would constitute an unreasonable invasion of patient privacy, necessarily would require examination of the information contained in the tort claim notices. Id. at 206. The court concluded that the circuit court had failed to apply ORS 192.496(1) correctly; instead, the circuit court had applied ORS 192.505—directing redacted disclosure Cite as 362 Or 68 (2017) 77

in certain circumstances6 —and it had ordered OHSU to disclose the nonexempt material. Id. at 204. In the Court of Appeals’ view, ORS 192.505 does not apply to a claimed exemption under ORS 192.496(1) because, on its face, ORS 192.505 applies only to records that contain both exempt and nonexempt material under ORS 192.501 and 192.502, and the record created by OHSU contains only nonexempt material.7 Id. The Court of Appeals concluded that ORS 192.505 does not apply to exemptions that classify an entire record as exempt from disclosure; rather, it applies only to public record exemptions that classify information in a record as exempt from disclosure. Id. at 205 (emphasis in original). Because the circuit court had applied ORS 192.505 without reviewing the requested record to deter- mine whether it was exempt from disclosure under ORS 192.496(1), the Court of Appeals concluded that the circuit court had erred in granting The Oregonian’s motion for summary judgment.8 Id. at 206. Accordingly, the Court of Appeals reversed and remanded with regard to the patient claims. Similarly, the Court of Appeals concluded that, to determine whether FERPA and ORS 192.502(8) prohib- ited the disclosure of claimants’ names for student-related claims, the circuit court was required to examine the tort claim notices involving students to determine whether they described and directly related to activities of a student or the educational status of a student. Id. at 210-11. Because the circuit court had not reviewed the tort claim notices, the

6 ORS 192.505 provides: “If any public record contains material which is not exempt under ORS 192.501 and 192.502, as well as material which is exempt from disclosure, the public body shall separate the exempt and nonexempt material and make the nonexempt material available for examination.” 7 ORS 192.501 provides that certain public records, including trade secrets, investigatory information compiled for criminal law purposes, and a personnel discipline action and associated materials, as well as others, are exempt from dis- closure unless the public interest requires disclosure in the particular instance. ORS 192.502 exempts from disclosure public records made confidential under Oregon law, the addresses of certain state employees and retirees, and other enu- merated records. 8 In light of its resolution of the claimed exemption under ORS 192.496(1), the Court of Appeals did not consider the personal information exemption under ORS 192.502(2). OHSU, 278 Or App at 206. 78 OHSU v. Oregonian Publishing Co., LLC

Court of Appeals reversed and remanded with respect to the student claims as well.9 We allowed review primarily to determine whether the names of the claimants and their attorneys, and the dates of the alleged torts, are exempt from disclosure as (1) “protected health information” under HIPAA (and thus unconditionally exempt from disclosure pursuant to ORS 192.502(8)); (2) protected health information that is con- fidential under ORS 192.558(1) (and consequently exempt from disclosure under ORS 192.502(9)(a)); (3) information about the physical or mental health or psychiatric care or treatment of a living individual that is exempt from dis- closure under ORS 192.496(1); or (4) information of a per- sonal nature that is exempt from disclosure under ORS 192.502(2).10 As noted, The Oregonian does not seek unre- dacted copies of the tort claim notices themselves or specific information about claimants’ health conditions, treatments, or diagnoses. II. ANALYSIS A. Standard of Review On review of cross-motions for summary judgment, we determine whether there are any disputed issues of mate- rial fact and whether either party is entitled to judgment as a matter of law. ORCP 47. We state the facts in the light

