Plaintiff Oregon Health and Science University (OHSU) is a health and research public university that provides patient care at its hospital. OHSU appeals the trial court’s judgment enjoining it from withholding particular information contained in public records that defendant Oregonian Publishing Company, LLC (The Oregonian) requested under the Oregon Public Records Law (OPRL), ORS 192.410 - 192.505. OHSU contends that the information is exempt from disclosure under the OPRL and that the court erred in compelling its disclosure. As explained below, we conclude that some of the requested information may be exempt from public disclosure if it is contained in a document described in ORS 192.496(1). That subsection exempts from disclosure records that “contain information about the physical or mental health or psychiatric care or treatment of a living individual.” Because the requested public records were not part of the record before the trial court, we cannot determine if any of those records and the information in those records are exempt from disclosure under ORS 192.496(1). We also conclude that the record is insufficient to determine whether one of the relevant records is an “education record” under the Family Educational Rights and Privacy Act (FERPA), 20 USC § 1232g, and therefore exempt from disclosure under ORS 192.502(8). Accordingly, we remand the case to the trial court to consider the application of ORS 192.496(1) and ORS 192.502(8) to the requested public records. Otherwise, we conclude that disclosure of the requested information in the tort claim notices that are the subject of this appeal is not precluded by state or federal law. Accordingly, we reverse and remand the judgment ordering disclosure and the supplemental judgment awarding The Oregonian its attorney fees.
I. BACKGROUND
The Oregon Tort Claims Act, ORS 30.260 - 30.300, limits the tort liability of public bodies of the state, including OHSU, and regulates the manner in which those claims are prosecuted. ORS 30.275(1) provides that no tort claim “shall be maintained unless notice of claim is given as required by
“Formal notice of claim is a written communication from a claimant or representative of a claimant containing:
“(a) A statement that a claim for damages is or will be asserted against the public body or an officer, employee or agent of the public body;
“(b) A description of the time, place and circumstances giving rise to the claim, so far as known to the claimant; and
“(c) The name of the claimant and the mailing address to which correspondence concerning the claim may be sent.”
The Oregonian publishes a newspaper of that name that is of general circulation within Oregon. In 2011, through a reporter, The Oregonian requested that OHSU provide it information from tort claim notices given to OHSU. Specifically,
“[u]nder Oregon Public Records Law, I am requesting a list of tort claims filed against Oregon Health & Science University and its affiliated entities, preferably in spreadsheet form, with information dating back to Jan 1, 2006 and including only the following types of information or data fields: claim number, claimant full name, attorney full name, date of alleged tort, date of tort claim notice, and whether it is closed or open.”
It further noted:
“I am not requesting any information generated in the course of medical treatment. I am not requesting health information of any kind. *** This is tort information, not health information, and it is submitted by individuals voluntarily, outside the course of medical treatment, to a public institution and in a venue—torts against public institutions—that is well recognized to be public information.”
OHSU had received eight tort claim notices during the period of the request. It compiled a document that listed the type of claim asserted in each notice and then either purported to disclose the requested information about that tort claim notice or cited statutory provisions that excused the
In the document, OHSU proposed to disclose all of the information with respect to the “other general liability” claim, but withheld the names of the claimants for all of the remaining claims. It also withheld the dates of the alleged torts and names of the claimants’ attorneys for some of those claims. The document cited one or more of various parts of the OPRL, ORS 353.260, the Health Insurance Portability and Accountability Act Privacy Rule, 45 CFR parts 160 and 164 (Privacy Rule),
Pursuant to ORS 192.450 and ORS 192.460,
OHSU then instituted proceedings for declaratory relief in the circuit court, seeking a determination that the information withheld is exempt from disclosure under the OPRL.
