Amanda Martin
Continuing on the theme of government transparency and how you get the information you need to cover the developing COVID-19 crisis, I have outlined here some principles to remember. I’ve also attached a sample letter you can use to make your requests. Of course, every situation is different and dependent on your relationship with public agencies and officials, so tailor the letter to your circumstances.
- Generally speaking, the Public Records Law gives you a right to demand access to records, not to demand answers to questions. Of course, it is fine (and, frankly, only natural) for you to start with a question. But if you do not get the information you need, identify the document that contains the answer to your question, and ask for that.
- The definition of a public record is key: any document made or received by a public agency in connection with the transaction of public business. G.S. § 132-1(a). Don’t forget that public agencies receive documents every day that otherwise wouldn’t be public but become public once they are received.
- The fact that a document has confidential information commingled with non-confidential doesn’t matter. The public agency must remove the confidential information and release the non-confidential, and the agency must pay that cost. N.C. Gen. Stat. § 132-6(c). This is particularly important now, because documents and databases may have both public and confidential information together.
- If a public agency withholds documents, ask their legal basis for doing so. They must answer you with numbers, not words. What I mean by that is they must provide you with a statutory or regulatory citation (like G.S. § 130A-143), not with an answer like “privacy of the patient” or “that’s confidential.” You can only evaluate the agency’s position if you know the precise statute they claim.
- If you are not asking for patient-specific information, HIPAA and state medical confidentiality statutes don’t apply.
- HIPAA also doesn’t apply unless you are asking a “covered entity” -- health plans, health care clearinghouses, and health care providers. The hardest call under HIPAA may be an emergency response team. A 911 call that results in a dispatch to a fire doesn’t trigger HIPAA, but a call that results in EMS dispatch might. Also, North Carolina has a very specific statute that exempts “medical records compiled and maintained” related to EMS programs. G.S. § 143-518. The statute doesn’t define “medical records,” but whatever they are, they are confidential.
- Remember that release of de-identified information or aggregated data does not violate either HIPAA or state law.
- Push back on anyone who tells you that HIPAA trumps state law. Our Court of Appeals has held that if federal law allows disclosure, state law requires it. DTH Media Corp. v. Folt, 259 N.C. App. 61, 71, 816 S.E.2d 518, 525 (2018) (emphasis supplied).
BOTTOM LINE: The two keys are (1) be prepared to identify what documents contain the information you need and (2) demand either those documents or a valid statutory exemption.
Download this
sample letter and make it your own. Revise it to ask for the information you need; remove the legal-y language, if you prefer; and edit to match the formality/informality of your relationship with your local public officials.
For more discussion of these issues and for North Carolina and CDC data on COVID-19, see the resources below.
From the Reporters Committee for Freedom of the Press
From UNC School of Government
Using & Disclosing Protected Health Information (PHI)
CDC
NCDHHS
Email us with feedback, questions, or topics that interest you:
First@smvt.com
If you know someone interested in information like this, please forward this email so they can sign up by emailing
First@smvt.com with “subscribe” in the subject line. We hope this blog will give you helpful information in digestible-sized updates. But if you ever want to stop getting FFR updates, just unsubscribe below.
@ncmedialaw
Direct Telephone: 919-755-0889
SMVT telephone: 919-582-2300
SMVT toll-free facsimile: 866-593-7695