90 The Court of Appeals also reversed the supplemental judgment awarding fees to The Oregonian on the ground that, on remand, The Oregonian may not be entitled to those fees as a matter of right. Id. at 211 (citing ORS 192.490(3)). 10 After we allowed review, OHSU provided a spreadsheet to The Oregonian that contained the requested information for which it did not claim an exemp- tion, but with the information still at issue on review redacted pursuant to ORS 192.505. Specifically, for patient claims, the spreadsheet included the claim num- ber, date of tort claim notice, and indicated whether the claim is open or closed. For student claims, OHSU provided all the requested information except the claimant name. For all other claims, the spreadsheet provided all the requested information. The Oregonian rejected the spreadsheet on the ground that it did not comply with the public records request that The Oregonian had made. In its brief before this court, OHSU argues that, because the spreadsheet contains the requested information for all claims other than patient claims and student claims, The Oregonian no longer has any basis to argue that patient names cannot be dif- ferentiated from other claimant names. At oral argument, The Oregonian argued that, by submitting the spreadsheet, OHSU had strategically attempted to alter the record in this case. Because of our disposition of the case, we do not address that procedural issue. Cite as 362 Or 68 (2017) 79

most favorable to the party against whom summary judg- ment was granted—in this case, OHSU. See Double Eagle Golf, Inc. v. City of Portland, 322 Or 604, 606, 910 P2d 1104 (1996). B. Overview As noted, ORS 192.420(1) provides that “[e]very person has a right to inspect any public record of a public body in this state, except as otherwise expressly provided by ORS 192.501 to 192.505.” A public record “includes any writ- ing that contains information relating to the conduct of the public’s business * * * prepared, owned, used or retained by a public body regardless of physical form or characteristics.” ORS 192.410(4)(a).11 Generally, disclosure of public records is the presumption, and exemptions from disclosure are narrowly construed and made on an individualized basis. Guard Publishing Co. v. Lane County School Dist. No. 4J, 310 Or 32, 37, 791 P2d 854 (1990). The public body or agency withholding a record has the burden “to sustain its action.” ORS 192.490(1). C. Patient Claims As noted, OHSU asserts that the claimant names, attorney names, and dates of the alleged torts for patient claims are “protected health information” that is shielded from disclosure by both HIPAA and exemptions under Oregon law. In contrast, The Oregonian has not addressed any of the exemptions from disclosure under Oregon law on which OHSU relies. Instead, The Oregonian primarily has staked its position on the threshold proposition that the requested record does not contain any protected health information under HIPAA and, therefore, its disclosure is required by ORS 192.420(1).12 The Oregonian asserts that 11 The 2017 Legislative Assembly renumbered subsection (4)(a) to subsection (5)(a), effective January 1, 2018. Or Laws 2017, ch 456. 12 At oral argument, The Oregonian appeared to concede that, if the requested record indicated that the claimants were patients, HIPPA’s protections would be invoked. However, although The Oregonian asserts that the disposi- tive issue is whether the requested record contains protected health information under HIPAA, it also has generally adopted the Court of Appeals’ conclusion that, even if the requested record contains protected health information under HIPAA, its disclosure is not prohibited because of HIPAA’s “required by law” exemption, 45 CFR § 164.512(a)(1). 80 OHSU v. Oregonian Publishing Co., LLC

the Court of Appeals incorrectly determined that the tort claim notices themselves were the public records at issue instead of the requested record—a list that The Oregonian argues is a different public record. The Oregonian argues that its instructions to OHSU were to make sufficient redac- tions from the tort claim notices such that the requested record would not contain protected health information. According to The Oregonian, providing claimant names, attorney names, and dates of alleged torts would not iden- tify any claimant as a patient or disclose any health infor- mation that could implicate HIPAA’s protections. As we now explain, we conclude that, in combination, the requested record contained identifiers—including claim- ant and attorney names, and dates of the alleged torts—that constitute protected health information under HIPAA that cannot be disclosed unless an exemption applies. Although an exemption exists under HIPAA for disclosures “required by law,” disclosure of the protected health information at issue here is not required under ORS 192.420(1), the provi- sion on which The Oregonian relies, because the unautho- rized disclosure of protected health information is restricted by ORS 192.558(1). Therefore, protected health information is exempt from disclosure under ORS 192.502(9)(a). It fol- lows that OHSU is not required to disclose claimant names, attorney names, and dates of the alleged torts for patient claims. 1. Is the information at issue protected health information? We begin our analysis with the question whether the information at issue constitutes protected health infor- mation under HIPAA. Congress enacted HIPAA to “improve the efficiency and effectiveness of the health care system by facilitating the electronic exchange of information with respect to financial and administrative transactions car- ried out by health plans, health care clearinghouses, and health care providers.” Standards for Privacy of Individually Identifiable Health Information, 67 Fed Reg 14776-01, 14776 (Mar 27, 2002). In addition, HIPAA protects the pri- vacy and confidentiality of health information. See 42 USC § 1320d-2. To advance those protections, Congress directed Cite as 362 Or 68 (2017) 81