OHSU raises three arguments on appeal. First, as to claims by patients, OHSU contends that the names of claimants, their attorneys, and the dates of the alleged torts in the four tort claims notices from patients are exempt from disclosure under the statutory exemptions for records containing “information about the physical or mental health
As to the two employment-related claims, OHSU asserts that the names of the claimants are exempt from disclosure under ORS 192.502(2) as “[information of a personal nature.” Moreover, OHSU argues, the employment tort claim notice related to a faculty member is a confidential personnel record under OHSU rules authorized by ORS 353.260(1) and is not a public record that must be disclosed under ORS 353.260(6). With respect to claims involving a student, OHSU contends that the name of the claimant is part of the student’s “education records” and confidential under FERPA and, thus, exempt from disclosure under ORS 192.502(8).
Finally, OHSU maintains that if, on review or remand, the court modifies the judgment ordering disclosure, then an award of attorney fees is discretionary, ORS 192.490(3), and the supplemental judgment on fees should be reevaluated for a determination of whether to award fees.
II. OREGON PUBLIC RECORDS LAW
Under ORS 192.420(1), “Every person has a right to inspect any public record of a public body in this state, except as otherwise expressly provided by ORS 192.501 to 192.505.” ORS 192.420(1) creates a “statutory presumption that documents will be disclosed to the public.” City of Portland v. Oregonian Publishing Co., 200 Or App 120, 124, 112 P3d 457 (2005).
A public body that withholds records as exempt from disclosure has the initial burden in a review proceeding of showing that a claimed exemption applies. ORS 192.490(1) (“[T]he burden is on the public body to sustain its action.”); see Mail Tribune, Inc. v. Winters, 236 Or App 91, 95, 237 P3d 831 (2010). “To satisfy that burden, a public body must establish exemptions from disclosure ‘on an individualized basis.’ ” Mail Tribune, Inc., 236 Or App at 95 (quoting Guard Publishing Co., 310 Or at 39). In establishing whether an exemption applies, a public body may conclude that the individual requesting disclosure has not met the showing required by the text of the statutory exemption. See, e.g., ORS 192.496(1) (establishing exemption for medical records “if the public disclosure thereof would constitute an unreasonable invasion of privacy” but providing that the requestor has “the burden of showing by clear and convincing evidence that the public interest requires disclosure in the particular instance and that public disclosure would not constitute an unreasonable invasion of privacy”).
III. PATIENT INFORMATION
OHSU initially asserts that information about the physical care and medical treatment of an identified person that is contained in a patient tort claim notice (including
“The following public records are exempt from disclosure:
“(1) Records less than 75 years old which contain information about the physical or mental health or psychiatric care or treatment of a living individual, if the public disclosure thereof would constitute an unreasonable invasion of privacy. The party seeking disclosure shall have the burden of showing by clear and convincing evidence that the public interest requires disclosure in the particular instance and that public disclosure would not constitute an unreasonable invasion of privacy.”
Second, OHSU contends that the nondisclosed information from patient tort claim notices is exempt from disclosure under ORS 192.502(2), which exempts the following records from disclosure:
“Information of a personal nature such as but not limited to that kept in a personal, medical or similar file, if public disclosure would constitute an unreasonable invasion of privacy, unless the public interest by clear and convincing evidence requires disclosure in the particular instance. The party seeking disclosure shall have the burden of showing that public disclosure would not constitute an unreasonable invasion of privacy.”
In OHSU’s view, direct or indirect patient identification information in a tort claim notice, including the name of the patient, date of the tort, and name of the patient’s attorney, is “information about the physical or mental health or psychiatric care or treatment of a living individual” and “[ijnformation of a personal nature,” the disclosure of which would be an unreasonable invasion of privacy without any clear public interest in favor of disclosure. More specifically, OHSU suggests that any disclosure of individually identifiable health information is an unreasonable invasion of privacy under either statutory exemption because: (1) that type of information is given special protection limiting
Additionally, OHSU argues that, because the information is “protected health information” and is confidential under the Privacy Rule, it is exempt from disclosure under ORS 192.502(8) (exempting from disclosure “[a]ny public records or information the disclosure of which is prohibited by federal law or regulations”). According to OHSU, HIPPA protected information is exempt from disclosure under ORS 192.502(8) independent of the question whether that disclosure would be unreasonable or in the public interest.
