OHSU v. Oregonian Publishing Co., LLC
S064249
| Or. | Oct 19, 2017Background
- The Oregonian requested a spreadsheet of tort claim notices from OHSU listing claim number, claimant name, claimant attorney, date of alleged tort, date of notice, and open/closed status (five-year period); it did not request the full notice texts.
- OHSU withheld claimant names, attorney names, and dates for patient-related claims (and student claimant names for student-related claims), citing HIPAA, Oregon statutes protecting health information, and FERPA.
- The Multnomah County district attorney ordered disclosure; OHSU sued in circuit court for a declaratory judgment that the withheld data were exempt. The circuit court ordered disclosure and awarded fees to The Oregonian.
- On appeal the Court of Appeals remanded for in-camera review of the tort notices to determine applicability of ORS 192.496(1) (medical privacy) and FERPA to student claims, and assumed for HIPAA analysis that the requested fields might be PHI.
- The Oregon Supreme Court held that the spreadsheet fields (claimant/attorney names and dates) for patient claims, in combination, are "protected health information" under HIPAA and under Oregon’s definition, and that Oregon law (ORS 192.558(1) and ORS 192.502(9)(a)) exempts that information from disclosure under ORS 192.420(1).
- The Court declined to resolve the FERPA/student-records issue because the parties’ briefs did not adequately develop that question; it remanded the student-claim issue for further proceedings and reversed the circuit court judgment and fee award.
Issues
| Issue | OHSU (Plaintiff) Argument | The Oregonian (Defendant) Argument | Held |
|---|---|---|---|
| Whether the requested claimant/attorney names and dates are "protected health information" (PHI) under HIPAA/Oregon law | These identifiers, in combination with other available info, identify patients and therefore qualify as PHI and are protected | The requested fields do not reveal health information or identify patients; the spreadsheet is a different record and could be produced without PHI | Held: In combination the fields constitute PHI under HIPAA and Oregon law |
| Whether HIPAA’s "required by law" exception means ORS 192.420(1) compels disclosure of PHI | OHSU: Even if HIPAA allows disclosures required by law, Oregon law (ORS 192.558(1)) restricts unauthorized disclosure of PHI so ORS 192.420(1) does not "require" disclosure | The Oregonian: ORS 192.420(1) requires disclosure; HIPAA’s exception therefore permits release | Held: ORS 192.420(1) does not require disclosure because Oregon law makes PHI confidential (ORS 192.558(1)), so HIPAA’s "required by law" exception does not authorize release here |
| Whether PHI protected under state law is exempt from the Oregon Public Records Law | OHSU: ORS 192.553–192.558 make PHI confidential; ORS 192.502(9)(a) therefore exempts PHI from ORS 192.420(1) | The Oregonian did not press state-law exemptions in depth | Held: PHI is confidential under ORS 192.553–192.558 and exempt under ORS 192.502(9)(a) |
| Whether student tort-claim notices are "education records" under FERPA and thus exempt | OHSU: Student tort notices relate directly to students and are education records; FERPA bars disclosure | The Oregonian: The requested spreadsheet wouldn’t reveal educational records or identify students as students; tort notices are not necessarily education records | Held: Court declined to decide due to inadequate briefing and left the Court of Appeals’ remand in place for circuit-court fact review |
Key Cases Cited
- Guard Publishing Co. v. Lane County School Dist. No. 4J, 310 Or 32 (narrow construction of public-records exemptions)
- Double Eagle Golf, Inc. v. City of Portland, 322 Or 604 (summary judgment standard; facts viewed in light most favorable to nonmoving party)
- Abbott v. Texas Dept. of Mental Health & Mental Retardation, 212 S.W.3d 648 (example that state public-records law can coexist with HIPAA's "required by law" exception)
- OHSU v. Oregonian Publishing Co., LLC, 278 Or App 189 (Court of Appeals opinion remanding for examination of records under ORS 192.496(1) and FERPA)