the Secretary of Health and Human Services to establish regulations for implementing each of the standards adopted by HIPAA. 42 USC § 1320d-1(d). The regulations that the Secretary adopted relating to the electronic exchange of health information and providing for the security and confi- dentiality of those exchanges are known as the Privacy Rule. See 45 CFR Parts 160 and 164. While HIPAA established that disclosure of a person’s health information is a federal offense, 42 USC § 1320d-6, the Privacy Rule described the specific circumstances under which disclosure is permitted and prohibited. The Privacy Rule is animated by three major purposes: “(1) To protect and enhance the rights of consumers by providing them access to their health information and controlling the inappropriate use of that information; (2) to improve the quality of health care in the U.S. by restoring trust in the health care system among con- sumers, health care professionals, and the multitude of organizations and individuals committed to the delivery of care; and (3) to improve the efficiency and effectiveness of health care delivery by creating a national framework for health privacy protection that builds on efforts by states, health systems, and individual organizations and individuals.” Standards for Privacy of Individually Identifiable Health Information, 65 Fed Reg 82462-01, 82463 (Dec 28, 2000). In recognition that state laws concerning the confidentiality and privacy of health information are not uniform or con- sistent, the Privacy Rule established “a set of basic national privacy standards” to provide “all Americans with a basic level of protection.” Id. at 82464. The Privacy Rule sets a ground floor of rules for health care providers, creating “a framework of protection that can be strengthened by both the federal government and by states as health information systems continue to evolve.” Id. Under HIPAA and the Privacy Rule, “protected health information” is “individually identifiable health infor- mation” that is transmitted or maintained in any form or medium. 45 CFR § 160.103. “Individually identifiable health 82 OHSU v. Oregonian Publishing Co., LLC

information” is health information, including demographic information, that: “(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and “(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and “(i) That identifies the individual; or “(ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.” Id. A covered entity may determine that health informa- tion is not individually identifiable health information if the name, address, all elements of dates, and certain other identifiers relating to an individual are removed. 45 CFR § 164.514(b)(2)(i). In light of those provisions, we conclude that the requested record contains “protected health information” under HIPAA and the Privacy Rule.13 In the absence of a patient’s written authorization or a permissible purpose, the disclosure of a patient’s name or the fact that she received health services is prohibited under HIPAA and the Privacy Rule. Breach Notification for Unsecured Protected Health Information, 74 Fed Reg 42740-01, 42745 (Aug 24, 2009). For such protected health information to lose HIPAA con- fidentiality protections, HIPAA provides that 19 separate identifiers must all be removed, including the very informa- tion requested by The Oregonian here: patient names, all elements of dates, and any other information that could be used alone or in combination with other information to iden- tify an individual as a patient. 45 CFR § 164.514(b)(2)(i).14 13 As noted, the definition of “individually identifiable health information” is part of the definition of “protected health information.” For ease of reference, and because “protected health information” is “individually identifiable health information” that is transmitted or maintained in any form or medium, we refer to “protected health information” from this point forward. 14 Indeed, under the Privacy Rule, a hospital must inform patients of the pro- tected health information that may be included in a patient directory, including Cite as 362 Or 68 (2017) 83