The Oregonian responds that it did not seek the disclosure of “information about the physical or mental health or psychiatric care or treatment of a living individual” under ORS 192.496(1), nor did it seek “[information of a personal nature” under ORS 192.502(2). Rather, it sought the claimant names, tort dates, and attorney names in tort claim notices filed during a particular period. Moreover, with respect to ORS 192.496(1), The Oregonian asserts that
“ [d] efendant does not seek any ‘information about the physical or mental health or psychiatric care or treatment’ of any person. ORS 192.505 requires a public body to segregate nonexempt material from any exempt material within a record. That a given document might otherwise ‘contain’ medical information within it does not exempt all information in that document from disclosure. ORS 192.496 does not provide a basis for exemption of the information defendant seeks, the names of persons who have filed tort claim notices.”
In all events, according to The Oregonian, the information in the patient tort claim notices is not private (primarily because it is disclosed in a legal demand intended for use in litigation that might be filed), nor is there a right of confidentiality about that information under state or federal law. Finally, The Oregonian argues that, without showing what particular health or personal information was part of the tort claim notices, OHSU has not met its burden to make a “sufficient showing of justification” to prove that an exemption applies on an “individualized basis” under Guard Publishing Co., 310 Or at 39.
As noted, OHSU submits that, because the information sought by The Oregonian from the patient tort claim notices is protected health information under the Privacy Rule, it is exempt from disclosure under ORS 192.502(8). In relevant part, the Privacy Rule prohibits a “covered entity”
“Individually identifiable health information is information * * * [that includes] demographic information collected from an individual, and:
“(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
“(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
“(i) That identifies the individual; or
“(ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.”
45 CFR § 160.103 (emphasis in original); see also 42 USC § 1320d(6). In a provision related to procedures for notifying patients of data breaches, the Privacy Rule lists examples of types of protected health information, which include a patient’s “full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information.” 45 CFR § 164.404(c)(1)(b).
The Privacy Rule, however, allows disclosure of protected information when that disclosure is “required by law.” 45 CFR § 164.512(a)(1). The Oregonian argues that disclosure of the public records containing the requested information is “required” by ORS 192.420(1), which confers a “right to inspect any public record of a public body in this state, except as otherwise expressly provided by ORS 192.501 to 192.505,” and that no exemption from disclosure under state law mitigates that requirement. OHSU counters that the Privacy Rule prohibits the disclosure of protected health information so that disclosure of that information is inhibited (and not “required”) by ORS 192.502(8) (exempting from disclosure “[a]ny public records or information the disclosure of which is prohibited by federal law or regulations”). OHSU also contends that the definition of “required by law” at 45 CFR section 164.103 does not contemplate the disclosure of protected health information under a public records law.
45 CFR section 164.103 provides:
“Required by law means a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes*202 or regulations that require such information if payment is sought under a government program providing public benefits.”
(Emphases in original.) In OHSU’s view, a public records law is not like those required disclosures and, therefore, would not fit the exception.
We conclude that, if the information is not otherwise exempt from disclosure under the OPRL, its disclosure is “required by” ORS 192.420 and, accordingly, allowed by 45 CFR section 164.512(a)(1). That disclosure requirement is the plain meaning of the “right to inspect” conferred by ORS 192.420 and its companion policy in ORS 192.440(1) that the “custodian of any public record that a person has a right to inspect shall give the person, upon request” either “[a] copy of the public record” or “[a] reasonable opportunity to inspect or copy the public record.” Under 45 CFR section 164.103, the statutory disclosure requirements are “mandate [s] contained in law that compel [] an entity to make a * * * disclosure” that are “enforceable in a court of law” under ORS 192.490 (court authority in reviewing action denying right to inspect public records).