As noted above, The Oregonian remonstrates that the requested record is a different public record from the tort claim notices themselves and that, under its instruc- tions to OHSU, sufficient information was redacted from the tort claim notices such that the requested record would not contain protected health information. The difficulty with The Oregonian’s position is that, regardless of the form in which the information that it sought was presented, that information was not sufficiently redacted in the requested record to lose its status as protected health information.15 Although The Oregonian instructed OHSU to redact any unrequested information contained in the tort claim notices in producing the requested record, it still would have been a relatively straightforward exercise for it to discern—from the requested information in combination— which of the claimants were health care patients, the fact that they had received treatment, and the dates of their treatment. In short, the patient identifiers would not be suf- ficiently obscured as undifferentiated data in the requested record to satisfy the privacy interests in protected health information with which HIPAA and the Privacy Rule are concerned. Nothing in HIPAA or the Privacy Rule indicates that the creation by redaction of a document that still con- tains such identifiers can somehow alter their status as pro- tected health information. Accordingly, we conclude that the requested record contains protected health information under HIPAA.16 The question remains whether, despite its status as protected health information, ORS 192.420(1) nonetheless the patient’s name, and the persons to whom that information may be disclosed— only clergy members and persons who specifically ask for the patient by name— and provide the patient with the opportunity to prohibit or restrict such disclo- sure. 45 CFR § 164.510(a). 15 The Oregonian has consistently pointed out that it has not sought the tort claim notices themselves. But, as the Court of Appeals observed, “[f]or purposes of this case, the compilation of [the information that The Oregonian seeks] into a different public record does not change the issues that must be resolved.” OHSU, 278 Or App at 194 n 3. 16 Because The Oregonian has not separately analyzed the categories of information that it requested in terms of whether those categories independently qualify as protected health information, it is sufficient for us to conclude that, in combination, the information contained in the requested record constitutes protected health information. 84 OHSU v. Oregonian Publishing Co., LLC

requires the disclosure of that information. Although we ultimately conclude that its disclosure is not required under that statute, we first discuss the parties’ arguments under HIPAA, which will provide a foundation for our discussion of Oregon law. 2. Prohibited disclosure under HIPAA and the “required by law” exception The Privacy Rule defines “disclosure” as “the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.” 45 CFR § 160.103. A “covered entity” is pro- hibited from disclosing protected health information unless an exception applies.17 45 CFR § 164.502(a). Exceptions include disclosure to the patient, disclosure with the patient’s authorization, and disclosure when the protected health information has been “de-identified,” among others. See, e.g., 45 CFR § 164.502(a)(1)(i); 45 CFR § 164.508; 45 CFR § 164.502(d)(2). As discussed, in concluding that disclosure of the disputed information could be required, the Court of Appeals relied on a HIPAA exception that allows a covered entity to “use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.” 45 CFR § 164.512(a)(1). “Required by law” refers to “a mandate contained in law that compels an entity to make a use or disclosure of pro- tected health information and that is enforceable in a court of law” and includes “statutes or regulations that require the production of information.” 45 CFR § 164.103. The question then is whether the OPRL—in par- ticular, ORS 192.420(1), the sole provision on which The Oregonian relies—“requires” disclosure of the protected health information at issue here. As amplified below, we conclude that ORS 192.420(1) does not require disclosure of the protected health information; to the contrary, we con- clude that, in the absence of a law requiring its disclosure, such disclosure is prohibited under Oregon law. To ground 17 The parties agree that OHSU is a covered entity. Cite as 362 Or 68 (2017) 85

our discussion, we briefly explain HIPAA’s relationship to state laws such as ORS 192.420(1) that generally require the inspection of public records. Where a conflict between HIPAA and state law exists, HIPAA’s provisions “shall supersede any contrary provision of State law.” 42 USC § 1320d-7(a). State laws that provide “more stringent” privacy protections than HIPAA affords are not superseded by HIPAA. 45 CFR § 160.203(b). A state law is “contrary” to HIPAA and, thus, superseded by HIPAA, if: “(1) A covered entity or business associate would find it impossible to comply with both the State and Federal requirements; or “(2) The provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of [HIPAA].” 45 CFR § 160.202. As noted, the Privacy Rule permits disclosure of protected health information where such disclosure is required by law. 45 CFR § 164.512(a)(1). The commentary to the Privacy Rule states that many apparent conflicts between HIPAA and other laws will not be true conflicts because of the “required by law” exception. Standards for Privacy of Individually Identifiable Health Information, 65 Fed Reg at 82481-82. As an example of the interaction between HIPAA and other laws requiring disclosure of pro- tected health information, the commentary states that the Freedom of Information Act (FOIA), 5 USC § 552, provides for public disclosure—upon the request of any person—of many types of information possessed by the federal govern- ment, subject to certain exceptions and exemptions. The Privacy Rule commentary states that uses and disclosures of protected health information required by FOIA fall within the “required by law” exception. Standards for Privacy of Individually Identifiable Health Information, 65 Fed Reg at 82482. The commentary further states that, in responding to a FOIA request that includes protected health informa- tion, a federal agency, when appropriate, must apply FOIA’s Exemption 6, which “permits federal agencies to withhold 86 OHSU v. Oregonian Publishing Co., LLC

‘* * * medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.’ ” Id. (quoting 5 USC § 522(b)(6)). The commentary ultimately observes: “We believe that generally a disclo- sure of protected health information, when requested under FOIA, would come within FOIA Exemption 6.” Id. Following the guidance provided in the Privacy Rule commentary, a covered entity responding to a public records request often could comply with both HIPAA and a law requiring disclosure of public records. In particu- lar, under HIPAA’s “required by law” exception, a covered entity might be required by a law such as ORS 192.420(1) to disclose protected health information, thus complying with both laws. However, if an exemption or exception to a law such as ORS 192.420(1) exists, the covered entity must consider that exemption or exception as part of its deter- mination whether disclosure is required by law. See U.S. Dep’t of Health & Human Services, FAQ (Aug 2004), avail- able at https://www.hhs.gov/hipaa/for-professionals/faq/506/ how-does-the-hipaa-rule-relate-to-freedom-of-information- laws/index.html (accessed Oct 10, 2017) (“For example, if a state public records law includes an exemption that affords a state agency discretion not to disclose medical or other information where such disclosure would constitute a clearly unwarranted invasion of personal privacy, the disclosure of such records is not required by the public records law, and therefore is not permissible under § 164.512(a).”). In short, although particular circumstances could require a different outcome, it generally is possible for a cov- ered entity to comply both with HIPAA and a state law such as ORS 192.420(1), after considering any applicable exemp- tions or exceptions from disclosure under such a law. See generally Abbott v. Texas Dept. of Mental Health & Mental Retardation, 212 SW3d 648, 665 (Tex Ct App 2006) (state public records law not superseded, because state agency could comply with both state public records law and Privacy Rule, as Privacy Rule allows disclosure of information at issue under “required by law” exception). Accordingly, we must determine whether Oregon law exempts the protected health information at issue from disclosure under ORS 192.420(1). Cite as 362 Or 68 (2017) 87

3. Exemption from disclosure of protected health infor- mation under Oregon law As noted, a right to inspect public records is the rule in Oregon, unless an exemption applies. See ORS 192.420(1) (“Every person has a right to inspect any public record of a public body in this state, except as otherwise expressly provided by ORS 192.501 to 192.505.”). As we now explain, we conclude that the protected health information at issue is exempt from disclosure under ORS 192.502(9)(a) and that its disclosure therefore is not “required” by ORS 192.420(1). ORS 192.502(9)(a) exempts from disclosure under ORS 192.410 to 192.505 “[p]ublic records or information the disclosure of which is prohibited or restricted or other- wise made confidential or privileged under Oregon law.” ORS 192.553 to 192.581 does just that. It makes “protected health information” confidential. ORS 192.553 provides, in part: “(1) It is the policy of the State of Oregon that an indi- vidual has: “(a) The right to have protected health informa- tion of the individual safeguarded from unlawful use or disclosure[.]” “Protected health information” is defined by ORS 192.556 (11)(a) to mean: “[I]ndividually identifiable health information that is maintained or transmitted in any form of electronic or other medium by a covered entity.” ORS 192.556(8) defines “Individually identifiable health information” as: “any oral or written health information in any form or medium that is: “(a) Created or received by a covered entity * * *; and “(b) Identifiable to an individual, including demo- graphic information that identifies the individual, or for which there is a reasonable basis to believe the information can be used to identify an individual, and that relates to: “(A) The past, present or future physical or mental health or condition of an individual; [or] 88 OHSU v. Oregonian Publishing Co., LLC