If disclosure of protected health information is allowed by 45 CFR section 164.512(a)(1) because it is otherwise “required by” ORS 192.420, then that disclosure is not “prohibited by federal law” under ORS 192.502(8). We reject OHSU’s assertion that “federal law” refers only to the disclosure limitations in the Privacy Rule and does not include the disclosure allowances in that same rule. The obvious meaning of “federal law” is the entire law; the entire operation of the Privacy Rule excuses the nondisclosure limitation in 45 CFR section 164.502(a) if the disclosure is “required by” an enforceable state law under 45 CFR section 164.512(a)(1). Put another way, whether any protected health information in the patient tort claim notices must be disclosed under the Privacy Rule and the OPRL depends entirely on whether an exemption from disclosure exists under ORS 192.496(1) and ORS 192.502(2).
As noted, ORS 192.496(1) exempts from disclosure
“ [r] ecords less than 75 years old which contain information about the physical or mental health or psychiatric care or treatment of a living individual, if the public disclosure thereof would constitute an unreasonable invasion of privacy. The party seeking disclosure shall have the burden of showing by clear and convincing evidence that the public interest requires disclosure in the particular instance and that public disclosure would not constitute an unreasonable invasion of privacy.”
The issue framed by the parties, in the summary judgment proceedings and on appeal, assumed that the patient tort claim notices fit the definition of exempt medical records under ORS 192.496(1). That is to say, because a tort claim notice is required to disclose the “circumstances giving rise to the claim,” ORS 30.275(4)(b), a medical treatment tort claim notice necessarily would describe “the physical or mental health or psychiatric care or treatment” of the claimant and the notice might then qualify as a nondisclosable record under ORS 192.496(1).
Assuming that the patient tort claim notices qualified as exempt records under ORS 192.496(1), the parties framed the question to be whether certain information in those potentially exempt records (name of the patient, date of the tort, name of the patient’s attorney) must be disclosed under ORS 192.505. That statute requires:
“If any public record contains material which is not exempt under ORS 192.501 and 192.502, as well as material which is exempt from disclosure, the public body shall separate the exempt and nonexempt material and make the nonexempt material available for examination.”
In light of the issue framed by the parties, the trial court concluded that the name of the patient, date of the tort, and name of the patient’s attorney in a patient tort claim notice
However, the parties led the court down the wrong path. ORS 192.496 describes four types of records that are entirely exempt from disclosure: medical records, sealed records, custodial records, and student records. ORS 192.496(1) exempts from disclosure all—and any part of—a medical record that qualifies under the statute. In order to properly apply ORS 192.496(1), under the plain meaning of its text, a court must evaluate whether the record contains “information about the physical or mental health or psychiatric care or treatment of a living individual.” If it does, then the court must determine whether the disclosure of that health, care, or treatment information “would not constitute an unreasonable invasion of privacy” and is otherwise in “the public interest.” If the medical record qualifies, and disclosure of the record with that information is not otherwise warranted, then the record, in whole or in part, is exempt from disclosure. The trial court did not conduct that evaluation in this case.
Instead of determining whether the entire record was exempt from disclosure, the court applied ORS 192.505, concluded that the patient tort claim notices contained “material which is not exempt under ORS 192.501 and 192.502 [claimant name, the name of the claimant’s attorney, and the date of the tort], as well as material which is exempt from disclosure,” and ordered OHSU to make that “nonexempt material available for examination.”
In doing so, the reviewing court misconstrued ORS 192.505, which does not apply to a medical record that otherwise qualifies as exempt from disclosure under ORS 192.496(1). On its face, ORS 192.505 applies only to records that contain material that is nonexempt and material that is exempt from disclosure “under ORS 192.501 and 192.502.” The medical records in question contain material that might be exempt from disclosure under a different statute, ORS 192.496(1).
“[a]s will later prove important, each of the exemptions in ORS 192.502 is worded slightly differently. Some of the exemptions describe particular types of documents and categorically exempt those documents from disclosure. E.g., ORS 192.520(32) (exempting county election security plans); *** ORS 192.502(7), (15) (exempting certain ‘reports’). Other exemptions, however, are phrased in terms of particular types of data or information within public records. E.g., ORS 192.502(3) (‘Public body employee or volunteer addresses, Social Security numbers, dates of birth and telephone numbers contained in personnel records maintained by the public body that is the employer or the recipient of volunteer services.’). Thus, although the definition of ‘public records’—and, by incorporation, the exemptions * * *—are phrased in terms of whether a writing ‘contains’ information related to public business, the specific exemptions themselves may apply to a writing in whole or in part.”