“(B) The provision of health care to an individual[.]” Those definitions are substantively comparable to the defi- nitions of “protected health information” and “individu- ally identifiable health information” under HIPAA and the Privacy Rule, and The Oregonian does not contend other- wise.18 Based on our analysis under HIPAA, we therefore conclude that the information at issue here also is “protected health information” for purposes of ORS 192.556(11)(a). ORS 192.558(1) generally permits the disclosure of a person’s protected health information only “in a manner that is consistent with an authorization provided by the indi- vidual or a personal representative of the individual.”19 The OPRL reinforces the prohibition against unauthorized dis- closure of protected health information in ORS 192.558(1) by providing an unconditional exemption for information protected by state law. In particular, ORS 192.502(9)(a) provides that “[p]ublic records or information the disclosure of which is prohibited or restricted or otherwise made con- fidential or privileged under Oregon law,” are exempt from disclosure under the OPRL. The legislative history of ORS 192.553 to ORS 192.558 is consistent with the foregoing analysis.20 Before those provisions were enacted in 2003, Oregon law provided: “[I]t is the policy of the State of Oregon to protect both the rights of an individual to have the medical history of the individual protected from disclosure to persons other

18 In symmetry with HIPAA, ORS 192.553(2) provides that, “[i]n addition to the rights and obligations expressed in ORS 192.553 to 192.581, [HIPAA] establish[es] additional rights and obligations regarding the use and disclosure of protected health information and the rights of indi- viduals regarding the protected health information of the individual.” (Emphases added.) 19 ORS 192.558(2)(a) and (3) contain specific exceptions to the prohibition in ORS 192.558(1) against unauthorized disclosures of protected health infor- mation. Specifically, ORS 192.558(2)(a) allows disclosure “[f]or the provider’s or plan’s own treatment, payment or health care operations.” In addition, ORS 192.558(2)(b) allows disclosure “[a]s otherwise permitted or required by state or federal law or by order of the court.” The Oregonian does not assert that any of those exceptions apply in this instance and therefore we need not address them. 20 ORS 192.553 to 192.558 were enacted by Oregon Laws 2003, chapter 86, sections 1 to 3, and codified as former ORS 192.518 to 192.520 (2003). The stat- utes were renumbered in 2011. Cite as 362 Or 68 (2017) 89

than the health care provider and insurer of the individual who needs such information * * *. It is recognized that both rights may be limited, but only to benefit the patient. These rights of confidentiality and full access must be protected by private and public institutions providing health care services * * *. The State of Oregon commits itself to fulfill- ing the objectives of this public policy for public providers of health care.” Former ORS 192.525(1) (2001), repealed by Or Laws 2003, ch 86, § 8. The proponents of the 2003 legislation were members of an interim legislative committee that had been tasked with reviewing (and revising as appropriate) Oregon privacy laws to ensure their consistency with federal law before the effective date of HIPAA in 2003. The commit- tee members emphasized that the intent of the legislation was to maintain the existing policy of protecting the confi- dentiality of patient medical records set out in former ORS 192.525 (2001), while harmonizing Oregon’s statutory pol- icy and terminology with HIPAA. As Representative Max Williams explained on the House floor: “The HIPAA privacy regulations provide new protection for the use and disclosure of patient health information by health care providers and insurers. They also enact addi- tional patient rights regarding access to information about their health care and their health information. HIPAA regulations are extensive and complex. And they preempt Oregon law to the extent that Oregon law is contrary to the federal law. It is this preemption issue that brings HB 2305 before you today. HB 2305 is the product of the advisory committee on privacy of medical information and records. A committee that was created by the 2001 Legislative Assembly * * *. “It was the goal of the committee to change only those Oregon statutes that must be changed in light of HIPAA and to preserve existing Oregon public policy as much as possible. * * * HB 2305 repeals ORS 192.525 and replaces it with new provisions that reflect existing Oregon policy and the new HIPAA privacy regulations. ORS 192.525 is the core confidentiality statute in Oregon for health care providers. It governs what disclosure providers can make of health information. Unfortunately, HIPAA contradicts the current ORS 192.525. The Oregon law uses terms that do not make sense after the enactment of HIPAA and contains 90 OHSU v. Oregonian Publishing Co., LLC

an authorization form that does not comply with specific HIPAA authorization requirements. Because of these prob- lems, the committee concluded that ORS 192.525 should be repealed. However, to avoid a vacuum in Oregon medical confidentiality law, the committee recommended replace- ment of 192.525 with a new provision intended to serve much the same purpose as the original statute but in con- formity with HIPAA. The new statute draws on an existing policy and the HIPAA privacy regulations to create a new core patient confidentiality law in Oregon.” Audio Recording, House Chamber, HB 2305, Mar 17, 2003, at 27:42 (statement of Rep Max Williams), https:// www.oregonlegislature.gov/citizen_engagement /Pages/ Legislative-Video.aspx (accessed Oct 10, 2017). Other statements made by interim committee mem- bers reinforced Representative Williams’ comments, includ- ing those of former Senator Neil Bryant: “The [interim committee] focused on the privacy aspects of HIPAA. As many of you know, Oregon has a long his- tory of protecting privacy and personal information, but we wanted to ensure that Oregon law would not conflict or be preempted by federal law and the HIPAA rules.” Testimony, House Judiciary Committee, HB 2305, Feb 18, 2003, Ex A (statement of former Sen Neil Bryant).21 21 Gwen Dayton, an interim committee member, similarly commented: “Essentially when we looked for HIPAA preemption, we looked for Oregon laws that implicated the release of protected health information in a way that was * * * contrary to HIPAA, meaning that providers and other entities cov- ered by HIPAA would not be able to comply with both state law and federal law or state law posed a substantial barrier or obstacle to effective implemen- tation of HIPAA. * * * “The guts of ORS 192.525 is really sub-one, which is a policy statement about confidentiality of medical records in Oregon. And that section is not completely preempted, but rather it uses terms that are inconsistent with HIPAA, that are confusing after implementation of HIPAA, that simply just don’t make a lot of sense. And there are certain provisions that are flat out contrary to HIPAA. As you go through the rest of 192.525, you have similar problems. Confusing use of terminology. The model authorization form that is contained in the existing statute simply does not comply with HIPAA. * * * There are other sub-sections of the statute that are preempted because they refer to this inappropriate authorization form. Others have problems simply because of the continuing confusing use of terms that just don’t make a lot of sense. “So those of us who looked at this statute felt that there was enough of it that could not be saved that a more effective way of dealing with it Cite as 362 Or 68 (2017) 91

Considering that ORS 192.502(9) exempted infor- mation protected as confidential under state law from dis- closure under the OPRL before the enactment of the 2003 legislation, it is likely that HB 2305—with its stated intent to maintain the confidentiality of protected health informa- tion with the additional protections of HIPAA—retained the confidentiality protections for such information that exempt it from the disclosure requirement set out in ORS 192.420(1). In sum, we conclude that ORS 192.556(11)(a) des- ignates the information at issue here as protected health information, and, subject to certain exceptions that do not apply here, ORS 192.558(1) prohibits its disclosure with- out a patient’s written authorization. ORS 192.502(9)(a), in turn, exempts that information from disclosure under ORS 192.420(1) because its disclosure is restricted by ORS 192.558(1).22 D. Student Claims We briefly turn to the claims filed by students. As noted, OHSU declined to disclose the names of student claimants in tort claim notices related to their education,

would be to simply repeal it and rewrite it. We want to maintain the effect of 192.525. We don’t want to leave a vacuum in Oregon law, but we want to replace it with something that does what 192.525 did but also implements HIPAA at the same time. * * * [W]e considered many options in replacing 192.525. Some states have actually rewritten HIPAA into state law—hook, line, and sinker. We considered that and decided against it because we were concerned that if we didn’t get every comma correct—every word correct— there would be an implied difference and we would be setting ourselves up for endless litigation about what we were trying to do in Oregon versus what the feds were doing.” Audio Recording, House Judiciary Committee, HB 2305, Feb 18, 2003, at 17:12 (statement of Gwen Dayton), https://www.oregonlegislature.gov/citizen_ engagement/Pages/Legislative-Video.aspx (accessed Oct 10, 2017). 22 In so concluding, we need not consider whether, in different circumstances, a provision of law other than ORS 192.420(1) could require the disclosure of protected health information. Further, in light of our resolution of the patient records issue, we also need not consider the additional arguments of the parties— and amicus curiae, the State of Oregon, through the attorney general’s— regarding the patient claims, including whether the information at issue is exempt from disclosure under ORS 192.502(2) or ORS 192.496(1), and whether the Court of Appeals erred by holding that ORS 192.505 does not apply to ORS 192.496(1); that ORS 192.505 applies only to exemptions that classify informa- tion within a record as exempt, rather than to exemptions that classify an entire record as exempt; and that ORS 192.496(1) is an exemption to the disclosure requirements of the OPRL. 92 OHSU v. Oregonian Publishing Co., LLC