267 Or App at 563-64. We concluded that ORS 192.505, requiring separation of exempt and nonexempt material in the provision of public records, applies only to the exemptions
In light of the reasoning in Brown, we conclude that the reviewing court erred in applying ORS 192.496(1) to classify information within a patient tort claim notice as subject to disclosure under ORS 192.505. Instead, application of ORS 192.496(1) necessarily requires examination of the actual “information about the physical or mental health or psychiatric care or treatment of a living individual” that is contained in the public record to determine whether the exemption applies, and then consideration of whether “the public disclosure thereof would constitute an unreasonable invasion of privacy.” Thus, the court erred in granting The Oregonian’s motion for summary judgment on the patient health information without a sufficient record to determine the application of ORS 192.496(1) to public records containing that information. See ORS 192.490(1) (in a public records review proceeding, the “court, on its own motion, may view the documents in controversy in camera before reaching a decision”)
IV. EMPLOYMENT-RELATED TORT CLAIMS
The reviewing court ordered disclosure of the name of the claimant in the two tort claim notices pertaining to employment liability. One of the claims was from a faculty member; the other was not. OHSU disclosed the date
“[information of a personal nature such as but not limited to that kept in a personal, medical or similar file, if public disclosure would constitute an unreasonable invasion of privacy, unless the public interest by clear and convincing evidence requires disclosure in the particular instance. The party seeking disclosure shall have the burden of showing that public disclosure would not constitute an unreasonable invasion of privacy.”
In contrast to ORS 192.496, ORS 192.502(2) is framed to exempt “information” instead of “records.” Thus, the issue is whether the name of the claimant can be excluded, under ORS 192.502(2), from the other information disclosed from the record under ORS 192.420. In Mail Tribune, Inc., 236 Or App at 96, we framed the test for an exemption under ORS 192.502(2) as follows:
“The personal privacy exemption may be invoked by a public custodian of records upon evidence that (1) the information is personal in nature and (2) disclosure would unreasonably invade privacy. If the public body produces evidence to satisfy those criteria, the burden shifts to the party seeking disclosure, who must show, by clear and convincing evidence, that the public interest nonetheless demands disclosure.”
Here, OHSU argues that the identity of the nonfaculty employment tort claimant is “[information of a personal nature” because “[disclosure of the employee’s name in that context establishes that the identified employee asserts that her employment was adversely affected with resulting financial, physical, mental or emotional injury.” OHSU explains that “[t]here are manifest public interests in employment privacy related to the nature of employment claims, which are implicated by disclosure of an employee’s name to a newspaper * ⅜ *.” We conclude that the name of a claimant in a tort claim notice is not “ information of a personal nature” exempt from disclosure under ORS 192.502(2).
“‘Webster’s Third New International Dictionary, at 1686 (Unabridged 1971), defines “personal” as meaning “1: of or relating to a particular person: affecting one individual or each of many individuals: peculiar or proper to private concerns: not public or general *** (personal baggage): *** 6: exclusively for a given individual (a personal letter) **$»>»
Id. at 555 (quoting Jordan, 308 Or at 441 (emphasis in Jordan)). In determining that the information in the disciplinary file was not information of a personal nature, we concluded that
“the records in this case, although relating to a specific individual, also have a bearing on his qualification to serve in a position of public trust. The tension between individually specific information and its reflection on matters of public concern is also present in the dictionary definition of the word ‘personal’ endorsed by the court in Jordan. On the one hand, ‘personal’ means ‘relating’ to a particular person. On the other hand, ‘personal’ means ‘peculiar or proper to private concerns: not public or general.’ Although the disputed records in this case pertain specifically to [the police officer], they do not affect him exclusively and are not peculiar to his private concerns.”
Id. at 556.