asserting that disclosure of that information was prohib- ited under FERPA and state law. The Oregonian, however, argues that the requested record would not identify any claimant as a student or disclose any student education records that would implicate FERPA. The Oregonian also asserts, albeit with scant citation to authority, that a tort claim notice is not an “education record” and that its dis- closure is not prohibited in this case because the requested information is not maintained or located in a place that is a repository of education records. Accordingly, The Oregonian argues that the exemption under ORS 192.502(8) for disclo- sure prohibited by federal law does not apply. OHSU counters that disclosure of a student’s name, particularly in the context of a tort claim notice, would con- vey significant information about the student: namely, that the student has claimed a compensable injury related to their education. That information, OHSU argues, is protected by FERPA’s prohibition against disclosing private records directly related to a student. Moreover, OHSU asserts, FERPA does not prescribe any specific location within an institution where a record must be maintained for it to be deemed an “education record.” Although, on the surface, the parties’ arguments would appear to present significant issues under FERPA, we conclude that those arguments are not sufficiently devel- oped for this court to make an informed decision. In par- ticular, although The Oregonian asserts that disclosure of education records is not prohibited by FERPA, it has not analyzed the issue in any detail.23 Nor has The Oregonian meaningfully addressed FERPA’s definition of “education records.” Overall, both parties’ arguments about the stu- dent records are cursory, consisting of a combined total of only six paragraphs in more than 80 pages of briefing. In short, in the absence of adequately developed arguments, we decline to consider whether the tort claim notices filed by students are “education records” under FERPA and pro- hibited from disclosure. We therefore leave undisturbed the 23 A brief review discloses that “state and federal courts are sharply divided on this issue.” See Caledonian-Record Publ’g Co. v. Vt. State Coll., 175 Vt 438, 441-42, 833 A2d 1273, 1275-76 (2003) (citing cases). The parties have failed to discuss those authorities. Cite as 362 Or 68 (2017) 93

Court of Appeals’ disposition of that issue which, to reiter- ate, was to remand it to the circuit court to examine the tort claim notices involving students to determine whether they described and directly related to activities of a student or the educational status of a student. OHSU, 278 Or App at 210-11. III. CONCLUSION To summarize: The Oregonian’s public records request sought information derived from tort claim notices received by OHSU. For patient claims, the requested record contained identifiers—including claimant and attorney names, and dates of the alleged torts—that, in combination, constitute protected health information under HIPAA that cannot be disclosed unless an exemption applies. An exemp- tion exists under HIPAA for disclosures “required by law.” However, disclosure of the protected health information at issue in this case is not required under ORS 192.420(1), the provision on which The Oregonian relies, because ORS 192.558(1) restricts its unauthorized disclosure. Therefore, it is exempt under ORS 192.502(9)(a) from disclosure pursu- ant to ORS 192.420(1). It follows that OHSU is not required to disclose claimant names, attorney names, and dates of the alleged torts for patient claims. With respect to the student claims, the parties have not adequately developed their arguments concern- ing whether the tort claim notices are “education records” under FERPA, and, if they are, whether FERPA prohibits disclosure of the claimants’ names. Accordingly, we decline to address that issue. The decision of the Court of Appeals is reversed in part and affirmed in part. The judgment of the circuit court and the supplemental judgment awarding attorney fees and costs to The Oregonian are reversed, and the case is remanded to the circuit court for further proceedings.