Here, while the claimant identification in the tort claim notice does relate to a particular person, it is not
OHSU argues that the tort claim notice by a faculty member is not a public record under ORS 353.260. That statute relates to personnel records maintained by OHSU. Under ORS 353.260(7), the term “personnel records” is defined as
“records containing information kept by the university concerning a faculty member and furnished by the faculty member or by others about the faculty member at the member’s or at the university’s request, including but not limited to information concerning discipline, membership activity, employment performance or other personal records of individual persons.”
ORS 353.260(1) authorizes OHSU to “adopt policies governing access to university personnel records that are less than 25 years old.” ORS 353.260(2) requires those policies to “require that personnel records be subjected to restrictions on access unless the president of the university finds
“[a]ny category of personnel records specifically designated as confidential pursuant to valid policies or orders as provided in this section shall not be deemed a public record for the purposes of ORS 192.420.”
OHSU claims that, under its adopted policies, all “information in the personnel file, apart from that identified above [stating exceptions that do not include tort claim notices], shall be confidential and restricted to access as hereinafter set forth.” OHSU asserts that this designation suffices to disqualify the faculty member tort claim notice as a public record under ORS 353.260(6). We disagree. The summary judgment record does not show that the faculty member tort claim notice is actually “in the personnel file” of the affected faculty member. Instead, the record shows that the tort claim notices are regularly kept by claims managers in OHSU’s risk management department. Accordingly, the reviewing court did not err in concluding that the faculty member tort claim notice is a public record subject to disclosure under ORS 192.420.
V. STUDENT-RELATED TORT CLAIM NOTICE
OHSU finally claims that the court erred in ordering disclosure of the student name in the tort claim notice pertaining to “general liability involving students.” OHSU asserts that the information is exempt from disclosure under ORS 192.502(8) as “information the disclosure of which is prohibited by federal law or regulations.” Specifically, OHSU contends that FERPA applies to OHSU and protects the privacy of a student’s “education records.” 20 USC § 1232g. FERPA implementing regulations define “education records” to mean “those records that are *** [d]irectly related to a student * * * [and] [m]aintained by an educational agency or institution or by a party acting for the agency or institution.” 34 CFR § 99.3. We conclude that a student tort claim notice is not an “education record” if it is not “directly related to a student [⅛]” activities or status as a student. We remand to the reviewing court to examine the
VI. CONCLUSIONS
In sum, we conclude that any information contained in a patient tort claim notice may be exempt from disclosure under ORS 192.496(1) if the notice contains “information about the physical or mental health or psychiatric care or treatment of a living individual,” the disclosure of which would be an unreasonable invasion of privacy, and if The Oregonian has not shown that “the public interest requires disclosure [of the record] in the particular instance.” We also conclude that any information in the student tort claim notice may be exempt from disclosure if the notice describes and directly relates to activities of a student or the educational status of a student. We remand the case to the reviewing court to make those determinations. The reviewing court did not err in directing the disclosure of the other information. Because The Oregonian may no longer be entitled to an award of attorney fees as a matter of right, ORS 192.490(3), we reverse the supplemental judgment awarding those fees.
Reversed and remanded.
When Congress passed the Health Insurance Portability and Accountability Act (HIPAA) in 1996, it empowered the federal Department of Health and Human Services (DHHS) to promulgate regulations related to the protection of patient health information and the circumstances under which that information could be disclosed if Congress failed to enact legislation addressing those matters within three years. Citizens for Health v. Leavitt, 428 F3d 167, 172 (3rd Cir 2005), cert den, 549 US 941 (2006). Congress did not meet its deadline, and DHHS promulgated the Privacy Rule. Id.
Under those statutes, a person denied the right to inspect or copy a public record under the OPRL may seek review by the attorney general or a district attorney, depending on the type of public body, to determine if a public record may be withheld from public inspection.
In general, the OPRL does not require public bodies to create new public records. The fact that OHSU did so in this case does not change the public records disclosure issues that are presented. The parties assume, as do we, that the question presented in this case is whether the requested information (name of claimant, date of the alleged tort, name of claimant’s attorney) can be redacted from the tort claim public records that could otherwise be provided to The Oregonian pursuant to its demand and whether OHSU may disclose any of the information in some of the tort claim notices. For purposes of this case, the compilation of that information into a different public record does not change the issues that must be resolved.
Under ORS 192.460 (l)(a), when a district attorney carries out the review functions for public records disputes involving “a public body other than a state agency,” as here, the procedures in ORS 192.450, for resolution of public records disputes by the attorney general for state agencies, apply. Under ORS 192.450(2), when the attorney general orders disclosure of a public record,
“the state agency shall comply with the order in full within seven days after issuance of the order, unless within the seven-day period it issues a notice of its intention to institute proceedings for injunctive or declaratory relief [in the appropriate circuit court]. ⅜⅜* The state agency shall institute the proceedings within seven days after it issues its notice of intention to do so.”
OHSU timely instituted that type of proceeding.
An exemption “means merely that the public body is not obligated to disclose under ORS 192.420.” Guard Publishing Co., 310 Or at 38 n 6. Thus, if a “public body is satisfied that a claimed exemption from disclosure is justified, it may, but is not required to, withhold disclosure of [exempt] information” under the OPRL. Id. at 37-38 (emphasis added). Apart from the OPRL, other laws may inhibit the disclosure of records that are confidential or privileged. See, e.g., ORS 646.461 - 646.475 (preservation of trade secrets).
Under ORCP 55 H, special protection can be given, including a qualified protective order, against discovery by subpoena of “individually identifiable health information,” which is defined to mean
“information that identifies an individual or that could be used to identify an individual; that has been collected from an individual and created or received by a health care provider ***; and which relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.”
ORS 192.553(l)(a) declares that an individual has the “right to have protected health information of the individual safeguarded from unlawful use or disclosure.” “Protected health information” is defined to mean “individually identifiable health information that is maintained * ⅜ * by a covered entity [including OHSU].” ORS 192.556(ll)(a). ORS 192.556(8) defines “individually identifiable health information” to mean
“any oral or written health information in any form or medium that is: (a) [c]reated or received by a covered entity ⅜⅜⅜; and (b) identifiable to an individual *** that relates to: (A) [t]he past, present or future physical or mental health or condition of an individual; (B) [t]he provision of health care to an individual!.]”
We note that, whatever relevance those statutes have in classifying privacy interests and the privacy/public interest balancing under the OPRL, they do not operate otherwise to limit or affect the disclosure of public records under the OPRL. ORS 192.558(2)(b) provides, in part, that “[a] health care provider or state health plan: * * * [m] ay use or disclose protected health information of an individual without obtaining an authorization * ⅜ * [a]s otherwise permitted or required by state or federal law or by order of the court.” Here, ORS 192.420(1) provides The Oregonian with a “right to inspect” any public records, and ORS 192.440(1) requires OHSU to provide The Oregonian copies or a reasonable opportunity to inspect the public records that The Oregonian “has a right to inspect.” Those statutes further permit OHSU to disclose those same records even if a public records exemption otherwise applies. Guard Publishing Co., 310 Or at 38.
It is undisputed that OHSU is a covered entity under HIPAA. See 45 CFR § 160.103 (“covered entity” means “[a] health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter”).
The parties raise no issue about whether the tort claim notices are conditionally exempt from disclosure under ORS 192.501(1) as “[r]ecords of a public body pertaining to litigation to which the public body is a party if the complaint
Analogously, in Port of Portland v. Ore. Center for Environ. Health, 238 Or App 404, 409-10, 243 P3d 102 (2010), rev den, 350 Or 230 (2011), the issue was whether the exemption in ORS 192.502(9) for “[p]ublic records or information the disclosure of which is prohibited or restricted or otherwise made confidential or privileged under Oregon law” applied to a joint-defense agreement. We concluded that the entire agreement was a “confidential communication” under the exemption, thus “dispos [ing] of defendants’ argument that the Port should separate exempt and nonexempt material under ORS 192.505.” Id. at 413.
OHSU represents that it offered the individual notices to the court for an in camera inspection, but the court declined to do so.